---
title: "Vanta Agent Explained: Monitoring, Limitations & MDM Alternatives"
description: "Learn what the Vanta Agent monitors, what it skips, its key limitations, and when an MDM may be a better fit for device compliance."
canonical: "https://axipro.co/what-is-vanta-agent/"
language: "en-US"
modified: "2026-06-08T04:36:48+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [Vanta](https://axipro.co/category/vanta/)

/ Vanta Agent Explained: Monitoring, Limitations & MDM Alternatives

# Vanta Agent Explained: Monitoring, Limitations & MDM Alternatives

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- June 8, 2026

Copy Link

The [Vanta](https://axipro.co/vanta/) agent checks four things on a laptop: whether the disk is encrypted, whether a password manager is installed, whether antivirus is running, and whether the screen locks on its own. That is the entire job. It is a lightweight background program that reports those signals back to Vanta so your compliance evidence stays current without anyone emailing screenshots to an auditor.

Most of the confusion around it comes from one of two directions: people expect it to manage their fleet like a full device-management platform, or they worry it reads far more than it does. Neither is true, and the gap between those two assumptions is where this guide lives.

What follows covers what the agent collects, what it deliberately ignores, how it talks to the Vanta platform, how it stacks up against a full MDM, and which compliance frameworks the evidence ends up supporting.

![Vanta Agent Explained](https://axipro.co/wp-content/uploads/2026/06/Vanta-Agent-Explained-1024x535.png)

## **What Is the Vanta Agent?**

The Vanta agent is a small program installed on employee computers to continuously confirm that each device meets a short list of security requirements. If you have seen it referred to as the Vanta Device Monitor, that is the same product under an earlier name. The two terms are interchangeable.

Under the hood, it runs a hardened build of [osquery](https://osquery.io/), an open-source framework that exposes operating system state as a queryable SQL database. Vanta ships a modified version that strips out the tables it considers risky, which is why the agent can read a disk-encryption flag but cannot pull your browser history or SSH keys.

**It is read-only by design.** It inspects configuration and reports back; it never changes a setting on the machine. Vanta positions it primarily for smaller fleets, generally companies running fewer than about 75 devices, where standing up a full management platform would be overkill.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **What Does the Vanta Agent Do?**

The agent exists to turn a recurring manual chore — proving that every laptop is configured securely — into something that happens quietly in the background.

### Continuous Device Monitoring

Once installed, the agent keeps tabs on the device’s security posture on an ongoing basis rather than at a single point in time. This matters because audits care about whether a control held throughout the period, not whether it happened to be true the morning someone took a screenshot. [Continuous checks](https://axipro.co/continuous-monitoring-for-soc-2-compliance/) caught the laptop with encryption switched off last Tuesday.

### Automated Compliance Checks

Each signal the agent gathers maps to a control your auditor wants evidence for. Instead of chasing employees for proof that their disk is encrypted, the check runs automatically, and the result flows into Vanta as evidence. The work that used to eat days of an onboarding cycle collapses into a background process.

### Real-Time Security Posture Tracking

The findings appear in Vanta as pass or fail states against each requirement, so a security lead can see fleet-wide compliance at a glance. A device that drifts out of compliance surfaces quickly, which shortens the window between a problem appearing and someone noticing it.

## What Information Does the Vanta Agent Collect?

This is the question employees actually care about, and the honest answer is reassuring: the agent collects security configuration, not content. It does not transmit passwords, environment variables, SSH keys, emails, or browsing history. It reads whether protections are switched on, not what you are doing with the machine.

Insider Note: The reason the agent cannot snoop even if someone wanted it to is architectural, not a policy promise. Vanta deploys a modified osquery build that removes the tables capable of reading sensitive content. The dangerous queries are not blocked at the dashboard; they are absent from the binary. That distinction is worth raising directly when an employee pushes back on installation.

### Operating System and Version Details

The agent records the OS and version so Vanta can confirm the device runs a supported, patchable platform. An end-of-life operating system is a control failure in its own right, and this is how it gets flagged.

### Disk Encryption Status

It checks whether [full-disk encryption](https://axipro.co/soc-2-encryption-requirements/) is active — FileVault on macOS and BitLocker on Windows. This is the single most universally required device control across every major framework, which is also why it is the one Linux check the agent does support.

### Screen Lock and Password Policies

The agent verifies that the screen locks automatically after a period of inactivity and that a password or equivalent is required to get back in. An unlocked laptop left on a train is a textbook breach, and this control is the cheapest defense against it.

### Antivirus and Firewall Status

It confirms that antivirus or endpoint protection software is installed and running. The point is not to endorse a particular product but to prove that some recognized protection is active and has not been quietly disabled.

