Safety risk is about harmful output. Legal risk is about whether an action is allowed under the law that governs it - jurisdiction, statute, case law. An agent can pass every safety and security check and still take an action that's illegal. These are separate risks, and most frameworks only cover the first.

Yes. Safe, secure, and reliable each have an established framework - red-teaming, SOC 2/ISO 27001, NIST AI RMF. None of them check whether a specific action is legal in the jurisdiction where it's taken. An agent can meet all three standards and still violate the law that applies to that action.

Compliance asks if your controls are sound - do you have the right processes, certifications, and audits in place. Legality asks a narrower question: is this specific action allowed, here, today? A company can be fully compliant on paper and still take individual actions that break the law.

No. SOC 2 and ISO 27001 demonstrate that your systems and controls meet defined requirements - that the agent behaves as designed and data is protected. Neither certification checks whether a given action is permitted under the statute, regulation, or case law that governs it in a specific jurisdiction.

Not knowing about an applicable law doesn't necessarily protect a company from liability. An agent can work exactly as designed and still create legal exposure if its actions violate the laws that apply to them. This is why legal risk needs to be evaluated at the action level, not just through system-level controls and audits.

Carver determines the applicable legal requirements and recommends whether an action is allowed, restricted, or requires review. The agent governance system then decides whether to allow, block, or steer the action based on those recommendations and the organization's own policies.

Carver primarily covers the US and EU, with coverage continuously expanding across jurisdictions and regulatory domains. It can be integrated throughout the AI application lifecycle - from development and testing to runtime decisions, monitoring, and audit - so the same legal intelligence can be used before and after deployment.

Carver checks an agent's intended action against the laws and regulations that apply to its location, industry, user, and activity, then determines what is allowed, restricted, or required - with the underlying legal sources for auditability. Our regulatory coverage is continuously expanding across jurisdictions and domains to reduce blind spots as the legal landscape evolves.