JFrog is expanding AppTrust with new DevGovOps features for European compliance. A ready-to-use DORA framework, repository-level policies, and AI Verification Policies are designed to give organizations signed proof with every release. This enables CISOs and R&D teams to comply with EU regulations without slowing down development.
With this expansion, JFrog aims to provide security and development teams with a single, shared overview of all legal requirements. According to the company, pressure is mounting from two directions. Regulators demand more oversight and evidence with each release, while AI agents generate code much more frequently. “Can you prove the trust in what you shipped and can you do it continuously to match the release cadence driven by AI agents?” summarizes CTO Yoav Landman.
Enabling controls instead of coding
The DORA framework is the most concrete addition. AppTrust provides pre-mapped “Policy as Code” rules for five areas: IT change management, source code and component integrity, vulnerability and patch management, resilience testing, and incident management. Users simply enable the controls that apply to them. Each control is linked to a DORA requirement. A score indicates which part of the framework is active.
Repo-Level Policies go a step further. Teams use them to set governance rules per repository, depending on the purpose, sensitivity, or lifecycle stage of the artifacts. This ensures that only approved components enter the pipeline.
And then there are the AI verification policies. Teams write policies in plain language, after which LLMs assess each release against them. For example, the system checks whether a pull request matches the original Jira ticket. Each assessment provides signed evidence. The goal is to prevent agents or developers from introducing out-of-scope code, unauthorized backdoors, or unapproved architectural changes.
The Cyber Resilience Act is also addressed. AppTrust continuously monitors released components for vulnerabilities, generates an SBOM for each release, and maintains scan history and remediation actions. Based on this, teams can prepare a report within 24 or 72 hours.
The DORA framework and AI Verification Policies are available immediately. The JFrog platform runs as SaaS with major cloud providers or as a self-managed solution, with Artifactory serving as the central repository for all artifacts and associated evidence.
Tip: JFrog aims to curb AI agents in the software supply chain