Accord · AI governance
Prove your AI is governed.
For teams deploying AI that must evidence it: map systems to the EU AI Act and NIST AI RMF, assess once across frameworks, and work every gap to closure.
One register, audit-ready AI records, ISO 42001 readiness.
Executive posture — composite risk exposure and cross-framework gaps
Award-winning Risknox platform
Platform tour · 5 modules
See Accord in operation.
From the posture view your board asks for to the remediation queue your engineers work, in the same governed register.
Module 01 · Command Center
Executive posture, at a glance
One view of AI risk exposure across every registered system, ranked so the unassigned owner and the missing evidence surface before the audit does.
Composite risk exposure score
Blends model criticality, control coverage and open gaps into a single figure.
Cross-framework gap radar
NIST AI RMF, EU AI Act and ISO 42001 gaps compared in one view.
Ranked work queue
Unassigned owners, scope drift and missing evidence ordered by severity.
Executive posture — composite risk exposure and cross-framework gaps
Module 02 · AI visibility
Find the AI nobody registered
Shadow AI enters through procurement, pilots and side projects. Accord discovers the tools in use and pulls them into one register — each with an owner, a data class and a policy.
Discovery across the estate
Sanctioned and unsanctioned tools appear in the same list, not split across spreadsheets.
Data flow per tool
What each tool receives, where it is hosted and who approved it.
Register with an owner
Every entry carries a risk rating and a named accountable person.
AI discovery
Shadow AISupport copilot
Customer ops · Customer tickets
Drafting assistant
Marketing · Public content
Transcription tool
Unassigned · Meeting audio
Vendor forecasting API
Finance · Internal forecasts
Browser summariser
Unassigned · Unclassified
Every tool found is registerable · owner, data class and policy per entry
AI discovery — shadow AI register with owner and data class
Module 03 · Inventory
Onboard every model once
Structured intake registers internal models, vendor APIs and agentic pipelines with the business context that decides which obligations apply.
Guided metadata intake
Purpose, architecture, ownership and data boundaries captured in one form.
Jurisdiction scoping
Deployment regions drive the requirements that follow the system.
Control package recommendation
Accord proposes the frameworks that system must satisfy.
System intake — business context, jurisdiction and criticality tiering
Module 04 · Assessment
Assess once, comply everywhere
Run EU AI Act, NIST AI RMF, ISO 42001 and Microsoft responsible-AI checks together, with overlapping controls de-duplicated and completion tracked as you work.
Curated control library
Pre-built, maintained controls for four global standards.
Completion tracking
Completed controls, pending checks and remaining readiness in one place.
Audit-ready export
Board and regulator-ready documentation the moment coverage is complete.
Gap assessment — available audits, added audits and control coverage
Module 05 · Remediation
Gaps become assigned work
Findings turn into engineering and policy tasks, weighted by business and technical impact so legal, risk and engineering agree on what is fixed first.
Dual impact modelling
Financial and reputational damage paired with the technical failure mode.
Prescriptive steps
Workshops, policy templates and documentation guides per gap.
Effort and dependency mapping
Low, medium or high scoping with prerequisites for backlog planning.
Mitigation work queue — business and technical impact per gap
What it does
The capabilities that matter.
AI has entered through procurement, pilots and side projects. The register is out of date the week it is written.
AI visibility and shadow AI discovery
Find every AI tool, model and assistant in use across the organisation — sanctioned or not — see which data flows into each, and bring them under one register with an owner, a risk rating and a policy.
Read the detailAI project inventory
One register of every AI system, owner, vendor, data class and deployment stage.
Gap assessment
Structured assessment against the controls your sector and board expect, with an evidence trail.
Security analysis
Review of data flows, model access, third-party dependency and prompt-injection exposure.
Mitigation tracking
Each gap becomes an owned task with a due date, so remediation is visible instead of assumed.
Reporting
Board and audit-ready reporting on AI inventory, open risk and progress over time.
Model Hub
One inventory of the AI models you use, their files, versions and owners — files stay in your own storage.
AIVSS reports
AI vulnerability scoring for your models and agents.
Microsoft Responsible AI mapping
Your controls mapped against Microsoft’s responsible AI standard.
AI impact assessment
Record the impact of each AI system, and who signed it off.
