Truveil is a rule-based, deterministic scoring engine. Same evidence in, same scores out. Calibrated against primary regulatory text across six major frameworks. This page explains the methodology at the level that matters for buyers, auditors, and the customers who will trust your audit reports.
Truveil scores every agent run against four accountability dimensions. Each dimension corresponds to a category of regulatory obligation that recurs across all six frameworks Truveil scores against. The frameworks are not the point. They are the source: six regulatory regimes that together document how AI systems fail the people they touch, distilled into signals an engine can score.
Every accountability signal is classified as either an AI-conduct signal (how the agent behaves: oversight, disclosure, reversibility) or a data-handling signal (how personal data is treated: accuracy, freshness, validation).
Conduct signals anchor to binding AI law where one exists, such as the EU AI Act in the European Union. In jurisdictions without binding AI-conduct law, they anchor to Truveil methodology, informed by the EU AI Act and NIST AI RMF as reference standards, and the report says so in those words.
Data-handling signals anchor to the jurisdiction's data-protection law: the DPDP Rules in India, the GDPR in the EU.
Where a provision is not yet in force, the report carries its effective date rather than asserting a present-tense breach. An audit that cites law you are not yet bound by, as if you were, is not an honest audit.
Two things sit outside that split.
Role vocabulary is one. Provider, Deployer, and Distributor are EU AI Act terms with no equivalent in any other AI instrument, so where a build is outside EU scope Truveil names the role as a reference framing for how the system is structured, not as a determination under the declared jurisdiction's law.
Prohibited practices are the other. A prohibition is a categorical bar, not a design standard, so it cannot honestly be cited as something a build is informed by. Where a build outside EU scope touches one, Truveil reports it as a forward-looking design signal and points at the data-protection law that does reach the practice today, rather than telling a customer their build may be unlawful under a regulation that does not apply to them.
Can the agent explain what it did, why, and on what evidence? Does it disclose its AI nature to affected users?
EU AI Act Articles 12, 13, and 50. NIST AI RMF Measure. DIFC Regulation 10 transparency obligations. Singapore MGF-GenAI. In India, transparency signals anchor to Truveil methodology informed by the EU AI Act and NIST as reference standards; DPDP notice obligations apply to personal-data collection from 13 May 2027.
Is there a named owner? A documented risk assessment? Human oversight where required? Approval gates on consequential decisions?
EU AI Act Articles 9, 14, 16, and 26. NIST AI RMF Govern. DIFC Regulation 10 accountability and Autonomous Systems Officer provisions. ISO/IEC 42001 leadership and accountability requirements. In India, accountability signals anchor to Truveil methodology informed by these reference standards; DPDP Rule 13 binds Significant Data Fiduciaries from 13 May 2027.
Is input data sourced from documented places? Is it fresh, validated, and grounded in cited evidence? Has bias evaluation happened where applicable?
EU AI Act Articles 10 and 15. NIST AI RMF Measure. Singapore MGF-GenAI data governance. In the EU, the GDPR. In India, DPDP Rules 6 and 8, effective 13 May 2027.
Can decisions be reversed? Is there a kill switch? Override controls? An appeal channel?
EU AI Act Articles 14(4), 20, 85, and 86. NIST AI RMF Manage. DIFC Regulation 10. ISO/IEC 42001 operational control and impact assessment. In India, DPDP Rule 14 anchors appeal and correction rights, effective 13 May 2027.
Not every agent is judged the same way. Each registered agent is classified into one of four categories from declared, structured attributes, and the emphasis each dimension carries in the composite grade varies by category.
The ordering below is Truveil's interpretation of the relative emphasis in the instruments it scores against, implemented in a stamped engine version. The numeric calibration is proprietary, and the classification and weighting method is the subject of pending patent applications. Obligations belong to the regulations; the emphasis belongs to the methodology.
Agents that score, rank or recommend in decisions affecting people: hiring, credit, triage. Accountability leads, because evidenced human oversight is the first protection where a person is affected, and the priority is stopping a bad decision, not undoing one. This is the ordering the EU AI Act's Article 14, effective 2 December 2027, is built around.
Grid management, vehicles, surgery assistance, industrial automation.
