Compliance in software delivery is crucial yet often cumbersome, relying on manual processes. GitLab's custom compliance frameworks offer an automated solution. Instead of documenting compliance, you define controls once, and the platform continuously verifies adherence. This article details establishing a SOC 2 framework quickly using templates, continuous monitoring, policy-based enforcement, and available standard templates. It also previews future AI-specific compliance templates.Compliance adherence is vital for regulatory and contractual obligations like SOC 2 and ISO 27001, preventing deal blocks, fines, and trust erosion. Custom frameworks address this by creating a label for projects with specific compliance needs. In Ultimate, these frameworks include requirements and automated controls, evaluating conditions like SAST running or branch protection. This shifts compliance from a sporadic audit snapshot to continuous, year-round monitoring.Templates simplify framework creation, offering predefined configurations for standards like SOC 2. You can create a framework from a built-in template in the Compliance Center or import a JSON file. Once applied, the SOC 2 template maps GitLab controls to Trust Services Criteria, checking items like vulnerability scanning, segregation of duties, and branch protection.The compliance status report (Ultimate) provides continuous visibility into adherence. It shows non-compliant projects, failed controls, and fix suggestions, updating automatically every 12 hours. This ensures compliance drift is detected within hours, not annually. Administrators or Security Managers/Owners can view and export this report.Beyond reporting, compliance adherence is enforced through policies. Scan execution, pipeline execution, and merge request approval policies can be scoped to a compliance framework. This automatically applies guardrails to all projects under that framework, blocking non-compliant changes before they merge.GitLab offers a growing library of predefined templates for standards like CIS CSC, CSA CCM, FedRAMP, ISO 27001, and PCI DSS. These templates are importable JSON files, configurable to an organization's specific needs. Future plans include AI-specific compliance templates for emerging AI governance obligations like the EU AI Act.