Regulatory engine
Assess once. Comply everywhere.
Controls are cross-mapped between frameworks, so overlapping requirements are satisfied by a single verified check rather than four separate audits.
EU 2024/1689
EU AI Act engine
Risk classification, Annex IV technical documentation, human-oversight records and post-market monitoring, mapped to enforcement deadlines.
- Prohibited, high-risk, GPAI and minimal classification
- Annex IV technical documentation
- Oversight and guardrail records
- Incident logging and post-market monitoring
NIST AI 100-1
NIST AI RMF mapping
Operationalise GOVERN, MAP, MEASURE and MANAGE, with model telemetry linked to organisational risk tolerance.
- Four-function alignment with evidence links
- Socio-technical and algorithmic impact mapping
- Safety and reliability benchmarks
- Adverse-behaviour review records
ISO/IEC 42001
ISO 42001 readiness
Stand up an AI management system with policy lifecycle control and an evidence locker an auditor can walk through.
- AI policy and objectives governance
- System lifecycle and change-control records
- Third-party supplier risk assessments
- Audit-ready evidence locker
Fortress handoff
AI risk in money
Accord findings flow into Fortress, so AI exposure is quantified beside the rest of enterprise risk instead of being tracked separately.
- AI exposure in the Fortress register
- Loss range per AI system
- Control gaps priced by expected loss
- One board view across every risk type
Governance engine
Built for AI estates that matter.
From foundation-model fine-tuning to agent tool calls, every layer of the lifecycle is instrumented, recorded and reviewable.
AI risk scoring
Objective severity scoring across exploitability, business impact, data exposure and guardrail maturity.
Audit-ready AI records
System cards and Annex IV artefacts generated from the register for regulators and customers.
Drift and policy alerts
Detection of prompt-injection exposure, guardrail evasion and unapproved parameter change.
Provenance and lineage
Logs of datasets, prompt templates, fine-tuning checkpoints and API versions.
Cross-functional workflow
Shared queue for engineering, risk, legal and compliance, with delegation and sign-off.
CI/CD and MLOps native
Checks inside GitHub Actions, GitLab CI, MLflow and LangSmith pipelines.
How it works
Governed in three moves.
Register what you run, assess the controls once, then keep the record current as the estate changes.
Catalog AI systems
Register internal models, vendor APIs and agentic pipelines into one governed inventory.
Evaluate controls
Run checks for safety, privacy, fairness, robustness and human oversight.
Record and oversee
Publish audit-ready records and get alerted on policy drift or unapproved change.
Who it’s for
One record, four different conversations.
Scale with assurance
Chief AI Officers
Ship generative and agentic AI with a governance record behind every deployment.
Retire the spreadsheet
GRC and risk leads
Replace manual tracking with multi-framework assessments in one register.
Deadlines tracked
Legal and compliance
Annex IV documentation, oversight records and a defensible evidence trail.
Guardrails in the pipeline
AI and ML engineering
Compliance inside MLOps, without slowing the release.
One pipeline
Govern → Monitor → Quantify → Underwrite.
Accord posture flows into Pulse, Fortress and Compass — no re-entry, no evidence loss.
Governance frameworks
FAQ
Answers auditors ask for.
How does Accord support EU AI Act compliance?
Accord classifies each system as prohibited, high-risk, GPAI or minimal, generates Annex IV technical documentation, records human-oversight arrangements and keeps post-market monitoring logs aligned to enforcement deadlines.
Does it govern third-party models like OpenAI, Anthropic or Bedrock?
Yes. Vendor APIs are inventoried like first-party models: configuration, prompt templates, data-processing terms and guardrail enforcement are checked against your governance policy.
How does AI risk scoring work?
Each system is scored on business impact, data exposure, exploitability, hallucination likelihood and guardrail maturity, which produces an objective severity rating so teams fix what matters first.
How does Accord connect to Pulse, Fortress and Compass?
Pulse signals feed the Accord inventory, Accord gaps flow into Fortress for dollar-quantified loss modelling, and the resulting posture is available to Compass for underwriting.
How do we start?
Guided intake plus MLOps and cloud connectors populate the inventory, so the first assessment starts from a structured register rather than a blank page.
Get started
Govern the AI you already run.
Walk your AI estate with us, or start from the inventory and assessment you already have.