Compliance Twin Setup Guide

Last Updated: February 12, 2026
Applies to: Enterprise Plan ($24,000/yr)

What Is Compliance Twin?

Compliance Twin is a continuous AI compliance monitoring system. Think of it as a security camera for your AI system's compliance status — it records your system's configuration, health, and compliance state at regular intervals, and locks each recording with a tamper-proof cryptographic seal.

What it does:

Takes versioned snapshots of your AI system's state (config, metrics, alerts, compliance checks)
Runs jurisdiction-specific compliance rules automatically (NYC LL144, Colorado AI Act, EU AI Act, SOC 2)
Detects when your system drifts from its compliant baseline
Generates signed, tamper-evident evidence bundles for regulators
Provides root cause analysis when compliance checks fail

What it does NOT do:

It does not modify your AI system
It does not make legal determinations
It does not replace human oversight — it augments it with continuous monitoring

Prerequisites

Before you begin, you need:

A HAIEC account on the Enterprise plan
An API key (generated from your Admin Dashboard)
An AI system to monitor (any system that makes automated decisions — hiring tools, lending models, insurance scoring, etc.)

Step 1: Get Your API Key

Log in to your HAIEC account at haiec.com/login
Navigate to Admin → API Keys at haiec.com/admin/api-keys
Click Generate New Key
Select the Customer API Key type
Copy the key — it starts with cust_ (e.g., cust_abc123def456)
Store it securely — you will need it to connect the Compliance Twin dashboard

Important: Your API key authenticates all Compliance Twin API calls. Do not share it publicly. You can rotate keys at any time from the Admin Dashboard.

Step 2: Connect the Dashboard

Go to haiec.com/compliance-twin
Paste your API key in the input field
Click Connect Dashboard
If this is your first time, the system will automatically launch the Onboarding Wizard

Step 3: Register Your First AI System

The Onboarding Wizard guides you through registration:

3a. Name Your System

Give your AI system a descriptive name (e.g., "Hiring Screening Model v2", "Loan Approval Engine").

3b. Select System Type

Choose the type that best describes your system:

Hiring / Recruitment — Automated employment decision tools
Lending / Credit — Credit scoring and loan approval
Insurance — Risk assessment and pricing
Healthcare — Clinical decision support
General AI — Other automated decision systems

3c. Select Environment

Production — Live system making real decisions
Staging — Pre-production testing environment
Development — Development/testing only

3d. Auto-Selected Compliance Rules

Based on your system type and jurisdiction, Compliance Twin automatically selects the relevant rule packs:

| Jurisdiction | Rules | What They Check | |---|---|---| | NYC Local Law 144 | 5 rules | Bias audit recency, public disclosure, candidate notice, logging, monitoring | | Colorado AI Act | 6 rules | Risk management, impact assessment, consumer notice, disclosure, oversight, monitoring | | EU AI Act | 5 rules | Risk management, record-keeping, transparency, human oversight, reporting | | SOC 2 | 7 rules | Access control, monitoring, logging, change management, alerts, compliance checks, sample rate |

You can also build custom rule packs later using the Pack Builder at /compliance-twin/composer.

Step 4: Connect Your AI System's Data

After registration, you need to send runtime data from your AI system so Compliance Twin can monitor it.

REST API (Primary Integration)

Send per-request metrics directly to the metrics endpoint from any language:

curl -X POST https://www.haiec.com/api/compliance-twin/metrics \
  -H "Authorization: Bearer cust_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "systemName": "Resume Screener v2",
    "latencyMs": 142,
    "success": true,
    "confidenceScore": 0.87,
    "modelVersion": "v2.1"
  }'

What Data to Send

systemName — Must match the name you registered in Step 3
latencyMs — Response time of each AI inference
success — Whether the request succeeded (true/false)
confidenceScore — Model confidence (0-1)
modelVersion — Which model version served the request
customMetrics — Any additional key-value pairs relevant to your system

The system automatically computes health status, detects anomalies using Z-score analysis against a 7-day baseline, and creates alerts when thresholds are exceeded.

Complementary HAIEC Tools

These are separate HAIEC products that complement Compliance Twin by providing additional data sources:

| Tool | Install | What It Does | |---|---|---| | @haiec/openai | npm install @haiec/openai | OpenAI SDK wrapper — tracks LLM usage, token counts, and cost per request for AI Inventory | | @haiec/anthropic | npm install @haiec/anthropic | Anthropic SDK wrapper — same usage/cost tracking for Claude models | | haiec-isaf-logger | pip install haiec-isaf-logger | Python ML training logger — logs data provenance, objective functions, and framework metadata with cryptographic verification | | GitHub Action | uses: subodhkc/haiec-scan@v1 | CI/CD security scanner — AST analysis, policy gates, SARIF export for GitHub Code Scanning |

These tools serve their own purposes (AI Inventory, ML compliance logging, security scanning) and are not required for Compliance Twin's core metrics ingestion.

