Module 4 · Govern
12 frameworks. 120 controls. One operating model
A single governance operating model across every regulatory obligation your AI estate faces, including EU AI Act, NIST AI RMF, ISO/IEC 42001, OWASP, MITRE ATLAS, GDPR, MAS MindForge, AI Verify, HIPAA, and more.
0
Frameworks
All major regulatory bodies
0
Controls
Across all 12 frameworks
0
Critical-severity
Requiring immediate attention
2
Control modes
Enforce or monitor, per control
12 frameworks. One score per AI system.
Every framework chip below is live in the platform today. The Conformity Score aggregates compliance posture across all of them.
From Submitted to Approved, with score gates
State-machine lifecycle for the conformity-assessment process. Score gates protect every transition, so a system cannot advance while critical controls are failing.
12 frameworks. One score per AI system.
Live, severity-weighted 0–100 score per AI system per framework. Updated after every test run. Your board and auditors see the same number in real time.
12 frameworks with real control counts and criticality data. Each framework maps to platform test coverage, not aspirational claims.
12 frameworks. 120 controls. One operating model.
73 / 100Coming next
Risk Classification Wizard
5 questions. EU AI Act risk tier.
The Risk Classification Wizard walks through 5 intake questions and outputs the EU AI Act Article 6 risk tier for your AI system, plus the recommended framework set for your compliance programme.
- Minimal risk · Limited risk · High risk · GPAI tier classification
- Recommended framework set per tier (EU AI Act + NIST + ISO/IEC 42001)
- Output feeds directly into the Conformity Pipeline
Annex IV Dossier. Auto-generated. Hash-anchored.
The complete EU AI Act technical documentation produced from test evidence, policy records, and conformity pipeline outputs. Your Notified Body gets a dossier they can verify, not one they have to trust.
EU AI Act Annex IV Dossier
Auto-generated · Hash-anchored · Audit-ready
Source evidence
Test results, policy records, conformity pipeline state, risk classification output
Integrity
Every assertion hash-anchored to the blockchain audit log. RFC3161 timestamps on every page.
Verification
External Auditor Seats give your Notified Body scoped, time-boxed, read-only access to the evidence behind every claim.
Controls Library
Enforce or monitor. Per control.
Every control has a mode: enforce blocks non-compliant actions; monitor creates an alert. Switch between modes without writing new policies, and simulate the impact before you commit.
- 120 controls across 12 frameworks
- 38 critical-severity controls with 4-hour SLA
- Mode changes routed through Approval Queue
Policy Studio
Author. Simulate. Enforce.
Author policies in YAML or JSON. Simulate against historical traffic before enforcing: see which past events would have been blocked before you promote to production.
Detect behavioural drift before it becomes a violation
Intent Baseline uses Lasso-style statistical modelling to capture the expected behavioural envelope of each AI system, then alerts when outputs deviate, even when individual responses look acceptable in isolation.
Policy originates here. Enforcement lives in Control.
Policies authored in Govern are enforced in Control and proven via test results in Analysis.
Trust layer for enterprise AI