Regulatory Compliance
Built for auditors, not against them. Every architectural decision was made with regulatory conformity in mind — not retrofitted after the fact.
Compliance-Ansatz
AIMOS meets data protection and security requirements not through retrofitting, but through architectural decisions. Three design principles permeate the entire system:
All processing on your server. Not a single byte leaves your network — unless you explicitly allow it.
The agent prepares, the human approves. No automatic sending, no automatic booking.
Complete audit trail: who requested what and when, which tool was used, what response was received.
EU-Datenschutz
AIMOS fulfills the GDPR not through retrofitting, but through architectural decisions — Privacy by Design.
EU AI Act
Risk Classification · Transparency · Human Oversight · Documentation
EU Regulation
The EU AI Regulation (EU) 2024/1689 is taking effect in stages and applies to every company that deploys AI systems. AIMOS is architecturally designed for compliance — not retrofitted after the fact.
AIMOS agents are assistive systems with human oversight (human-in-the-loop). No autonomous decisions about individuals, no biometric surveillance, no social scoring functions. This places them in the "limited risk" category — not "high-risk."
Art. 50: Users must know they are interacting with an AI. Every AIMOS agent identifies itself as an AI assistant in its system prompt. All actions are traceable in the audit trail.
Art. 14: Execution Rings ensure that no agent independently performs critical actions. Bookings, emails, and orders are presented as drafts — the human decides.
Art. 11: System architecture, data flows, model description, performance metrics, and risk assessment are documented and accessible. MIT License: full source code access.
Art. 12: Every agent action is logged — tool calls, LLM requests, token consumption, decision chains. Audit-proof trails with session IDs and timestamps.
Art. 10: Training data and processing data never leave the SovereignNode. PII Vault automatically anonymizes external API calls. No cloud dependency.
Cloud AI services must comply with stricter requirements as "General Purpose AI" (GPAI). AIMOS uses a locally operated open-source model — the GPAI obligations apply to the model provider (Alibaba/Qwen), not the operator.
Standards Compliance
ISO 9001 & 27001 · GoBD
Standards Compliance
AIMOS supports the requirements of both standards through built-in mechanisms.
Bookkeeping
The GoBD (Principles for the Proper Management and Storage of Books, Records, and Documents in Electronic Form) places special requirements on AI-assisted systems.
AIMOS solves this through strict architectural separation:
Agents prepare journal entries (draft). Finalization is performed exclusively by authorized staff in the target system (ETA V8, DATEV, etc.). No LLM has transaction rights.
Ring 2 actions (write operations) require explicit authorisation. Accounting-relevant processes always require human approval — architecturally enforced, not by policy.
Privacy by Design
PII-Vault (Personally Identifiable Information — personal data protection) · Audit-Trail · Execution Rings · Token-Tracking
Data Sovereignty
All data stays on your SovereignNode. Not a single byte leaves your network — unless you explicitly allow it.
Datenschutz-Engine
Automatic anonymisation of personal data before every external API call.
Mappings are bound to the session and are not persistently stored
Detection via regex patterns and Named Entity Recognition
Every anonymisation is documented in the audit log
Protokollierung
Every agent action is logged without gaps. The audit trail captures six event types:
{
"id": 42847,
"timestamp": "2026-03-22T14:32:17.445Z",
"session_id": "ses_7f3a2b91",
"agent": "logistik",
"event_type": "TOOL_START",
"tool": "sql_query",
"ring": 1,
"params": {
"connector": "uyumsoft_db",
"query": "SELECT item, qty FROM stock WHERE qty < 10"
},
"user_id": "tg_12345",
"pii_anonymized": false
}{
"event_type": "LLM_USAGE",
"session_id": "ses_7f3a2b91",
"model": "qwen3.5:27b",
"prompt_tokens": 2847,
"completion_tokens": 312,
"total_tokens": 3159,
"latency_ms": 4280,
"cognitive_balance": 3
}Access Control
Wie Execution Rings unautorisierte Aktionen verhindern.
Resource Monitoring
Every LLM call is documented with exact token consumption, model name, and latency.
Exact breakdown into prompt_tokens and completion_tokens per request.
Every LLM request is captured with latency_ms, including model name and session context.
Remaining LLM calls per session are tracked as cognitive_balance.
Nachweisbarkeit
Complete traceability of every AI-assisted decision.
Every LLM call is documented with exact token consumption (prompt + completion), model name, and latency.
From the user request through tool calls to the response — every step is traceable with timestamp and session ID.
Session-gebundene Anonymisierungs-Mappings. Nachvollziehbar, which data was anonymized and de-anonymized when.
MIT License: Auditors can review every line of code. No black box, no proprietary logic.