### Installed Software and Auto-Update Settings

To detect the controls above, the agent reads the list of installed applications — for example, to confirm a password manager is present — along with update-related settings. It is reading the inventory to verify protections exist, not building a behavioral profile of the user.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **How Does the Vanta Agent Work?**

### How the Agent Communicates with the Vanta Platform

After installation, the employee registers the device against your Vanta account, which links that machine to its owner. From then on the agent runs its checks locally and sends only the results — the pass or fail signals — up to Vanta over an encrypted connection. The raw system queries stay on the device. What travels is the verdict, not the underlying data.

### How Often the Vanta Agent Runs Checks

The agent uses osquery’s scheduled-query model, meaning each check runs on a recurring interval in the background rather than continuously hammering the system. Results sync to Vanta periodically through the day, and the platform’s tests re-evaluate on a regular cadence so a freshly remediated device clears its failing check without anyone forcing a manual refresh. In practice, a fixed laptop usually shows green within hours, not at the next audit.

![Install Vanta Agent](https://axipro.co/wp-content/uploads/2026/06/Install-Vanta-Agent-1024x683.jpg)

## **Getting Started with the Vanta Agent**

### Supported Operating Systems and Versions

The agent supports current versions of macOS and Windows, plus several Linux distributions — primarily Ubuntu and close relatives — on the condition that the device exposes a stable, unique hardware identifier. There is one significant caveat on Linux: the agent can only check disk encryption there. Screen lock, antivirus, and password-manager detection are not available on Linux, so those controls will need manual evidence or MDM coverage on Linux machines.

### How to Install the Vanta Agent

Installation is a per-device download. The employee logs into Vanta during onboarding, downloads the installer for their operating system, runs it with administrator rights, and completes a short browser-based registration that ties the device to their account. No additional configuration is needed; the agent arrives ready to work with your account.

Pro Tip: Two avoidable issues cause most failed installs. The installer needs administrator permissions, so run it as admin from the start. It also opens a browser window to finish registration, which means a machine with no default browser set will hang and time out. Set a default browser before you begin, and temporarily pause aggressive antivirus that may block the install.

### Assigning Device Monitoring Tasks to Personnel

Rather than chasing installs individually, you assign a “Require device monitoring” task to the relevant employee group in Vanta. With the prompt option enabled, employees are walked through installing the agent themselves, and the task passes automatically once their computer registers. For teams using an MDM instead, you can assign the same requirement without prompting for the agent.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **Vanta Agent vs. Mobile Device Management (MDM) Solutions**

The agent and an [MDM](https://en.wikipedia.org/wiki/Mobile_device_management) solve overlapping problems with very different scope. The agent is a compliance-evidence sensor. An MDM is a management platform that can also enforce and remediate. Understanding where that line sits will save you from reaching for the wrong tool.

The agent reads configuration and reports it; it cannot push a fix. An MDM can lock a device remotely, enforce a policy centrally, and wipe a machine that has gone missing. At the same time, an MDM typically requires more infrastructure, more administrative overhead, and meaningful per-seat cost. The agent, by contrast, is included in Vanta’s platform and takes minutes to deploy.

The practical dividing line is fleet size and risk appetite. For a team of twenty, the agent usually provides everything a SOC 2 auditor needs at the device level. For a team of two hundred spread across multiple office locations, the inability to remotely enforce or remediate becomes a genuine gap — and that is where a [full MDM](https://axipro.co/drata-vs-thoropass-vs-vanta-which-compliance-tool-reigns-supreme/) earns its keep.

### When to Use the Vanta Agent

Reach for the agent when you are a smaller or earlier-stage company that needs solid compliance evidence without the cost and administrative weight of a management platform. It is also the right tool for filling coverage gaps — such as the Windows laptops your macOS-only MDM cannot see.

### When to Use an MDM Integration Instead

As the fleet grows, the limits of a read-only sensor start to show. An MDM lets you enforce configuration rather than just observe it, push fixes centrally, and manage devices at a scale where chasing individual installs stops being realistic. Larger organizations and anyone needing remote lock or wipe should lean on an MDM as the system of record.

### Using Both Together

These are not mutually exclusive. A common pattern is to run an MDM as the primary monitoring source and keep the agent as a secondary option for devices the MDM does not cover. If a computer reports through both, Vanta simply shows both sources. You get the enforcement of the MDM where it reaches and the agent’s coverage everywhere else.

## **Integrating the Vanta Agent with Your Existing Tools**

### MDM Integrations Supported by Vanta

Vanta connects with several widely used MDM platforms, including [Jamf](https://www.jamf.com/), [Kandji](https://kandji.io/), and [JumpCloud](https://jumpcloud.com/), configured from the Integrations page in your dashboard. When an MDM is connected, devices it manages stay visible for monitoring without the agent installed, and unmonitored-device tracking adjusts accordingly. The choice between sources is yours to set per task.

### Viewing and Managing Company Computers in Vanta

The Computers page is the single view of every device under monitoring, whether the data comes from the agent or an MDM. Each row shows a machine, its owner, and a column of check marks or X’s — one per security control. A green check means the control is met; an X means it is not. Clicking a user opens their fuller profile, including onboarding and access status alongside their device details.

