Compliance per app

If you build AI into your own product, auditors and customers ask about that app, not your whole organization. Compliance per app answers for one app at a time.

Open Govern → Frameworks → Apps and choose an app. Each app instrumented with the Shield360 SDK is listed by its service name.

What the app page shows

• Inventory record: owner, purpose, approval and expiry, risk rating and NAIC tier, from the AI inventory.
• EU AI Act: the app’s class, your role and any Annex III area, with the Articles that apply (EU AI Act).
• Impact assessment status (Impact assessments).
• Model use: the app’s model calls checked against your approved models.
• Evaluation coverage: how much of its traffic is evaluated.
• Guard and prompt-injection counts, linking to Security when your organization has it.
• Retention in effect. This is set per environment, and labelled as such.
• Linked risks and findings.
• Control status for the framework and period you choose. Each check is labelled App when it was measured for this app alone, or Organization-wide when the evidence is shared.

Evidence package for one app

Select Download app evidence package. It is the same signed evidence package as for an environment, scoped to the app:

• App-scoped: control status, inventory, the risk register and heat map, findings and impact assessments.
• Organization-wide: everything else, included and labelled as such.

The manifest records the scope under its signature, so a reviewer can tell an app package from an environment package.

Apps monitored only by the SDK

If your organization has no enrolled computers, checks that rely only on the endpoint collector (coding agents, devices and AI accounts) read Not applicable to SDK-only monitoring instead of showing a gap.

Permissions

Viewing app compliance needs View the compliance overview.

Next steps

• Framework controls
• Evidence package
• AI inventory