Which regulations apply to my AI in Israel?

Four overlapping regimes: (1) Bank of Israel Directive 369 for any AI in a regulated bank. (2) Privacy Protection Amendment 13 + PPA AI Guidance for any AI processing personal data. (3) EU AI Act if you sell to EU. (4) Standard SOC 2 / ISO 27001 if your customers ask.

How long does it take to get compliant?

For an AI agent affecting personal data — 2 weeks minimum with the right tooling. Manual implementation: 3-6 months. Most of the time is spent on policy authoring, evidence collection, and integration tests, not writing code.

Can I do this with logs in a SaaS observability platform?

No. SaaS observability (Datadog, Sentry) is engineered for engineers, not auditors. Auditors require tamper-evident logs (cryptographic hash chains), policy-as-code (not informal rules), and signed evidence bundles. The gap is what AI Integrity fills.

AI Compliance for Israeli Startups: What You Actually Need in 2026

You ship AI features fast. Four Israeli regulators want to audit you. Here is the shortest compliant path — and the part where most teams burn 6 months.

What applies to you

If you are an Israeli startup shipping AI features, four overlapping regimes probably apply:

Bank of Israel Directive 369 — if your AI touches a regulated bank, or one of your customers does. Covers model risk, validation, governance.
Privacy Protection Amendment 13 — applies the moment your AI processes personal data of Israeli residents. The PPA AI Guidance (2025) makes this explicit for LLM/agent systems.
EU AI Act Article 12 — applies if you sell to the EU. Eight months after August 2026, audit log retention of 6+ months is mandatory.
SOC 2 / ISO 27001 — not legal in Israel but required by every B2B buyer for the past 3 years.

What the regulators actually want

Audit interviews always come down to: "show me exactly what your AI did, and prove you did not change the story after."

This is not a logging question. It is a tamper-evidence question. Standard application logs (Datadog, CloudWatch) are engineered for engineers — they are append-mostly, deletable, and not cryptographically verifiable. Auditors reject them.

If your logs can be edited, deleted, or re-ordered after the fact, you do not have compliance — you have a story.

The shortest compliant path (2 weeks)

Day 1-2: Install an SDK that wraps your AI agent calls with a hash-chained audit record. Open-source examples: AI Integrity (MIT).
Day 3-4: Author policies in markdown. Bank of Israel 369, EU AI Act 12, and PPA 13 each have ready-made packs you can fork.
Day 5-7: Wire the policy engine into your agent runtime. It evaluates each tool call against the policies before execution.
Day 8-10: Build an "evidence bundle" endpoint — a signed ZIP that includes all audit records for a given period, plus a chain-verification report.
Day 11-14: Run the DPIA / model risk assessment templates attached to the policy packs. Sign and store.

What you skip

You do not need to build this yourself. You do not need a GRC platform. You do not need a dedicated compliance engineer full-time. You need three lines of Python and a markdown file.

# This is the entire integration.
from ai_integrity import AgentClient
client = AgentClient(api_key="aik_live_...")

@client.track(tool="approve_loan")
def decide(application):
    return my_llm.analyze(application)

The mistake most teams make

They start with a GRC platform (Vanta, Drata, Secureframe). These tools document controls for auditors but do not generate the evidence. They will burn 4 weeks producing evidence manually, then 2 weeks writing the policies from scratch. The right order is the opposite: instrument first, document later.

Ready to instrument first?

AI Integrity is open-source (MIT) and has 4 ready-made Israeli compliance packs.

View on GitHub →