![Vanta Compliance Frameworks](https://axipro.co/wp-content/uploads/2026/06/Vanta-Compliance-Frameworks-1024x683.jpg)

## **Which Compliance Frameworks Does the Vanta Agent Support?**

A clarification first, because this is where expectations run ahead of reality. The agent does not “support a framework” the way a product supports a file format. It supplies one category of evidence — endpoint security configuration — that maps to specific controls inside many frameworks. The frameworks themselves are far broader, covering policies, access management, vendor risk, and much more that has nothing to do with a laptop.

### SOC 2

[SOC 2](https://axipro.co/soc-2/), defined by the [AICPA](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2), is built around five Trust Services Criteria, and the device controls the agent checks feed directly into the Security criterion. Encryption, access control, and endpoint protection evidence are routine asks in a SOC 2 audit, and the agent automates the device-level portion of that.

### ISO 27001

[ISO/IEC 27001](https://www.iso.org/standard/27001) is the international standard for [information security management systems](https://axipro.co/iso-27001-gap-analysis-a-detailed-guide-for-security-audit/). Its Annex A controls include explicit expectations around endpoint security and cryptography, and the agent’s encryption and protection checks line up with those control objectives.

### HIPAA

For organizations handling protected health information, the [HIPAA Security Rule](https://axipro.co/hipaa-certification/), administered by the [U.S. Department of Health and Human Services](https://www.hhs.gov/hipaa/for-professionals/security/index.html), requires safeguards for electronic PHI. Device encryption and access controls are core technical safeguards, and the agent provides ongoing evidence that they are in place.

### GDPR

The [General Data Protection Regulation](https://axipro.co/gdpr-compliance/) requires appropriate technical measures to protect personal data, with encryption named explicitly as an example in [Article 32](https://gdpr-info.eu/art-32-gdpr/). The agent’s monitoring helps demonstrate that devices touching EU personal data meet that bar on an ongoing basis.

### FedRAMP

[FedRAMP](https://www.fedramp.gov/) governs cloud services used by U.S. federal agencies and is the most demanding of the group by a wide margin. Worth flagging: in 2026 the program shifted its core terminology, now describing approved services as FedRAMP certified rather than authorized. The agent’s device evidence is a small input into a far larger continuous-monitoring obligation here — not anything close to the whole picture.

**Important:** Installing the agent and turning every check green does not make you compliant with any of these frameworks. The device controls are one slice of evidence among dozens. Treating a fully green Computers page as “we passed SOC 2” is the most common misread of what the agent actually buys you.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **Conclusion**

The agent is a focused tool that does one job well: it keeps your device-security evidence current and honest without manual effort. It reads configuration, never changes it, and reports only verdicts rather than content. For smaller fleets it can carry the device-monitoring load on its own; for larger ones it works best as a complement to an MDM. Match it to your fleet size and your framework’s real requirements, and it quietly removes one of the more tedious parts of staying audit-ready.

## **Frequently Asked Questions About the Vanta Agent**

Is the Vanta Agent the Same as the Vanta Device Monitor?

Yes. They are two names for the same software. Older documentation and some installers refer to the Vanta Device Monitor, while the agent is the current name. There is no functional difference.

Does the Vanta Agent Access Personal Data?

No. It does not transmit passwords, emails, browsing history, environment variables, or SSH keys. It reads security-configuration flags — such as whether encryption is on — and reports the results. The sensitive osquery tables are removed from the build entirely.

Can Employees See What the Vanta Agent Is Collecting?

Yes, and this is a useful point to share with skeptical staff. Because the agent runs osquery, a technically inclined employee can inspect the exact set of queries it executes on their machine using the agent’s command-line tools. Nothing about what it checks is hidden.

What Happens If an Employee's Device Fails a Check?

The device shows an X against the failing control on the Computers page, and the corresponding Vanta test flags as failing. Remediation is usually straightforward — for example, switching encryption back on — and once the agent’s next check picks up the fix, the status clears on its own.

Is the Vanta Agent Available for Linux?

Partially. The agent runs on several Linux distributions, mainly Ubuntu and close variants, but it can only check disk encryption there. Screen lock, antivirus, and password-manager detection are not supported on Linux, so those controls need manual evidence or an MDM for Linux devices.

How Do I Know the Vanta Agent Is Running?

The agent includes a built-in diagnostic tool — run via its command-line interface as vanta-cli doctor — which checks for common problems and reports what it finds. On Windows you run it from an administrator command prompt. The device also appearing on your Computers page is the simplest confirmation that it is reporting.

Can the Vanta Agent Be Deployed at Scale?

It can be pushed to many machines, including through MDM-delivered install scripts, but Vanta recommends it mainly for fleets under roughly 75 devices. Beyond that size, a dedicated MDM is the better backbone, with the agent filling gaps the MDM cannot reach. Scale is exactly the line where most teams graduate from the agent to an MDM-first setup.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- June 8, 2026
- [Vanta](https://axipro.co/category/vanta/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us