One workspace for the whole governance loop

A central record of every AI system and agent: vendor, model, owner, department, purpose, affected people, jurisdictions, data categories, hosting, access, decision authority, human oversight, lifecycle, review dates and change history. Agents are first-class records with authorized actions, connected tools, autonomy level, override and logging.

• Manual entry and CSV import
• Lifecycle Draft → Review required → Approved → Active → Suspended → Retired with approval records
• Material changes (deployment, data, jurisdictions, permissions) automatically create a reassessment task
• Dependency map: organization → department → system → vendor → data → tools, with declared vs inferred relationships labelled

Organization-level and per-system assessments with a transparent prioritization model (severity × likelihood × exposure), unknown-is-not-safe scoring, and a versioned regulatory rules engine that returns potentially applicable, likely not applicable, insufficient information or requires specialist review.

• Every finding explains why it was produced
• Assessment history is preserved per version and ruleset
• Results link to official sources and verification dates

A structured, version-controlled regulatory database covering Canada (PIPEDA, Quebec, Alberta, BC, Ontario, Bill C-36 status, the AIDA history), the EU AI Act as amended in 2026 with GDPR intersections, US federal and state instruments, and voluntary standards (NIST AI RMF, NIST GenAI Profile, ISO/IEC 42001, ISO/IEC 23894, OECD).

• Each requirement carries jurisdiction, authority, citation, source URL, status, dates, applicability conditions, evidence, controls, confidence, version, reviewer and verification date
• Scheduled source monitoring with ETag/hash change detection feeds a human review queue; nothing goes live without validation
• Historical versions remain available for past assessments

Findings become structured tasks with title, explanation, rationale, priority, owner, due date, status, related system, requirement, control and evidence. Kanban and table views, reviewer approval, and risk acceptance with named approver, rationale, expiry and review date.

• Accepting a risk never removes a legal obligation; it is recorded as a decision
• Task events keep a full completion history
• Owners are notified by email when assigned

Twelve document types generated from structured answers: Acceptable Use, Governance Policy, Inventory, Risk Assessment, Vendor Due Diligence Questionnaire, Incident Response, Agent Access & Approval, Data Handling, Training Record, Action Plan, System Card and Management Review Summary.

• Draft → Review → Approve → Publish → Reassess with approval history
• Every version is stored; approved versions are never overwritten
• PDF, DOCX and Markdown export
• Assumptions and references are listed inside every document

Vendor records with AI capabilities, data relationship, retention, subprocessors, trust documentation, contract status, security controls, certifications (claimed vs verified), renewal date and approval status. Send a twelve-area questionnaire by secure link, collect answers, and record a reviewer decision.

• Certification claims stay unverified until a report is attached as evidence
• Questionnaire answers are stored verbatim with document references
• Vendor review report per vendor

Uploads with SHA-256 hashes, classification, ownership, timestamps, verification state (uploaded, reviewed, verified, rejected), expiry and retention dates, links to systems, controls, tasks, policies, vendors and incidents, and a hash-chained audit log.

• Evidence coverage map shows which controls are evidenced, awaiting review, untested or failed
• Export bundles by period and system
• Downloads are authenticated and logged

Reported → Triaged → Investigating → Contained → Resolved → Reviewed with timeline, affected system, cause, impact, mitigation, follow-ups and a note on potentially applicable external reporting for specialist review. The platform never notifies regulators or third parties on your behalf.

Executive Governance Summary, AI Risk Register, System Assessment Report, Vendor Review Report, Regulatory Applicability Report, Governance Activity Report and Evidence Export. Each states scope, date, limitations, source basis and reviewer status.

Roles: Owner, Administrator, Compliance Manager, Contributor, Viewer, External Reviewer and Authorized Partner. Server-side permission checks on every action. Advisor workspaces manage separate client organizations with recorded authorization and strict tenant isolation.