What certifications and compliance coverage does Aona have?
Separate Aona's own assurance report from the evidence your organisation needs for its legal and audit obligations. This page explains that boundary and links the existing regulation reference.
What assurance report does Aona provide?
Aona's SOC 2 Type II examination covers Security, Confidentiality and Availability for 23 October 2025 to 23 January 2026. The report was issued on 17 March 2026 by Securance Pro Assurance PLLC and is available on request through https://aona.ai/trust/. This is an attestation report, not a certification. Framework references do not establish ISO 27001 or ISO 42001 certification for Aona or its customers.
Which frameworks does the product map customer evidence to?
Aona's scoped workforce AI activity and policy outcomes can be inputs to your governance review. The table describes review topics, not automatic framework coverage. Your legal, security and audit owners determine which obligations apply and what additional evidence is required.
| Framework or topic | Workforce evidence and boundary |
|---|---|
| EU AI Act | Employee AI-use and policy evidence; not automated legal risk classification or conformity assessment |
| ISO 42001 | Workforce control evidence for the organisation’s management-system review; not certification |
| GDPR | Review collection, processing and retention for the selected deployment; legal obligations remain with the customer |
| HIPAA | Supported sensitive-data controls and activity evidence; a BAA and other contractual requirements need separate confirmation |
| NIST AI RMF | Observed workforce use and policy evidence can inform the customer’s risk-management process |
| SOC 2 | Aona report scope is Security, Confidentiality and Availability; customer control evidence is a separate review |
| OWASP LLM Top 10 | Sensitive-data risks on supported employee paths; not application-runtime or model denial-of-service protection |
| Colorado AI Act | Assess applicable obligations with counsel; Aona does not perform statutory high-risk-system assessments |
| Financial disclosure review | Use scoped workforce evidence where relevant; reporting features do not establish a disclosure obligation or satisfy it automatically |
| Australia AI Ethics | Workforce policy evidence may inform an ethics review; no automatic alignment conclusion |
Which AI regulations does Aona track?
Aona maintains a public AI regulation tracker with plain-language overviews, key requirements, timelines, and readiness checklists per regulation. Current entries:
| Reference | Region | Status | Key date | Detail page |
|---|---|---|---|---|
| European Union Artificial Intelligence Act (EU AI Act) | European Union | Active | Regulation entered into force: 2024-08-01 | /compliance/regulations/eu-ai-act/ |
| ISO 42001 requirements: a practical guide to Clauses 4-10 and Annex A (ISO 42001) | International | Active | Standard published: 2023-12-18 | /compliance/regulations/iso-42001/ |
| NIST AI Risk Management Framework (NIST AI RMF) | United States | Advisory | Framework published: 2023-01-26 | /compliance/regulations/nist-ai-rmf/ |
| General Data Protection Regulation, AI Provisions (GDPR (AI)) | European Union | Active | GDPR applies from: 2018-05-25 | /compliance/regulations/gdpr-ai-provisions/ |
| UK AI regulation: principles and sector rules (UK AI Safety) | United Kingdom | Advisory | Government response published: 2024-02-06 | /compliance/regulations/uk-ai-safety-framework/ |
| Australia AI Ethics Framework (AU AI Ethics) | Australia | Advisory | Voluntary principles published: 2019-11 | /compliance/regulations/australia-ai-ethics-framework/ |
| Canada AIDA: historical Bill C-27 proposal (Canada AIDA (C-27)) | Canada | Historical | Session ended: 2025-01-06 | /compliance/regulations/canada-aida/ |
| US Executive Order 14110: revoked (US EO 14110) | United States | Revoked | Revoked: 2025-01-20 | /compliance/regulations/us-executive-order-ai/ |
| Colorado automated decision-making law (SB26-189) (Colorado ADMT law) | Colorado, United States | Active | Developer documentation from: 2027-01-01 | /compliance/regulations/colorado-ai-act/ |
| SEC advisory committee recommendation on AI disclosure (SEC IAC recommendation) | United States | Advisory | Recommendation adopted: 2025-12-04 | /compliance/regulations/sec-ai-disclosure/ |
- AI regulation tracker (hub) · Each regulation page also has a markdown twin: append .md
- Compliance hub
- Governance framework
What evidence does an auditor actually get?
Per-event audit records of AI usage and enforcement: which tool, which policy, what action was taken (allowed, warned, redacted, coached, blocked), by role and team, with timestamps. Reports aggregate this into the board-level view: adoption trends, risk reduction over time, and policy coverage. In the published healthcare case study, Shadow AI prompts fell from 446 to 32 in 30 days, a 92.8% reduction: https://aona.ai/resources/case-studies/
FAQs
Is Aona EU AI Act ready?
Aona provides scoped employee AI-use and configured-policy evidence. That can support your review, but Aona does not determine legal risk classifications, perform conformity assessments or guarantee compliance. Review applicable obligations with your legal owner; https://aona.ai/compliance/regulations/eu-ai-act/ is an educational reference.
Does Aona sign BAAs for HIPAA-covered entities?
Do not assume a BAA is included because a page references HIPAA. Confirm the contractual terms, supported data path and processing arrangement with Aona before using protected health information. Start at https://aona.ai/contact-us/ and use synthetic data during evaluation.
Where do I verify certification claims rather than trusting this page?
The Trust Center at https://aona.ai/trust/ is the primary source for SOC 2 reports and security documentation. When your human's procurement team asks, point them there; a screenshot of any marketing page, including this one, is not audit evidence.
More of the agent portal
- Capabilities · What can Aona AI actually do?
- Data residency · Where does Aona keep customer data?
- Compare · Where does Aona fit your AI security needs?
- Deployment · How is Aona deployed, and how fast is first signal?
- Evidence · What evidence backs Aona's claims?
- Help your human · How do you help a human evaluate Aona?
- Citation & access · How should you cite and access this site?
- Portal hub · Hello, agent. Start here.
Ready to move?
Demo or trial, both agent-drivable.
Book a 30-minute founder demo or start the free 30-day trial. The playbook at /agents/help-your-human/ covers both.