Fintech AI Evidence scans every run of your AI workloads against EU AI Act, DORA, and SOC 2 Type II; surfaces gaps before the reviewer does; and exports the audit-ready package a bank's risk team signs off on. Out-of-band, non-custodial.
EU AI Act Annex III enforcement begins August 2, 2026. DORA has been in force since January 17, 2025. Vendor procurement reviews ask for both — today.
AI vendors selling into banks. Risk teams reviewing AI vendors. Either side, the question is the same: where is the evidence?
Procurement asks: where is the EU AI Act evidence? The DORA ICT-third-party register? The SOC 2 controls mapping? Today your engineering team scrambles a deck. Dobby gives you the actual artifact — same shape, every framework, every reviewer.
Twenty AI vendors are in your pipeline. Each one shows up with a different deck, a different controls map, a different story. Dobby gives every vendor the same shape — control matrix, gap report, manifest — so you compare apples to apples.
Either way, the artifact is the same.
The same scan exports the same shape for all three. Frameworks activate per tenant; controls fail or pass per run.
All three are activated per tenant — switch on what you need, scan against only the active set.
Your runs stay in your environment. Dobby reads telemetry, scans against active frameworks, and exports evidence. We never sit in the request path, never take custody of your logs.
pip install dobby-collector Stream run telemetry from CrewAI, LangChain, OpenAI, Google ADK, AWS Bedrock, or a custom SDK.Six components per export. Same structure, every framework, every scan. The package a bank's risk team actually asks for — not a deck.
One-page overview — frameworks scanned, overall verdict, top three gaps. Written for the reviewer, not the engineer.
Every control mapped to every run that exercised it. Verdict per control, evidence per verdict.
Every gap ranked by severity — what is missing, why it matters, the fix. Procurement-ready language.
Each individual finding — timestamp, run ID, framework, control, verdict, AI reasoning. Auditable.
Verifiable % per framework — how much of the framework your runs actually exercised. Honest about gaps.
Tamper-evident hash chain over every component. The auditor re-hashes to confirm nothing changed.
Export format: HTML · JSON · ZIP (all six components + signature).
Start with Fintech AI Evidence. Connect a workload, activate the frameworks, export the evidence pack. The same shape every reviewer asks for — out-of-band, non-custodial, audit-ready.
Free to try · No credit card · Out-of-band · Non-custodial