New AI and financial regulations such as NIST AI RMF, EU AI Act, DORA, force a hard question for the platform teams: how do we ship AI to production in regulated environments without stalling the release cycle?

This session, jointly presented by maintainers and contributors from OSCAL Compass (CNCF Sandbox), Sigstore Model Transparency (OpenSSF), and Kagenti (OSS), demonstrates end-to-end compliance automation for the AI lifecycle as a live walkthrough, from model release to agent operations.
We show how to digitize the EU AI Act into machine-readable OSCAL catalog, bring supply chain trust to ML models via Model Transparency signing, and enforce identity policies for agent-implemented controls through Kagenti. Posture assessment is automated using the right policy engine per control type, OPA, Kyverno, OCM, or CEL, with OSCAL Compass as the common standard for compliance artifacts representation.

Attendees will learn about our latest agentic architecture for compliance that scales in an open, composable, maintainable way, and where open specifications and policy open tooling meet in practice.