What it is: a simple spreadsheet saved as a .csv file where each row is one decision your AI made about one person or case. You need at least two columns:

• A protected-attribute column — the group to check for fairness, e.g. gender, race, age_band.
• An outcome / prediction column — what the model decided, e.g. 1/0, approved/denied, hire/no-hire.
• (Optional) a ground-truth label column — the correct answer. Add it to also measure equal-opportunity (accuracy parity across groups).

Where to get it: export your model's prediction logs, batch-scoring output, or a table of past decisions from your data warehouse, BI tool, or notebook — most teams already log this.

How to create it: in Excel / Google Sheets add the columns above and Save As → CSV; or in Python: df[['gender','prediction','label']].to_csv('outcomes.csv', index=False).

🔒 Parsed entirely in your browser — the file never leaves your device. Download a blank template ↓

What it does: compares two snapshots of your data to detect drift — when live inputs have shifted away from what the model was built on (a leading cause of silent accuracy decay).

• Baseline — your reference data: the training set, or a known-good period (e.g. last quarter). Upload a CSV or paste a URL.
• Current — recent production data with the same column names. We compute PSI & KS for every shared feature.
• Load only the baseline to run a data-quality scan (missing values, outliers, constants, duplicates).
• URL sources supported: HuggingFace dataset pages (huggingface.co/datasets/…), direct .csv links (GitHub raw, cloud storage), HuggingFace file paths.

Download a blank CSV template ↓

What it does: scores your documentation against the 14 control areas auditors expect, then shows exactly which are present, weak, or missing.

• Link: paste a public URL to a model card (e.g. Hugging Face, GitHub, Confluence) and click Fetch & analyse — we retrieve and scan the text server-side.
• Paste: or paste the text directly — your model card, system card, datasheet, or any governance write-up, even a rough draft.
• Don't have one yet? Paste whatever description exists; the scan tells you precisely which sections to write next.
• You'll get: a completeness score and a present / weak / missing breakdown per control.

What it does: answers your AI-governance questions and proposes step-by-step fixes, grounded in the results from the other tools (your risk tier, fairness/drift findings, and documentation gaps).

• Run the Intake and scanners first for tailored advice — or just ask general questions about the EU AI Act, NIST RMF, ISO 42001, bias, or drift.
• It helps you prepare and evidence compliance; it never claims to make a system “compliant” on its own.

What it does: compiles every result into one audit-ready report — risk classification, applicable regulations across authorities, findings, and a prioritised remediation roadmap (each action has an owner, effort, framework reference, and acceptance test).

• Print / PDF to share with stakeholders; Save to get a link to resume or share the assessment later.
• Run more tools, then click Rebuild to refresh the report and score.

Select a framework below to see its phased rollout. Milestones are marked done, imminent (<90 days), or upcoming. Run the System Intake first and your risk tier will highlight only the obligations that apply to you.

What it does: compiles a structured technical document covering the 14 Annex IV control areas required for EU AI Act high-risk systems — auto-filled from your intake, fairness, and documentation results.

• Run the System Intake and Fairness Scanner first for the richest auto-fill.
• Fill in any blank fields, then click Generate & Download to get a .md file ready for your technical file.
• The card is a governance starting point — have your legal team review before submission to a notified body.

System prompt: the instructions you give the LLM before the user turn. Required by EU AI Act Art. 50 to include an AI disclosure. We check for 6 recommended safety controls.

Adversarial test prompts: one per line — paste typical attack samples from your red-team or known jailbreak libraries to see how many your system prompt can resist. We check 24 injection and jailbreak patterns.

• All analysis runs in your browser. No prompts are sent to any server.
• Pattern matching is a fast triage — not a substitute for live red-teaming with a real model.

A board-ready governance framework document covering five areas:

• AI Governance Team Charter — mandate, composition, and the explicit input → process → output workflow the team operates on.
• C-Suite Accountability Matrix — what each executive owns, what they receive monthly/quarterly, and what they approve.
• IT Governance Controls for AI — data, infrastructure, security, change-management gates, vendor governance, and incident response.
• 12-Month Working Plan — phased roadmap (Foundation → Assessment → Controls → Optimise) with inputs, activities, and deliverables per phase.
• Staff AI Usage Policy — acceptable use, approved-tools register, and high-risk use cases that need governance approval.

Fill in your organisation profile and click Generate Framework. Download as Markdown for your intranet, board pack, or compliance file.

Each iteration runs four steps:

• Observe — reads your current assessment (risk tier, fairness, drift, docs, LLM safety).
• Think — a reasoning model decides the single best next action.
• Act — executes that action (flag a gap, record a recommendation, summarise findings, or ask you a question).
• Evaluate — scores progress and decides whether to continue.

The agent stops when the goal is complete, it needs your input, or it reaches the 6-iteration limit. Run Tool 1 (intake) first so the agent has real data to reason from.

Most AI governance tools review models and documents, periodically. This governs every action an agent takes, at runtime — the layer no one else ships.

• Policy-as-code: risk = action type × irreversibility × data sensitivity × blast radius. Crossing a threshold forces human approval or a block.
• Redaction: PII & secrets are stripped before the action runs. The raw payload is never stored — only a redacted copy.
• Tamper-evident ledger: each entry is hash-chained to the one before it (EU AI Act Art. 12). Change any past record and Verify chain breaks.
• Kill switch: engage it and the whole fleet is halted (EU AI Act Art. 14(4)).

We score every incident against your system's domain, risk tier, and findings — and, when available, against your live Agent Control Plane telemetry (the action types your fleet is intervened on most). Higher relevance = closer to your situation.

• If you've run the System Intake, your profile is pre-filled. Otherwise set it below.
• Each match shows the failure mode and the exact preventive control + framework reference.

We score every tracked development against your jurisdiction, tier, domain and traits (GenAI, personal data, automated decisions), then sort by what's coming soonest and what changed most recently.

• Pre-filled from your System Intake when available — adjust below.
• Each item shows who it affects, the impact, and a concrete next action.

Register a system (or auto-fill from your System Intake). We compute every regulatory obligation that applies to it — across the jurisdictions it operates in — with a countdown to each effective date and the concrete artifact list. Link saved assessments to build the system's governance record.

• Active duties already apply today; imminent ones take effect within 180 days.
• The Control Library below cross-maps NIST AI RMF (72 subcategories), ISO/IEC 42001 Annex A (38 controls) and the EU AI Act artifact set, so one piece of evidence can satisfy several regimes.

Getting a compliance deadline wrong is worse than being slow to update it. The watcher classifies news by likely framework/jurisdiction and — when an LLM is configured — drafts a plain-English summary and a suggested Regulatory Horizon entry. You decide what's accurate and supply the final date/impact/action before anything is published.