Evidence first, framework second

Where this is today

The order matters and it is the argument of this page: the evidence exists first, and an adapter is a reading of it. So the evidence is here and the adapters are not, and that is the right way round rather than an excuse.

• AvailableThe evidence, the findings and the record of processing. Which is what any adapter consumes. It is collected once and it is already collected.
• AvailableA legal category and a sensitivity level on every field, and the category cites its provisions. A field-level reference on the category, linked to the official consolidated text at the article: ordinary personal data cites Articles 4(1), 6 and 5 GDPR; a special category cites Article 9 GDPR and Article 9 LOPDGDD; conviction data cites Article 10 GDPR and Article 10 LOPDGDD. A field nobody has classified cites nothing, and the sensitivity level cites nothing — it is EVIDENT’s ordering, and the regulation defines no such scale. Provisions on one field, not coverage across a framework.
• PlannedThe GDPR adapter. The first one, and the one the other three are shaped against. It is the larger claim: evidence mapped onto the controls of a framework, with coverage reported per control, rather than a citation on a single field.
• PlannedISO 27001, ISO 27701 and EU AI Act adapters. Built on the evidence model rather than bolted onto the report writer, which is why they come after it.
• PlannedControl evidence states. The vocabulary below is the adapters’ own vocabulary, published now so it can be argued with.

Available is in the product today. Preview is built and reachable, and still changing shape. Planned is specified and not built — published in advance so it can be judged before it exists.

A citation on a field is not a framework adapter

Two of the rows above are easy to read as one, so they are worth separating. Available today: every classified field names the provisions its classification rests on — one, two or three of them, depending on the category — and links to the official consolidated text, in your language, at the article rather than at the top of an eighty-page regulation. The citation is tied to the category that was concluded, so a field nobody has settled cites neither Article 9 nor Article 10 — the reference follows the conclusion instead of asserting one.

Still planned: the adapter. That is the other direction of travel. It takes the evidence and the findings, maps them onto the controls of a framework, and reports control by control what the evidence supports, what it partly supports and what it cannot settle. A field citing Article 9 is one input to that. It is not coverage of a control, and this page does not offer it as coverage.

The target architecture

Canonical evidence + findings
        |-> GDPR adapter
        |-> ISO 27001 adapter
        |-> ISO 27701 adapter
        |-> EU AI Act adapter
        `-> future frameworks

The rules every adapter follows

• An adapter maps evidence and findings to controls. It never collects evidence of its own — that would be a second scanner with a second opinion.
• One finding may support several controls, across several frameworks, at the same time.
• Framework and mapping versions are immutable. A framework upgrade never rewrites a historical assessment, because an assessment is a statement about a moment.
• A mapping may state its limitations and say where human interpretation is required — and where that is true, it should.

What a mapping is, and what it is not

A mapping says: this evidence is relevant to this control. It does not say you comply with it. The gap between those two sentences is where the profession lives, and it belongs to your DPO, your auditor and your lawyer.

Where the available evidence cannot settle a control, it is reported as UNKNOWN with the missing evidence named, rather than being quietly counted as satisfied.

Control evidence states