JFrog Ltd., the Liquid Software company and creators of the JFrog Software Supply Chain Platform, has announced new DevGovOps capabilities that give CISOs and R&D leaders a single, shared view of regulatory requirements with signed evidence for every release. The new capabilities include an out-of-the-box compliance framework for the EU Digital Operational Resilience Act (DORA), Repo-Level policies, and AI Verification Policies.
JFrog has announced new DevGovOps capabilities, including an out-of-the-box compliance framework for DORA, Repo-Level policies and AI Verification Policies.
The capabilities aim to help organizations continuously comply with EU software regulatory deadlines without slowing development.
Regulatory deadlines already in effect or arriving include DORA, the European Central Bank requirements, the Cyber Resilience Act and the EU AI Act.
The CRA requires manufacturers to issue an early warning within 24 hours and notify authorities within 72 hours of an actively exploited vulnerability.
CRA fines can reach €15 million or 2.5% of global annual turnover, whichever is higher.
Recent survey data shows 59% of companies regularly compromise on compliance under business pressure, and 43% rated their compliance maturity at the lowest level.
"We are excited to give Security and R&D leaders one version of the truth for EU Software Compliance," said Yoav Landman, Co-Founder and CTO, JFrog. "Regulations now demand more controls and visibility, backed up by evidence for every release, and AI is dramatically accelerating the pace and the number of releases. It all comes down to a simple question: can you prove the trust in what you shipped and can you do it continuously to match the release cadence driven by AI agents? Our customers can now rely on one system of record for their releases and compliance evidence, and with policies that check a release against its intent in plain language and produce signed proof."
"With AI agents shipping code faster than ever and regulators demanding strict accountability, teams automate governance into their software supply chain without sacrificing velocity," said Haggai Schechtman, VP of Product and Engineering for DevGovOps, JFrog. "JFrog AppTrust helps accelerate the audit process with controls that allow organizations to be audit-ready anytime. Pre-mapped frameworks automate EU DORA and CRA compliance out-of-the-box, while plain-language, AI-evaluated policies verify releases match architectural and business intent, attaching cryptographically signed proof directly to every artifact."
Various regulatory deadlines are already in effect or arriving fast – DORA, European Central Bank, Cyber Resilience Act, the EU AI Act, etc. – each having unique requirements, but the one common thread is evidence produced on demand. And the consequences of not being able to comply can be costly.
The widespread adoption of AI amplifies the compliance challenge. Autonomous agents and AI-assisted developers can plan, code, test, and deploy in hours, while manual governance processes take weeks. Additionally, Gartner research notes that CIOs and CISOs face tension due to competing mandates: service delivery versus security.
Continuous governance and compliance help resolve that tension by building policy enforcement and evidence into every release, instead of as a checkpoint after the fact. This is what JFrog's recently introduced four pillars of DevGovOps aim to do. The new JFrog AppTrust capabilities build on these pillars - expanding JFrog's current solution to include:
DORA Out-of-the-Box Compliance Framework: Allows customers to effectively meet emerging regulations, by codifying their standards into machine-readable rules known as Policy as Code. JFrog AppTrust provides pre-mapped PaC frameworks across five software-delivery obligation areas: ICT change management, source code and component integrity, vulnerability and patch management, resilience testing, and incident management. Customers can simply switch on the controls that apply to their environment or needs instead of coding them.
Repo-Level Policies: Enables organizations to enforce governance controls at a granular level, based on the specific purpose, sensitivity, or lifecycle stage of the artifacts in a particular repository. By tailoring governance to specific repos, teams ensure only approved, compliant components enter the pipeline.
AI Verification Policies: Enables teams to write policies in plain language and LLM models evaluate every release against them to verify intent and alignment with any connected data source using AppTrust's Prompt to Release Traceability. Each evaluation then generates signed proof of compliance. By continuously validating intent against execution – such as matching Pull Requests to their original Jira ticket – JFrog AppTrust ensures neither agents nor developers introduce out-of-scope code, unauthorized security backdoors, or unapproved architectural shifts.
CRA readiness: JFrog AppTrust continuously monitors released components for vulnerabilities, generates a standards-based SBOM for each release, and keeps scanning history and remediation records attached to each release, making it easy for teams to start a 24-hour or 72-hour report from existing evidence.
One system of record, wherever it runs: The JFrog Platform is available as SaaS across major cloud providers and self-managed, with JFrog Artifactory as the single source of truth for every artifact and its evidence.
About JFrog
JFrog Ltd., the creators of the unified DevOps, DevSecOps, DevGovOps, and AgentSecOps platform, is on a mission to create a world of trusted software delivery without friction from development to production. Driven by a "Liquid Software" vision, the JFrog Platform is a software supply chain system of record that is designed to power organizations as they build, manage, govern, and distribute secure software with speed and scale. Holistic security features help identify, protect, and remediate against threats and vulnerabilities. The universal, hybrid, multi-cloud JFrog Platform is available as both SaaS services across major cloud service providers and self-hosted. Millions of users and approximately 6,600 organizations worldwide, including a majority of the Fortune 100, depend on JFrog solutions to securely embrace digital transformation in the AI era.
