AI Governance Pack

AI governance is two more frameworks on the evidence engine you already run

An AI-asset inventory, a model/vendor register, and readiness tracking against NIST AI Risk Management Framework 1.0 and ISO/IEC 42001:2023 — 110 tracked controls, one module.

Start free trial Book a walkthrough

Why this exists

Almost every mid-market compliance tool can run a SOC 2 or ISO 27001 program. Almost none of them have an answer when a customer’s security questionnaire asks how you govern the AI features you shipped last quarter, or what happens when a vendor bakes a foundation model into a tool your team already uses. NIST AI RMF and ISO/IEC 42001 are already fully seeded in CMDash’s framework catalog — this pack is what makes them sellable on their own: an inventory to start from, a register for the vendors behind your models, and a readiness view that tells you what is actually missing.

“GOVERN, and specifically the inventory and decommissioning subcategories. Almost nobody has a maintained AI system inventory with a risk tier per entry when they start, and almost nobody has a documented process for retiring a model. Both are subcategories, both need an artefact, and neither can be produced retrospectively.”

From the NIST AI RMF framework page’s own FAQ.

What’s in the pack

AI-asset inventory worksheet

An AI asset is not a second inventory bolted onto the side — it is CMDash’s existing crown-jewel asset record, extended with the fields an AI-governance review actually asks for. Create one and you get an ordinary asset (name, owner, criticality) plus:

Purpose — what the system does, required for every entry
Foundation model — free text (e.g. "GPT-4o", "in-house fine-tune"), not a fixed list
Model / API provider — links to your existing TPRM vendor register, not a second vendor list
Data classification — the same CUI/PHI/PII/confidential/internal/public scale used everywhere else in CMDash
Human oversight — human-in-the-loop, human-on-the-loop, or autonomous (self-declared, never computed)
Training data source, and free-form notes

Model / vendor register

Rather than a second, parallel vendor list, an AI asset’s model or API provider links to the same third-party-risk vendor record everything else in CMDash uses — the same criticality tier, monitoring, and questionnaire workflow, not a spreadsheet that goes stale the moment your real vendor record changes.

Readiness tracking

A prioritized gap list for each framework, using the same rule engine every framework in CMDash runs on:

Unmapped controls — never assessed at all
Missing evidence — marked implemented with nothing on file
Stale evidence — past the tenant's own freshness window
Continuous-control-monitoring drift, for any control wired to a CCM rule

Zero shipped evidence-mapping rules for either — no mainstream integration category answers “AI posture” the way there is for identity or vulnerability scanning today. Readiness here means a rule-based gap list over what you’ve assessed and attached evidence to, not an automated scanner that reads your AI systems for you.

The two frameworks

NIST AI Risk Management Framework 1.072 controls

GOVERN, MAP, MEASURE and MANAGE, with the verbatim public-domain subcategory text. The voluntary framework US regulators and customers increasingly ask about, tracked as real controls with evidence.

Ships with verbatim NIST AI Risk Management Framework (AI RMF 1.0) text — public-domain content.

ISO/IEC 42001:202338 controls

The first management-system standard for artificial intelligence. Track an AI management system the same way you track your ISMS — policies, roles, impact assessment, life cycle, data governance, and third-party AI.

Control text is licensed by ISO / IEC — CMDash ships identifiers, titles, and its own evidence guidance, never the publisher’s wording.

The two frameworks crosswalk to each other, and ISO/IEC 42001 crosswalks on into ISO/IEC 27001’s Annex A — so work you’ve already done for an ISMS carries partway into your AI management system instead of starting from zero.

Where this pack stops

Published on purpose — a buyer who finds a limit after signing is a support ticket, not a sale.

The AI inventory is what your people register. CMDash does not discover AI systems on your network, in your SaaS estate, or in your code — shadow AI stays invisible until a human enters it, and closing that gap is exactly what the AI-governance specialists sell.
No model-level technical testing. CMDash runs no bias, robustness, drift or performance evaluation of a model. Those results are evidence you attach from somewhere else, never evidence the product produces.
EU AI Act coverage is the shipped framework and regulatory-radar content — obligation dates mapped onto ISO 42001 and NIST AI RMF controls. It is not a staffed regulatory-research desk reinterpreting the Act for you as guidance lands.
Framework coverage here is ISO/IEC 42001 and NIST AI RMF. Specialist AI-governance platforms map ten or more AI regimes; CMDash maps two, and crosswalks them into the ISMS you already run.
AI governance is a pack on a general GRC platform, not a dedicated AI-governance product. In a market moving this fast it will trail the specialists on AI-specific depth — the trade is that everything else in your programme is already here.
ISO 42001 Annex A control text is licensed by ISO and is not reproduced anywhere in CMDash — you need your own copy of the standard to work from.
Readiness is a rule-based gap list, not an AI-specific automated scanner — there is no mainstream integration category that reads an AI system for its own posture the way there is for identity or vulnerability scanning.
CMDash is not a certification body. Certification against ISO/IEC 42001 is issued by an accredited body after an audit; there is no such thing as being "AI RMF certified" at all — it is a voluntary framework.

Every seeded framework, including both of these, is available on every CMDash tier — the AI Governance Pack adds the inventory, register, and readiness surfaces on top.

Start free trial View pricing

Why this exists

From the NIST AI RMF framework page’s own FAQ.

What’s in the pack

AI-asset inventory worksheet

Purpose — what the system does, required for every entry
Foundation model — free text (e.g. "GPT-4o", "in-house fine-tune"), not a fixed list
Model / API provider — links to your existing TPRM vendor register, not a second vendor list
Data classification — the same CUI/PHI/PII/confidential/internal/public scale used everywhere else in CMDash
Human oversight — human-in-the-loop, human-on-the-loop, or autonomous (self-declared, never computed)
Training data source, and free-form notes

Model / vendor register

Readiness tracking

A prioritized gap list for each framework, using the same rule engine every framework in CMDash runs on:

Unmapped controls — never assessed at all
Missing evidence — marked implemented with nothing on file
Stale evidence — past the tenant's own freshness window
Continuous-control-monitoring drift, for any control wired to a CCM rule

Where this pack stops

Published on purpose — a buyer who finds a limit after signing is a support ticket, not a sale.

The AI inventory is what your people register. CMDash does not discover AI systems on your network, in your SaaS estate, or in your code — shadow AI stays invisible until a human enters it, and closing that gap is exactly what the AI-governance specialists sell.

No model-level technical testing. CMDash runs no bias, robustness, drift or performance evaluation of a model. Those results are evidence you attach from somewhere else, never evidence the product produces.

EU AI Act coverage is the shipped framework and regulatory-radar content — obligation dates mapped onto ISO 42001 and NIST AI RMF controls. It is not a staffed regulatory-research desk reinterpreting the Act for you as guidance lands.

Framework coverage here is ISO/IEC 42001 and NIST AI RMF. Specialist AI-governance platforms map ten or more AI regimes; CMDash maps two, and crosswalks them into the ISMS you already run.

AI governance is a pack on a general GRC platform, not a dedicated AI-governance product. In a market moving this fast it will trail the specialists on AI-specific depth — the trade is that everything else in your programme is already here.

ISO 42001 Annex A control text is licensed by ISO and is not reproduced anywhere in CMDash — you need your own copy of the standard to work from.

Readiness is a rule-based gap list, not an AI-specific automated scanner — there is no mainstream integration category that reads an AI system for its own posture the way there is for identity or vulnerability scanning.

CMDash is not a certification body. Certification against ISO/IEC 42001 is issued by an accredited body after an audit; there is no such thing as being "AI RMF certified" at all — it is a voluntary framework.