Compliance-Epistemic Project Framework (CEPF)

CEPF is a regulatory crossing catalogue: a mapping of regulatory regimes onto the operational obligations each one produces, and onto the points where those obligations overlap. It exists because organisations subject to several regimes at once do not face a sum of separate compliance programmes — they face one programme with shared controls, and the shared controls are where both the cost and the omissions concentrate.

The framework works on obligations, not on principles. Every regime is broken down into the deliverables it actually requires, the roles that produce them and the effort each one carries. Where two regimes demand the same control — access management, audit logging, change management, incident response — the control is stated once and documented against each regime, rather than built twice.

CEPF is proprietary to Dynamics Consulting, and it is the instrument behind the exposure assessment and the wider AI governance and compliance advisory work.

CEPF v7 — 19 frameworks, 247 requirements, 24 cross-framework overlap groups, 695 document templates — snapshot July 2026

An overlap group is a point where two or more regimes require the same control — not a similar principle, but an artefact or a process that can be built once and documented against each regime. Access management, audit logging, change management, incident response, an SBOM, a technical file, a post-market surveillance plan. A programme built regime by regime does that work twice and still leaves gaps at the seams; a programme built on the crossings does it once and documents it against each.

Which groups exist, which requirements sit in each and what the shared control is worth in effort stay inside the framework: that mapping is the instrument, and it is applied in engagements rather than published.