AI Governance module

Know what AI is in your business, who is accountable for it, and what you would tell a customer, an auditor or a regulator.

Self-guided, or with advisors at the ready.

A model inventory, a risk register and the policy set behind them, mapped to the EU AI Act, NIST AI RMF and ISO 42001.

See what you need to reportOrder the module, $2,900/yr

How people arrive here

Enterprise procurement asked
A customer wants to understand how you govern AI before they sign, and a clear answer moves the deal along.
The EU AI Act applies to you
You use or provide a system within its scope, and the obligations are workable once you know which ones are yours.
Your board asked
What AI is in use, who owns it, and what happens if it goes wrong.

What the module covers

Model inventory
What AI is in use, by whom, and for what, with an owner recorded against each system.
Risk classification
Against the AI Act categories, with the Annex III section cited on each classification rather than a tier asserted on its own.
Risk register
Each system carries the risks identified for it, who owns them, and what is in place, so the register answers a question about a named system rather than describing the estate in general.

How it works

You bring
A list of the systems you use or build, and who owns each.
ThemisIQ applies
The classification each framework uses, so what you enter once serves the AI Act inventory, the risk register and your policy set.
You get
An inventory, a risk register and a policy set you can send to a customer.

How you stand behind it

Every classification records the basis it was made on, and is recomputed against current guidance rather than left frozen.

Nothing is a black box. Every score carries the inputs and the method that produced it, so a reviewer can follow the reasoning rather than taking the number on trust.

What it satisfies

Each of these is described, sourced and mapped to a module on the regulations page.

EU AI ActNIST AI RMFISO 42001

High-risk obligations apply from 2 December 2027 for stand-alone systems, and from 2 August 2028 where the AI is built into a product already covered by EU product-safety law (Regulation (EU) 2024/1689 as amended by (EU) 2026/1744).

Those are the high-risk dates, and they are not the whole Regulation. The Article 5 prohibitions have applied since 2 February 2025, with the prohibitions added by the 2026 amendment applying from 2 December 2026. Obligations for general-purpose AI have applied since 2 August 2025, and the Article 50 transparency duties retain their original schedule. So parts of the Act may already bind you even though the high-risk deadlines are years away.

Pricing

One flat annual price.

Add modules and the multi-module discount applies automatically: two modules −10%, three or more −20%.

AI Governance
$2,900 / reporting year
✓Model inventory: what is in use, by whom, for what
✓Risk classification against the AI Act Annex III categories
✓Requirements for each system, from its classification
✓An inventory export you can send to a customer
Order the module

Questions people ask first

We only use third-party AI tools. Does this still apply?
Usually yes, and it is the commonest case. The Act places duties on deployers as well as providers, so using a system someone else built can still bring obligations, and a customer asking how you govern AI will not distinguish between the two. The inventory records what you use alongside anything you build, with the owner named either way.
How do we know if a system is high-risk?
High-risk under the Act is not a judgement about how advanced a system is, it is whether its use falls in one of the Annex III categories, such as employment and HR, credit and finance, education, or essential services and healthcare. The module classifies against those categories and cites the section it matched, so the answer is checkable rather than asserted.
Is ISO 42001 certification required?
No. ISO 42001 is a voluntary management-system standard and no regulation requires certification to it. What a customer or an auditor usually wants is evidence that you know what AI you have, who is accountable for it and what you do when something goes wrong, which is the same evidence the standard is built around.
How long does an inventory take to build?
As long as it takes to list the systems you use or build and name an owner for each. Classification and requirements follow from that rather than needing separate work. What takes longest is finding the systems nobody has written down, which is also the part with the most value in it.
Citation for the dates above: Regulation (EU) 2024/1689 as amended by (EU) 2026/1744.

Not sure whether the AI Act reaches you?

Free, takes about five minutes. Your Compliance Obligation Map lists the sustainability-related regulations your company is likely to face, country by country.

See what you need to reportTalk to us