Regulatory Coverage
Draxion's compliance engine is grounded in the actual statutory text of 8 major regulatory frameworks — not summaries, not templates. Every policy and report cites the specific article that justifies each claim.
Why It Matters
Most AI compliance tools generate reports by asking a language model to write about regulations from memory. The output sounds authoritative. The citations are often wrong.
Draxion works differently. Before generating any policy, report, or compliance claim, it retrieves the actual regulation text from an embedded knowledge base of 48 curated regulatory chunks — the verbatim statutory text of every framework we cover.
This means every claim Draxion makes is grounded in a specific article. Every citation is real. Every report can be verified by your legal team, your auditors, and your regulators.
Your question or report request
Regulatory knowledge base retrieval
48 chunks · GDPR · EU AI Act · HIPAA · SOC 2 · ISO 27001 · NIST · SOX · FERPA
Grounded output with citations
Every claim cites a real article. Zero hallucinations.
Coverage matrix
Each framework is filed against the clauses Draxion cites and the documents it produces — 32 document types in total. Open any row for the full record.
| Framework | Jurisdiction | Articles covered | Documents |
|---|---|---|---|
| GDPR | European Union | Articles 5, 13, 17, 25, 28, 32, 33, 35 | 4 |
| EU AI Act | European Union | Articles 5, 9, 10, 13, 14, 17, 50, 51 | 4 |
| HIPAA | United States | Privacy Rule, Security Rule, Breach Notification Rule, HITECH Act provisions | 4 |
| SOC 2 | United States (AICPA) | Trust Service Criteria: CC1–CC9, A1, C1, PI1, P1–P8 | 4 |
| ISO 27001 | International | Annex A Controls: 5.7, 5.23, 8.8, 8.25, 8.30, 8.34 | 4 |
| NIST AI RMF | United States (Federal) | Govern, Map, Measure, Manage functions — all 164 subcategories | 4 |
| SOX | United States | Section 302, Section 404, Section 906 | 4 |
| FERPA | United States | 34 CFR Part 99 — Sections 99.3, 99.30, 99.31, 99.60-99.67 | 4 |
Frameworks Covered
One file per framework: who it binds, the clauses Draxion cites, the documents it produces, and what non-compliance costs.
General Data Protection Regulation
Who needs it
Any organization processing personal data of EU residents
Articles covered
Articles 5, 13, 17, 25, 28, 32, 33, 35
Risk if ignored
Up to €20M or 4% of global annual turnover per violation
What Draxion generates
European Union Artificial Intelligence Act
Who needs it
Any organization using, deploying, or distributing AI systems in the EU
Articles covered
Articles 5, 9, 10, 13, 14, 17, 50, 51
Risk if ignored
Up to €35M or 7% of global annual turnover for prohibited AI
What Draxion generates
Health Insurance Portability and Accountability Act
Who needs it
Healthcare organizations, business associates, and any entity handling Protected Health Information
Articles covered
Privacy Rule, Security Rule, Breach Notification Rule, HITECH Act provisions
Risk if ignored
Up to $1.9M per violation category per year. Criminal charges for willful neglect.
What Draxion generates
Service Organization Control 2
Who needs it
Technology companies serving enterprise customers who require security assurance
Articles covered
Trust Service Criteria: CC1–CC9, A1, C1, PI1, P1–P8
Risk if ignored
Enterprise customers require SOC 2 — no report means no enterprise deals
What Draxion generates
Information Security Management Systems — ISO/IEC 27001:2022
Who needs it
Organizations seeking internationally recognized information security certification
Articles covered
Annex A Controls: 5.7, 5.23, 8.8, 8.25, 8.30, 8.34
Risk if ignored
Loss of certification, failed enterprise procurement security reviews
What Draxion generates
NIST AI Risk Management Framework
Who needs it
US federal contractors, government suppliers, and organizations seeking the US standard for AI governance
Articles covered
Govern, Map, Measure, Manage functions — all 164 subcategories
Risk if ignored
Required for federal contracts — loss of eligibility
What Draxion generates
Sarbanes-Oxley Act
Who needs it
US public companies and their subsidiaries using AI in financial reporting or accounting workflows
Articles covered
Section 302, Section 404, Section 906
Risk if ignored
Criminal liability for executives. Up to $5M fine and 20 years imprisonment.
What Draxion generates
Family Educational Rights and Privacy Act
Who needs it
Educational institutions receiving federal funding — including universities, colleges, and K-12 schools
Articles covered
34 CFR Part 99 — Sections 99.3, 99.30, 99.31, 99.60-99.67
Risk if ignored
Loss of all federal funding. Institutional reputational damage.
What Draxion generates
Certification status
Stated exactly as it stands today. Where an audit is still in progress, this page says so.
Audit scheduled Q4 2026. Security architecture built to SOC 2 Trust Service Criteria. Report available under NDA upon request.
Request at security@draxion.ioData Processing Agreement available. GDPR compliance maintained through privacy by design architecture and DPA with all sub-processors.
DPA available at /dpaTechnical documentation complete. Risk classification assessed. Available under NDA.
Available under NDA
HIPAA is not a certification — it is a legal compliance standard. Draxion's architecture supports HIPAA requirements. BAA available for healthcare customers.
Request at hello@draxion.ioGovern, Map, Measure, and Manage functions implemented.
See Pricing for report accessControls mapped to ISO 27001:2022. Formal certification audit planned for 2026.
Documentation under NDA
Audit ready
Draxion generates audit-ready reports in minutes. Request a demo and we will show you your first report live.
Certification documentation is available under NDA — security@draxion.io