Last updated: June 2026
A practical guide to compliance automation vs compliance-aware engineering — when to use Vanta/Drata, when to assess architecture, and when to generate controls from a formal spec.
Topics: compliance · soc2 · hipaa · gdpr · eu-ai-act · grc · architecture · vanta · drata
Related: Spec-driven development guide — same formal-model approach for code; this repo covers the compliance side.
You need SOC 2 for enterprise sales. Or HIPAA for healthtech. Or EU AI Act Annex IV before August 2, 2026.
The default path:
- Build fast with vibe-coding or generic scaffolds
- Buy Vanta in month nine
- Discover half the controls were never designed in
- Spend quarters retrofitting auth, audit logs, tenancy, and documentation
Compliance automation tools excel at Layer 1 (evidence on an existing app). They do not write the controls your auditor expects to see in code and architecture docs.
| Layer | Role | Examples |
|---|---|---|
| 1. Evidence & monitoring | Continuous control evidence, audit walkthrough | Vanta, Drata, Secureframe |
| 2. Architecture assessment | Gap analysis before or during build | Archiet audit, manual EA review |
| 3. Compliance-aware codegen | Controls + docs from formal spec | Archiet |
Your architecture specification (Archiet's Architectural Genome) declares:
- Which frameworks apply (
soc2,gdpr,hipaa,pci,dora,nis2,eu_ai_act) - How auth works (httpOnly cookies, RBAC, workspace tenancy)
- Which entities carry PII/PHI/cardholder data
- Which ADRs document security decisions
Lowering emits in one pass:
- Production code with those controls implemented
compliance/<framework>/overlay artifacts (control matrices, DPIAs, runbooks)- Traceability matrix: requirement → entity → route → test → ADR
Same model → same output on regenerate. Not a disconnected compliance PDF.
See examples/sample-control-traceability.md — one SOC 2 CC6.1 row end-to-end.
| Vanta / Drata | Archiet | |
|---|---|---|
| You have | Production app already | PRD / new product |
| You get | Evidence + monitoring | Code + compliance pack |
| Retrofit cost | High if controls missing | Low if greenfield |
Use both: Archiet ships controls + docs → Vanta verifies in prod.
→ Comparison doc · archiet.com/vs/vanta · archiet.com/vs/drata
| Framework | Generated artifacts (examples) |
|---|---|
| SOC 2 | Control matrix, change-mgmt runbook, incident response |
| ISO 27001 | SoA draft, control mapping |
| GDPR | DPIA, DSAR runbooks, processor register |
| HIPAA | PHI control matrix, BAA tracking |
| PCI-DSS | CDE scoping, segmentation checklist |
| DORA / NIS2 | ICT risk, incident reporting overlays |
| EU AI Act | Annex IV, risk tier, post-market monitoring |
Full hub: archiet.com/compliance-frameworks
High-risk systems under Annex III need technical documentation before market placement.
Free tools:
Architecture-first Annex IV: docs/eu-ai-act-annex-iv-from-architecture.md
Stack traceability examples (Annex IV §2 → code):
| Stack | Example |
|---|---|
| Flask | examples/annex-iv-flask.md |
| FastAPI | examples/annex-iv-fastapi.md |
| Django | examples/annex-iv-django.md |
| NestJS | examples/annex-iv-nestjs.md |
| Laravel | examples/annex-iv-laravel.md |
| Go Chi | examples/annex-iv-go.md |
| Rails | examples/annex-iv-rails.md |
| .NET | examples/annex-iv-dotnet.md |
No. Vanta owns continuous evidence. Archiet owns greenfield controls + architecture-grade compliance docs. Most serious teams use both.
No. Archiet generates audit-ready preparation — control narratives, evidence checklists, implemented controls in code. Your CPA firm issues the opinion.
Checklists are static. Archiet ties each control to your entities, routes, and tests — and regenerates when the architecture changes.
Same genome drives code and compliance. See spec-driven-development.
- Platform: archiet.com/compliance-frameworks
- Comparison hub: archiet.com/vs/compliance-automation-tools-2026
- Free architecture audit: archiet.com/audit-my-architecture
- EU AI Act use case: archiet.com/use-cases/eu-ai-act-high-risk-ai-compliance
MIT — see LICENSE.