Guide · Agent skill
How to use the Compliance OS multi-framework orchestrator agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
Compliance OS is an agent skill, a packaged set of instructions and Python scripts that an AI agent can load to help with a specific job. This one helps compliance teams run several frameworks such as ISO 27001, SOC 2, GDPR and the EU AI Act as one program instead of four separate ones. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what it needs and does not do, so you can use it on your first attempt.
Compliance OS multi-framework orchestratoralirezarezvani/claude-skills · MIT Download the skill Quick start
- 1Download the ZIP. Get the compliance-os skill ZIP from this page.
- 2Install the skill. Unzip it into ~/.claude/skills/ or a project's .claude/skills/, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare a company profile. Optionally copy assets/company_profile_template.json and fill in your industry, geography, AI use and other profile fields.
- 4Ask for framework selection. Describe your company and ask which of the 12 supported frameworks apply.
- 5Request overlap and evidence mapping. Ask which controls overlap across your selected frameworks and for the unified evidence checklist with reuse map.
- 6Run a mock audit. Name one framework and scope and ask for a simulated internal audit with findings and interview questions.
What the compliance-os skill makes the agent do
The skill covers four decisions. First, given a company profile, it works out which of the 12 supported frameworks apply: ISO 27001, ISO 13485, ISO 42001, ISO 14971, EU AI Act, EU MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2 and HIPAA. Second, across the frameworks you select, it computes which controls overlap and how much evidence can be reused. Third, for a chosen framework and scope, it generates a simulated internal audit drawing on a 205-scenario library. Fourth, it builds a unified evidence checklist with a reuse map showing which artefact satisfies which controls in which frameworks.
The skill is an orchestrator. It does not replace per-framework skills or experts; it points to them for the detailed operational work.
Install the compliance-os skill
Download the ZIP of the skill from this page. Then choose one of two routes.
For Claude Code, unzip it into your personal skills folder ~/.claude/skills/ or into a project's .claude/skills/ folder, so the skill directory sits inside one of those locations. For the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- Personal use across projects: ~/.claude/skills/
- Single project, shared with a repository: .claude/skills/ inside the project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with natural requests
You do not need a special command. Describe the job in plain language and mention the compliance work involved. The skill's own description lists the situations it fits: standing up a multi-framework program, planning the annual audit calendar, or preparing for certification stage 1.
Name your company profile, frameworks or scope where you can. The more specific the request, the more useful the output.
- Which frameworks apply to a B2B SaaS company that handles EU personal data and uses AI in its product?
- Show where ISO 27001 and SOC 2 controls overlap and how much evidence I can reuse.
- Simulate an internal ISO 27001 audit for our cloud hosting scope and give me interview questions per control.
- Build a combined evidence checklist for ISO 27001, SOC 2 and GDPR with a reuse map.
What the skill needs and how the scripts run
The skill requires Python 3 and uses only the standard library, so no third-party packages are needed. It runs scripts. You can run them with no input to get the embedded sample, or pass a JSON file describing a company profile, control libraries or audit scope. The skill includes templates for these files: assets/company_profile_template.json and assets/control_library_template.json.
The skill does not use the network.
- Python 3 (standard library only)
- Optional JSON input: company profile, control libraries or audit scope
- Scripts: framework_selector.py, cross_framework_mapper.py, audit_simulator.py, evidence_pool_generator.py
python scripts/framework_selector.py profile.jsonSafety notes on scripts and network access
The skill runs local Python scripts, so review the scripts before you run them in a sensitive environment, as you would with any script. The skill does not use the network, so it does not send your profile or evidence data anywhere by itself.
The outputs come from embedded, curated tables and reference files, not from live regulatory data. Check current law and standard texts yourself, and have counsel review any novel cross-framework mapping.
Tips for getting useful output
Start with the framework selector, so you do not forget an applicable framework. Name your most established certification as the reuse anchor, then map new frameworks against it. Keep evidence in one indexed location, since the evidence pool step works best when artefacts are catalogued.
Treat mock audit findings as practice material. The skill's methodology is designed to prepare the team without breaking trust, so use the output to rehearse interviews and find gaps before the external auditor does.
- Give a company profile file to get output tailored to your organisation
- Use the evidence checklist to decide where one artefact can serve several frameworks
- Plan the audit calendar, since stacked surveillance audits compete for auditor capacity
What people use it for
- Choosing which frameworks a new AI SaaS company should plan for before a first certification
- Consolidating an ISO 27001 and SOC 2 program so access-review records are assembled once
- Preparing a team for a certification stage 1 with a simulated internal audit
- Planning an annual audit calendar so surveillance audits do not collide
Frequently asked questions
How do I install the compliance-os agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
Is the compliance-os skill free?
The skill is published under the MIT licence. Check the licence file in the source repository for the full terms before you rely on it commercially.
What does the compliance-os skill require?
It requires Python 3 and uses only the standard library, so you do not need third-party packages. It also accepts optional JSON files for a company profile, control libraries or audit scope.
Does compliance-os replace a compliance consultant or legal advice?
No. The skill's mappings are simplified and reflect published guidance, and it is not a substitute for binding legal advice. Novel cross-framework mappings should be reviewed with counsel.
Does the skill use live regulatory data?
No. Its outputs come from embedded curated tables rather than current law, so verify against the current text of each standard or regulation.
How is compliance-os different from per-framework skills?
Per-framework skills do the detailed operational work for one framework. Compliance OS orchestrates across frameworks, handling selection, overlap, mock audits and combined evidence, and it does not replace the per-framework skills.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Compliance OS suits compliance teams consolidating or standing up a multi-framework program, teams preparing for a stage 1 certification audit, and consultants who want a structured starting point for mock audits and evidence mapping. It is not the right tool for final legal or certification decisions, detailed per-framework operational work, or anyone who needs live regulatory data.
Download the skill