JFrog Ends the Audit Scramble: Delivers New DevGovOps Capabilities with Signed Compliance Evidence for Every Release, Without Slowing Development

New DORA Compliance Framework, Repo-level Policies, and AI Verification Policies give CISOs and R&D leaders one shared view of EU regulatory requirements, including AI assets

SUNNYVALE, Calif. & BARCELONA, Spain, October 21, 2026--swampUP Europe 2026 – JFrog Ltd. ("JFrog") (NASDAQ: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, the system of record for trusted software artifacts, binaries, and AI assets, today announced new DevGovOps capabilities that give CISOs and R&D leaders a single, shared view of regulatory requirements with signed evidence for every release. The new capabilities include an Out-of-the-Box Compliance Framework for the EU Digital Operational Resilience Act (DORA), Repo-Level policies, and AI Verification Policies. Together these capabilities help organizations prepare for continuously complying with EU software regulatory deadlines, without slowing development.

"We are excited to give Security and R&D leaders one version of the truth for EU Software Compliance," said Yoav Landman, Co-Founder and CTO, JFrog. "Regulations now demand more controls and visibility, backed up by evidence for every release, and AI is dramatically accelerating the pace and the number of releases. It all comes down to a simple question: can you prove the trust in what you shipped and can you do it continuously to match the release cadence driven by AI agents? Our customers can now rely on one system of record for their releases and compliance evidence, and with policies that check a release against its intent in plain language and produce signed proof."

Compliance Deadlines are Here. Gaps in Control Are Becoming Liabilities.

Various regulatory deadlines are already in effect or arriving fast – DORA, European Central Bank (ECB), Cyber Resilience Act (CRA), the EU AI Act, etc. – each having unique requirements, but the one common thread is evidence produced on demand. And the consequences of not being able to comply can be costly. For example, the CRA requires manufacturers of products with digital elements to issue an early warning within 24 hours and notify authorities within 72 hours of an actively exploited vulnerability or severe incidents. Additionally, manufacturers must manage vulnerabilities for the product's supported life. Fines can reach €15 million or 2.5% of global annual turnover, whichever is higher.

The widespread adoption of AI amplifies the compliance challenge. Autonomous agents and AI-assisted developers can plan, code, test, and deploy in hours, while manual governance processes take weeks. Recent survey data shows 59% of companies regularly compromise on compliance under business pressure, and 43% rated their compliance maturity at the lowest level. Additionally, Gartner research notes that CIOs and CISOs face tension due to competing mandates: service delivery versus security.