AI governance
AI is already in your business. Now you can show it's under control.
No agent to install and no new tool to learn. AI governance runs through the modules you already use, into the same findings register.
Three questions every board will ask.
Where are we using AI?
An inventory across your own assessments and the suppliers who process your data.
Is our data being used to train models?
Vendor answers recorded, scored and kept with the vendor's history.
Do staff know the rules?
A signed record of who has acknowledged your AI use policy, and which version.
AuditPilot
Assess your own AI use
Work through ISO/IEC 42001 and NIST AI RMF structures alongside Essential Eight and ISO 27001. Gaps go straight into your findings register with an owner and a due date.
- ISO/IEC 42001 management system areas
- NIST AI RMF Govern, Map, Measure, Manage
- Evidence and maturity per control
VendorShield
Know which suppliers put your data into AI
Send the AI & data exposure questionnaire to any supplier. Answers like “we train models on your data” raise a finding automatically and lift the vendor's risk tier.
- Model training, retention and region
- Third-party AI providers and subprocessors
- Opt-out and human review commitments
Policy management
Get staff to agree how they use AI
Start from the Acceptable AI Use and AI Data Handling templates, publish a version, and track who has acknowledged it. Overdue acknowledgements become findings.
- Versioned, immutable published policies
- Private signing links per employee
- Exportable acknowledgement record
SecureDevComing soon
Catch AI risks in your code
Detect hardcoded AI provider keys and flag prompt-injection patterns in the applications you build.
- AI API key detection
- Prompt-injection pattern checks
- Findings assigned to developers