Compliance your platform generates by default.
Verholm builds the Compliance Fabric, an open-source control and evidence layer for regulated AI, and helps life sciences and finance teams put it into production.
The Compliance Fabric
An open-source layer that runs across a regulated Kubernetes platform. You author controls once, the platform enforces them as policy, and the running system produces audit-ready evidence on demand. The control logic is open, so a quality team and an auditor can read exactly how each control is enforced, instead of trusting a black box.
Author
Controls as code in OSCAL: GxP, DORA, and NIS2 in one place.
Enforce
Controls compiled into Kubernetes policy at CI, admission, and runtime.
Evidence
Running state becomes audit-ready evidence and on-demand audit packs.
A consultancy built around the Fabric.
Readiness assessment
A fixed-scope review of your platform against the Fabric's controls for GxP, DORA, and NIS2. You leave with a clear gap map and a path to close it.
Implementation
We deploy and qualify the Fabric on your platform, wiring policy enforcement, supply-chain trust, and evidence collection into your clusters.
Managed Fabric
A hosted control plane, audit-pack and validation-report generation, certified GxP control packs, and support, built on the open core.
Training and enablement
Workshops that bring your platform and quality teams up to speed on Kubernetes, validated AI, and the Fabric itself.
I'm a platform engineer in Copenhagen who has built GxP-compliant Kubernetes platforms for regulated manufacturing at major Nordic life sciences companies.
I'm a full Kubestronaut, holding all five CNCF Kubernetes certifications, and I maintain the open-source Compliance Fabric. I also teach Kubernetes and platform engineering publicly on LinkedIn, Udemy, and LinkedIn Learning. Verholm is where that combination of regulated delivery and open-source work becomes independent.
The thesis is simple: agentic AI is arriving in regulated industries whether the validation story is ready or not. The Fabric is how I make sure it is, in the open.
Putting AI into a regulated environment?
Start with a readiness assessment. Fixed scope, a clear written output, and no long commitment.