I worked at a bring your own distro place before, ISO certified. I don’t exactly recall what we had to install for compliance but one of them was Clam AV. So it’s possible.

I recall Arch, Ubuntu, Debian and Fedora being used. Relatively small shop though, like 40 devs.

Ironically we were contracting with ASML at the time and ended up having to work on Windows machines using Remote Desktop 99% of the time.