ADB Forge
Book a demo

Evidence and controls

Compliance built in: controls that leave a record

“Compliance built in” means identifiable controls, checks and records, not automatic legal compliance. Six controls are built into every agent, and each one writes evidence your compliance, audit and model-risk teams can check for themselves. Regulatory approval remains your organisation’s decision.

The six built-in controls

Choose a control to see what it does and a sample of the record it writes.

Policy engine

Sets permissions, approval thresholds and action limits for each agent, with a switch to stop it at once.

Sample audit-record entry Illustrative

2026-03-14 09:12:44 policy.decision  agent=collections-v7  action=offer_payment_plan  amount=4200  limit=5000  result=ALLOW  rule=PP-03

Framework mappings

Mapped to the frameworks you already work with

Controls are mapped to international frameworks, and country packs add local rules. Each mapping shows which control addresses which requirement, so your teams can trace one to the other.

  • European Union emblemEU AI ActEU Artificial Intelligence Act
  • ISO/IEC 42001AI management systems standard
  • NIST — National Institute of Standards and TechnologyNIST AI RMFUS AI Risk Management Framework
  • European Union emblemGDPREU General Data Protection Regulation
  • European Union emblemDORAEU Digital Operational Resilience Act
  • Model-risk guidanceFor banks and insurers
  • Data protection lawsNational data protection
  • Central-bank rulesAI and outsourcing
  • UAE PDPLFederal Decree-Law No. 45 of 2021
  • Saudi Arabia PDPLPersonal Data Protection Law
  • Qatar PDPPLLaw No. 13 of 2016
  • Bahrain PDPLLaw No. 30 of 2018
  • Oman PDPLRoyal Decree 6/2022
  • Egypt PDPLLaw No. 151 of 2020
  • Kenya Data Protection ActAct No. 24 of 2019
  • Tanzania PDPAPersonal Data Protection Act, 2022
  • Uganda DPPAData Protection and Privacy Act, 2019
  • Rwanda DPP LawLaw No. 058/2021
  • Nigeria NDPANigeria Data Protection Act, 2023
  • South Africa POPIAProtection of Personal Information Act
  • India DPDP ActDigital Personal Data Protection Act, 2023

Validation reports

Prepared for model-risk review

Model-risk review is the independent check that banks and insurers apply to models before use. Each agent version gets a report covering scope, data, results, limitations and controls, with space for the people who sign it off.

[Bank name] · ProductionIn-country region

Validation / Reports / VR-0817

Validation report · call review v8

Illustrative · sample data
Draft · generated 09:16:40Awaiting sign-off
  1. §1Scope and intended usePost-call conduct review, retail cards, two languages
  2. §2Data1,200 anonymised calls from the bank’s own archive
  3. §3Results6 of 6 agreed thresholds met
  4. §4LimitationsNot validated for business-banking calls
  5. §5ControlsHuman approval on product switches; stop switch tested
Model riskComplianceBusiness owner

Next step

See Forge on a use case like yours

See your use case in a demo. If it fits, we agree a pilot using your approved data and success criteria.

Book a demo

Before a pilot begins, we agree

  1. One initial use caseA single, well-defined task to start with.
  2. Data and environmentWhich data the agent may use and where the pilot runs.
  3. Success criteriaThe tests and thresholds that count as a pass.
  4. Evaluation deliverablesValidation results, audit records and a validation report.
  5. The decision processWho reviews the evidence and decides on production.

Pilot scope and fees are agreed before work begins.