Skip to content
TruthVouch Docs

For Compliance Officers

You’re managing AI compliance across 55+ regulatory frameworks. Your auditors want proof of monitoring, your board wants quarterly reports, and regulators are asking about EU AI Act Article 73 incident notifications. This quickstart gets you from zero to audit-ready documentation in under one hour.

The TruthVouch Difference

Traditional approach: Manual AI inventory, manual framework selection, manual gap identification, manual task creation, quarterly audits. Time required: 3-6 months for first audit-ready report.

With TruthVouch: AI auto-discovers your systems, auto-identifies applicable frameworks, auto-scans for gaps, auto-creates remediation tasks, continuous monitoring. Time required: Under 1 hour to your first audit-ready report.

Step 1: Take the AI Maturity Assessment (15 minutes)

Before you run scans or remediate gaps, understand your organization’s compliance readiness and let TruthVouch auto-generate your compliance roadmap.

  1. Go to TruthVouch AI Advisor Assessment (or click “Take Assessment” after signing up)
  2. Answer 25 quick questions about your current AI governance, compliance practices, and risk posture (15 minutes)
  3. You’ll get:
    • Your AI Maturity Score (0-100) across 5 dimensions: Strategy, Governance, Technical, Ethical, Operational
    • Industry benchmark (how you compare to peers in your sector)
    • Which regulatory frameworks are most critical for your organization (auto-identified based on your industry, regions, and AI usage)
    • Compliance roadmap with ranked priorities
    • Recommendations for which TruthVouch modules to activate first

Why this first? The assessment auto-identifies applicable frameworks so you don’t waste time on irrelevant regulations. It also gives you a baseline maturity score to measure progress and justify investments to your board.

Save this report — you’ll reference it throughout your compliance journey.

Step 2: Auto-Discover Your AI Systems (10 minutes)

TruthVouch auto-discovers AI systems across your organization — no manual inventory spreadsheet needed.

  1. Go to app.truthvouch.ai and sign up with your work email
  2. During onboarding, TruthVouch will auto-discover systems via:
    • Cloud connectors (AWS, Azure, GCP APIs) — Auto-finds ML models, SageMaker, Vertex AI instances
    • ITSM integrations (ServiceNow, Jira) — Auto-discovers AI system tags and documentation
    • Code repository scanning (GitHub, GitLab) — Finds open-source LLM implementations, ML frameworks
    • Log analysis — Identifies AI tool usage from infrastructure and application logs
  3. Review and approve the discovered systems
  4. Mark which ones you govern (vs. which are shadow AI you’re monitoring)

Typical result: Teams discover 3-5× more AI systems than they initially realize — often 15-50 systems depending on org size. This visibility alone is worth the investment.

Based on your AI Maturity Assessment, TruthVouch pre-selects applicable frameworks. Review and confirm.

  1. From the dashboard, go to Compliance → Framework Selection
  2. You’ll see frameworks already highlighted from your assessment:
    • Your region’s critical regulations (EU AI Act if selling to EU, GDPR if processing EU data, CCPA for California, etc.)
    • Industry-specific requirements (HIPAA for healthcare, SOC 2 for SaaS, PCI DSS for payments, etc.)
    • Risk-based priorities (High-Risk AI systems require stricter frameworks)
  3. Toggle additional frameworks if needed — 55+ frameworks available
  4. Save

Pro tip: Don’t select all frameworks. Compliance is more effective when focused on what actually applies to you. Your assessment identified the critical ones.

Step 4: Run Your First Automated Compliance Scan (15 minutes)

Let TruthVouch automatically scan for compliance gaps across all selected frameworks. The scan does the heavy lifting.

  1. Go to Compliance → Scans
  2. Click New Scan
  3. Select:
    • Frameworks: All your enabled frameworks (or subset for a pilot)
    • AI Systems: All systems (or specific ones to start)
    • Scope: Full audit or quick assessment
  4. Click Start Scan and TruthVouch does the rest:

The scan will automatically:

  • Query 16+ infrastructure connectors (AWS, Azure, GitHub, Slack, Datadog) for control evidence
  • Auto-collect training records, policy documents, audit logs
  • AI-map findings to specific framework articles and requirements
  • Identify gaps and non-conformances
  • Classify risk levels per EU AI Act categories
  • Estimate remediation effort and priority for each gap
  • Auto-generate evidence summaries

Time to complete: 15-20 minutes for 55+ frameworks across all systems (what would take 2-3 weeks manually)

Result: A detailed, audit-ready gap report — not a vague “you’re not compliant” message.

Step 5: Review Auto-Generated Gaps & Create Remediation Tasks (20 minutes)

Once the scan completes, you’ll see a detailed gap report with recommended actions.

  1. From the scan results, review the Gaps tab

    • Sorted by severity (Critical, High, Medium, Low)
    • Each gap shows: framework article, requirement, evidence needed, remediation steps, responsible team
    • Example: “EU AI Act Article 5 — Prohibited Practices: No risk assessment on high-risk AI systems”

  2. For each Critical or High gap, click Create Remediation Task

    • TruthVouch auto-creates tasks in Jira or ServiceNow (if connected)
    • Includes: requirement, evidence needed, responsible team, deadline
    • Links to helpful resources (templates, documentation, regulatory guidance)

  3. Assign tasks to:

    • Your team (for policy and process gaps)
    • Engineering (for technical controls like encryption, audit logging)
    • HR (for training program gaps)
    • Legal (for contract and documentation gaps)

Result: An actionable remediation plan with effort estimates — not a vague compliance checklist.