Agents that act on physical or operational systems at machine speed. Reversibility and accountability lead: the stop path, the override, and the operator who answers for them become the decisive safeguards once actions execute faster than review, the design logic of Article 14(4)(e)'s safe-halt requirement, effective 2 December 2027.
Market briefs, literature review, competitive analysis, commercialisation strategy.
Agents that research, analyse and synthesise without consequential effect on identified persons. Transparency and data trust lead: the failure modes here are unsupported synthesis and weak provenance, not unsupervised action. Periodic validation and escalation are proportionate for this category; the methodology does not demand per-output approval of an agent whose output a person reads before anything happens. Regulatory carve-outs cover fields like bias evaluation that do not apply to research agents with no protected attributes in scope.
Agents doing bounded analytical tasks: summarisation, formatting, internal tooling. Data trust leads, because the residual risk is quietly wrong data rather than consequential action. Where such an agent interacts with people directly, the transparency duty in Article 50 of the EU AI Act, in force now, is scored. A transparency baseline applies to this category regardless.
Scored means the engine grades every run against these six. Cited means Truveil answers from fourteen, including advisory and conditional instruments that never enter a grade.
Truveil's scoring engine is calibrated against primary regulatory text from six major frameworks. When your agent operates in a single jurisdiction, the audit cites that framework directly. When your agent operates across jurisdictions, Truveil applies the strictest rule per dimension and cites every applicable framework in the audit report.
Articles 5, 9 to 15, 22, 25 to 27, 49, 72 to 73. Annex III high-risk categories. Article 14 human oversight. FRIA scope for essential services. Provider-deployer determination. Article 22 GDPR automated decisions.
Govern, Map, Measure, Manage functions. Generative AI profile (AI 600-1). Sectoral overlays for credit (FCRA), employment (EEOC), clinical (FDA), and housing (FHA).
Rule 3 notice, Rule 6 security safeguards and one-year log retention, Rule 8 erasure and retention timing, Rule 9 contact for processing questions, Rule 13 DPIA and audit cadence, Rule 14 Data Principal rights. Significant Data Fiduciary obligations. Section 33 penalties. Substantive Rules take effect 13 May 2027; Truveil applies forward-looking framing until then.
Autonomous Systems Officer where high-risk processing applies. Evidence of compliance on request under Regulation 10.2.2. Significant-decision oversight. Certification pathway.
AI management system requirements. Leadership commitment, risk assessment, AI system impact assessment, operational planning and control, performance evaluation, continual improvement. Certifiable by accredited bodies; Truveil evidence maps to certification preparation.
Nine dimensions of accountability. AI Verify testing alignment. MGF-GenAI profile. IMDA expectations for deployers and developers.
Truveil's engine is updated when these frameworks change. Updates flow through to your audit reports automatically. No version drift between what regulators require and what Truveil scores against.
Every audit Truveil produces is reproducible. The engine is rule-based with no probabilistic inference, no LLM-driven scoring decisions, no hallucinated compliance claims. Two auditors running your logs through Truveil reach the same conclusion every time. This matters for regulatory defensibility: an audit report that cannot be reproduced cannot be defended. The log the engine reads is hash-chained and countersigned by an independent RFC 3161 timestamping authority.
Truveil's scoring engine is calibrated against primary regulatory text retrieved from authoritative sources. Truveil's analytical layer sits on top of structured, JSON-grounded primary regulatory text. When the EU AI Act is updated, the JSON updates and Truveil's scoring follows. When India DPDP Rules issue clarifications, they propagate through the engine. Your audit report cites the framework, the article, and the obligation that applies.
Truveil does not care what model powers your AI agent. GPT-4o, Claude, Gemini, an open-source fine-tune: the audit layer treats them identically. Switch models without losing your audit history or your compliance baseline.
The inputs to a re-derivation are anchored in time by a party that is not Truveil. The unit of assessment is the run, and the grade is evidence about a completed run, never an authorisation gate for a pending action. Truveil does not decide what an agent may do. It grades what the record shows the agent did.
Truveil generates audit-grade reports in under 30 seconds. Reports include grade, dimension scores, agent category context, framework citations, and remediation guidance. Plain language for legal and procurement teams. Regulatory citations for defence. Tracked over time so you can demonstrate improvement to regulators, auditors, and clients.