Step 5: Understand What Happens Automatically

Once registered and connected, Compliance Twin runs continuously without manual intervention:

Automatic Snapshots

Daily scheduled snapshots capture your system's full state
Config-change snapshots trigger whenever your system configuration changes
Manual snapshots can be triggered on-demand from the dashboard
Each snapshot is SHA-256 hashed and parent-chained to the previous snapshot (append-only hash chain stored in PostgreSQL)

Automatic Compliance Checks

Rule packs execute against every new snapshot
Each rule produces a PASS or FAIL result with evidence
Results are stored per-system for your audit trail

Automatic Drift Detection

The Delta Engine compares consecutive snapshots
Changes are auto-classified into 9 categories: config, threshold, baseline, health, compliance, metric, alert, drift, other
You are alerted when your system drifts from its compliant baseline

Automatic Regression Detection

When rules that were passing start failing, the system generates a regression report
Root Cause Analysis automatically builds a deterministic cause tree
Cross-framework remediation maps fixes across all 9 supported frameworks

Step 6: Monitor Your Dashboard

Your dashboard shows:

System Health — Uptime, latency, error rate for each monitored system
Compliance Status — Pass/fail across all active rule packs
Risk Score — Composite score (0-100) from 5 weighted dimensions:
- Health (20%), Compliance (30%), Drift (15%), Alerts (15%), Provenance (20%)
Alerts — Critical, warning, and info alerts with severity badges
Regression Reports — PASS→FAIL regressions with severity-weighted scoring

Risk Score Interpretation

| Score | Level | Meaning | |---|---|---| | 90-100 | Excellent | Fully compliant, no issues | | 70-89 | Good | Minor issues, action recommended | | 50-69 | Fair | Significant gaps, action required | | 0-49 | Critical | Major compliance risk |

Step 7: Generate Evidence Bundles

When you need proof for a regulator, auditor, or customer:

Go to the Export section in your dashboard
Select a time range (e.g., last 30 days, last quarter)
Choose format — JSON (machine-readable) or HTML (human-readable report)
Click Export

The system collects all snapshots, rule executions, compliance checks, drift detections, config changes, and regression reports for that time range. It then:

Builds a Merkle tree over all item hashes
Signs the bundle with HMAC-SHA256
Persists and anchors the bundle to the provenance log

Independent Verification

Anyone can verify your evidence bundle at haiec.com/verify — no HAIEC account required. They can:

Enter a Bundle ID, or
Paste the full JSON bundle

The verification endpoint recomputes the HMAC signature, Merkle root, and individual item hashes, reporting PASS/FAIL for each integrity check.

Step 8: Set Up Alerts (Optional)

Configure multi-channel notifications:

Email — Via Resend API with HTML templates
Slack — Block Kit formatted webhooks
Webhooks — Generic HTTP with optional HMAC-SHA256 payload signing

Alert routing:

CRITICAL alerts → All channels
WARNING alerts → Email only
INFO alerts → Dashboard only

Configure at /compliance-twin/notifications.

Access Control

Compliance Twin uses role-based access control (RBAC) with 4 roles:

| Role | Can Do | |---|---| | User Admin | Everything — register systems, configure thresholds, trigger snapshots, sign evidence, export, view, acknowledge alerts | | Compliance Officer | Trigger snapshots, sign/export evidence, run checks, view dashboard, acknowledge alerts, verify bundles | | Engineer | Run compliance checks, view dashboard, view drift alerts, acknowledge alerts, verify bundles | | Auditor | Export/download evidence, view dashboard, view drift alerts, verify bundles |

Frequently Asked Questions

How often are snapshots taken?

Daily by default, plus on every config change. You can also trigger manual snapshots at any time.

Can I customize which compliance rules run?

Yes. Use the Pack Builder at /compliance-twin/composer to create custom rule packs from any combination of rules across all 4 jurisdictions.

Is the evidence legally admissible?

Compliance Twin generates tamper-evident evidence with cryptographic integrity proofs. The evidence is designed to support regulatory compliance but does not constitute legal advice or certification. Consult your legal counsel for jurisdiction-specific requirements.

What happens if I lose my API key?

You can generate a new key from Admin → API Keys at any time. The old key will be invalidated. Your data is not affected.

Can multiple team members use the same dashboard?

Yes. Each team member needs their own HAIEC account with the appropriate role assigned. The API key is shared at the organization level.

Next Steps

Book a demo to see Compliance Twin in action
View the product page for architecture diagrams and pricing
Read the 30-day compliance plan for a broader compliance roadmap

Compliance Twin Setup Guide: From Zero to Provable Compliance