Step 6: Set Up Continuous Compliance Monitoring (10 minutes)

This is the key to never being audited unprepared: instead of scanning quarterly, TruthVouch continuously monitors for compliance.

  1. Go to Compliance → Monitoring

  2. Enable Continuous Scan — runs automatically every:

    • Daily (recommended) for Critical frameworks (EU AI Act, GDPR)
    • Weekly for others
    • Custom schedule available

  3. Set up Framework-Specific Monitors:

    • EU AI Act Article 73 Incident Notifications: When an AI system causes harm, TruthVouch auto-generates incident notification draft
    • GDPR Article 33 Breach Reporting: Tracks 72-hour deadline for notifying authorities
    • ISO 42001 Control Testing: Continuous verification that you’re executing defined controls

  4. Configure Alerts:

    • Critical gaps discovered → Email to Compliance Officer + Slack
    • Article 73 incident threshold exceeded → Escalate to Legal + CEO
    • Deadline approaching (e.g., 72-hour notification window) → Daily reminder
    • New framework requirements released → Auto-flagged for review

Result: Compliance officers are alerted to issues before auditors are, not after.

Step 7: Generate AI-Powered Board Reports (5 minutes)

Your board and auditors need proof you’re monitoring AI for compliance. TruthVouch auto-generates reports.

  1. Go to Compliance → Reports
  2. Click New Report
  3. Select:
    • Report type: Compliance Status (for board), Audit-Ready Docs (for auditors), Regulatory Digest (for execs)
    • Timeframe: Last 30 days, Last 90 days, YTD
    • Frameworks: Which ones to include?
  4. Choose Export Format:
    • PDF (for board presentations — board-ready design included)
    • OSCAL JSON (for auditors, ServiceNow, Jira)
    • CSV (for detailed analysis)
  5. Click Generate — takes 2-5 minutes

Your report will include:

  • Compliance score per framework with trend
  • Gap status (open, in progress, resolved)
  • Remediation timeline and progress
  • Incident count and resolution time
  • Control testing results
  • Training completion rates
  • Next quarter’s focus areas

What it looks like to your board: “We’re monitoring 55+ frameworks across 30 AI systems. 94% of gaps are on track. Next audit: Q2.”

Step 8: Set Up Your Trust Center (optional, 5-10 minutes)

Some organizations (especially B2B SaaS) publish a customer-facing Trust Center — public proof of compliance.

  1. Go to Compliance → Trust Center
  2. Click Enable Public Trust Center
  3. Select which frameworks to display publicly (recommend: ISO 42001, SOC 2, GDPR, EU AI Act)
  4. TruthVouch auto-generates a public-facing page showing:
    • Your compliance status per framework
    • Latest audit date
    • Key controls and policies (without confidential details)
    • Link to full security documentation

Your customers can then view yourcompany.com/trust and see proof of compliance at a glance.

What Happens Next (Month 2+)

Once your initial scan is done and gaps are assigned:

  1. Weekly Monitoring (15 minutes)

    • Check dashboard for new critical gaps
    • Review remediation task progress
    • Update deadlines if needed

  2. Monthly Deep Dives (30 minutes)

    • Review framework-specific dashboards
    • Check Article 73 and Article 33 incident thresholds
    • Plan for upcoming Q-end scans

  3. Quarterly Reporting (1 hour)

    • Run compliance scan across all systems and frameworks
    • Generate board-ready report
    • Compare quarter-over-quarter progress
    • Plan next quarter’s remediations

  4. Annual Audit Prep (2-4 hours over 2 months)

    • Generate audit-ready OSCAL and PDF packages
    • Collect evidence from remediated gaps
    • Prepare DPIAs, algorithmic impact assessments
    • Schedule auditor review

Key Framework Overview

EU AI Act (37 articles, priority: Critical if you sell to EU)

  • Articles 1-15: Scope and requirements
  • Articles 16-50: Risk-based requirements (High-Risk AI vs. Prohibited)
  • Article 73: Incident notification (mandatory when systems cause substantial harm)
  • Annex IV: Mandatory technical documentation for High-Risk systems

ISO 42001 (requirements across 6 clauses)

  • Clause 4: Context of the organization
  • Clause 5: Leadership and governance
  • Clause 6: Planning (risk assessment, AI inventory)
  • Clause 7: Support (competence, awareness, documentation)
  • Clause 8: Operations (incident management, performance monitoring)
  • Clause 9: Performance evaluation (compliance audits)

GDPR (90+ articles, priority: Critical if you have EU users)

  • Article 33: Personal data breach notification (72-hour deadline)
  • Article 35: Data Protection Impact Assessment (required for high-risk processing)
  • Recital 71: Meaningful information about AI decision-making

SOC 2 Type II (6 trust service criteria)

  • CC: Common Criteria (security, availability, processing integrity)
  • A: Availability controls
  • C: Confidentiality controls
  • PII: Personal information safeguarding

Questions?

  • Onboarding: Your assigned Compliance Success Manager will guide you
  • Framework questions: Use the Regulatory FAQ (AI chatbot with context of your compliance posture)
  • Report generation: See Compliance Reporting
  • Integration issues: Contact support@truthvouch.ai

You’re now set up for continuous compliance monitoring. Within 1 hour, you’ll have your first audit-ready report. Within 30 days, your board will have proof that you’re systematically monitoring AI for compliance.