Verified Digital Agents → C2MD → Translate a control

Translate Compliance Control

Give it one control reference and the agent it applies to. Get back rules that agent can actually be held to — MUST, MUST NOT, MAY — with the clause they came from still attached.

Live · free tier

The gap this closes

Controls are written for organisations. Agents need instructions. "Implement appropriate technical and organisational measures" cannot be evaluated at runtime — nothing can decide whether a given action complied with it. A rule like "MUST NOT return an approval decision without recording the model version that produced it" can be evaluated, enforced, and later shown to an auditor.

Translation is where compliance stops being a document and becomes something the system does.

What it accepts

FrameworkReference you give it
NIST SP 800-53 Rev 5Control ID — e.g. AU-2, AC-6
ISO/IEC 42001:2023Clause number
EU AI Act — Regulation (EU) 2024/1689Article
GDPR — Regulation (EU) 2016/679Article

Ask C2MD for list_supported_frameworks to get the current frameworks, jurisdictions and version anchors it is pinned to — worth doing, because "which revision" is the first question an auditor asks about a control mapping.

Why the citation stays attached

Every generated rule keeps its clause-level citation. That is what makes the mapping reviewable: a compliance officer can check the rule against the source text rather than trusting that the translation was faithful. A rule with no provenance is an assertion, and an assertion is not evidence.

Composable by design

Translate one control at a time and compose them, or generate a whole bundle and get the translations for every control that applies. Same output format either way — the rules land in VDA-MD, the plain-Markdown governance format that ACP versions and signs, and that an agent evaluates locally at runtime.

Worked example

NIST SP 800-53 AU-2 → agent rules, for Northwind Bank's credit-decision agent Demo data

Ask for it in plain language