Same engine, EU AI Act today, NIST RMF tomorrow

说明与用途

Opencomplai 的风险引擎将核心逻辑与法规映射分离，支持 EU AI Act、NIST RMF、ISO 42001 等多种法规，避免重写核心代码。

问题

Integrating new regulatory frameworks into a risk engine without rewriting core logic.

结果

Risk assessment logic remains unchanged across regulations; only mapping layer changes, reducing maintenance and rewrite effort.

工作流

• 1. Build core engine to evaluate controls and policy mappings without regulation names.
• 2. Create a mapping layer that translates framework‑specific terms to core primitives.
• 3. Load appropriate mapping in CLI/services for desired regulation.
• 4. Run risk assessment using core engine and selected mapping.

证据

I built the risk engine (packages/core) so it doesn't know what "EU AI Act" means. It knows controls, evidence, and policy mappings. The regulation-specific part is a mapping layer on top, not baked into the primitives.

来源

That split matters because the alternative, hardcoding "Annex III" and "Article 5" into the core assessment logic, turns every new framework into a rewrite.

来源

Concretely: core has no HTTP dependency and no regulation-specific naming in its primitives. It evaluates controls and policy mappings, full stop. The CLI and services consume that engine and apply whichever mapping is loaded.

来源