Compliance

Inkog maps every finding to industry compliance frameworks, enabling automated compliance reporting for audits and security reviews.

Supported Frameworks

Framework	Description	Coverage
OWASP LLM Top 10	AI-specific vulnerability taxonomy	Full
EU AI Act	European AI regulation	Articles 13-15
NIST AI RMF	AI risk management framework	MAP, MEASURE
CWE	Common Weakness Enumeration	20+ mappings

How It Works

Every Inkog finding includes compliance metadata:


{
  "id": "finding_001",
  "pattern": "infinite_loop_semantic",
  "severity": "critical",
  "compliance_mapping": {
    "cwe_ids": ["CWE-835", "CWE-400"],
    "owasp_items": ["LLM06:2026"],
    "owasp_agentic_threats": ["ASI08"],
    "eu_ai_act_articles": ["Article 15.1"],
    "nist_categories": ["MEASURE 2.5"],
    "iso_42001_clauses": ["8.2", "8.3", "A.4.5", "A.6.2.6"]
  }
}

Compliance Reports

Generate compliance-focused reports:


# JSON with compliance data
inkog -output json . > compliance-report.json
 
# Extract OWASP violations
cat compliance-report.json | jq '.compliance_report.owasp_llm_top_10'

Framework Coverage

OWASP GenAI LLM Top 10 (2026)

OWASP GenAI LLM Top 10 2026. Full status definitions and notes: OWASP LLM Top 10 coverage.

OWASP LLM	Inkog rules
LLM01: Prompt Injection	`prompt_injection`, `prompt_template`, `skill_tool_poisoning`
LLM02: Sensitive Information Disclosure	`cross_tenant`, `hardcoded_credentials`, `logging_sensitive_data`, `pii_filter_wiring`, `skill_cross_origin`, `unsafe_env_access`
LLM03: Excessive Agency	`excessive_permissions`, `goal_conflict_detection`, `missing_authz`, `missing_oversight`, `skill_autonomy_abuse`, `skill_excessive_permissions`, `token_validation`
LLM04: Supply Chain	`skill_supply_chain`, `supply_chain`, `unsafe_deserialization`
LLM05: Data and Model Poisoning	`data_poisoning`
LLM06: Unbounded Consumption	`context_exhaustion`, `infinite_loop`, `missing_rate_limits`, `recursive_tool_calling`, `token_bombing`
LLM07: Misinformation	`overreliance`
LLM08: Hidden Context Exposure	`system_prompt_leak`
LLM09: Vector and Embedding Weaknesses	`rag_overfetching`
LLM10: Improper Output Handling	`command_injection`, `exec_eval`, `output_validation`, `path_traversal`, `sql_injection`, `ssrf`

Full OWASP LLM mapping →

EU AI Act

Article	Focus	Inkog Rules
Article 13	Data Governance	`hardcoded_credentials`, `prompt_injection`
Article 14	Human Oversight	`infinite_loop`, `tainted_eval`, `sql_injection_via_llm`
Article 15	Accuracy & Cybersecurity	`hardcoded_credentials`, `output_validation_failures`

Full EU AI Act mapping →

NIST AI RMF

Category	Focus	Inkog Rules
MAP 1.1	Input/Output Validation	`prompt_injection`, `output_validation_failures`
MAP 1.2	Data Governance	`logging_sensitive_data`, `unsafe_env_access`
MAP 1.3	System Reliability	`infinite_loop`, `context_exhaustion`
MEASURE 2.2	Security Risk	`hardcoded_credentials`
MEASURE 2.4	AI System Risks	`tainted_eval`, `sql_injection_via_llm`

Full NIST AI RMF mapping →

Audit Trail

For compliance audits, save scan reports with timestamps:


# Timestamped compliance report
inkog -output json . > "reports/inkog-$(date +%Y%m%d-%H%M%S).json"

Store reports in version control or a compliance management system for audit trails.

CI/CD Integration

Fail builds on compliance violations:


# GitHub Actions
- name: Compliance Check
  run: |
    inkog -output json . > report.json
    # Check for EU AI Act violations
    VIOLATIONS=$(jq '.compliance_report.eu_ai_act | add' report.json)
    if [ "$VIOLATIONS" -gt 0 ]; then
      echo "EU AI Act compliance violations detected"
      exit 1
    fi

Custom Compliance Policies

Enterprise customers can define custom compliance policies mapping findings to internal security standards.

Contact support@inkog.io for custom compliance integration.