AI Governance

What it is

Three related surfaces cover how CMDash handles artificial intelligence — both the AI you run inside your own organization, and the AI CMDash runs on your behalf.

AI Governance (/ai-governance, under Compliance) is a system-of-record for the AI your organization builds or buys: an AI-asset inventory and model/vendor register, plus a readiness view against two frameworks that ship pre-seeded in every workspace — NIST AI RMF 1.0 and ISO/IEC 42001. Each AI asset you record — a support-ticket triage model, an in-house fine-tune, a third-party API you call — carries its purpose, foundation model, data classification, human-oversight level, and criticality. If the model is provided by an outside vendor, you can link it to the same third-party vendor register TPRM already uses, rather than keeping a second list.

AI Suggestions (/ai-suggestions, under Security) asks CMDash's own AI to draft remediation recommendations for your open, highest-priority risks.

Ask (/ask, under Security — page title "Ask your posture") is a single-question assistant: ask a plain-English question about your posture, maturity, risks, exceptions, or evidence, and get an answer grounded in and cited to your organization's own records.

All three surfaces that call CMDash's AI provider draw from one shared, tenant-wide AI budget — see "Where AI usage is metered" below.

When to use it

• Building the AI-system inventory an assessor, auditor, or the EU AI Act / a customer questionnaire will eventually ask for, and tracking which of your AI systems has a human in the loop versus running autonomously.
• Checking your progress against NIST AI RMF or ISO/IEC 42001 without standing up a separate tracker — the readiness view reuses the same unmapped-control / stale-evidence / drift rule engine every other framework in CMDash uses.
• Getting a starting draft for how to close a specific open risk, when you want a second opinion before writing a remediation task yourself.
• Asking a specific, single question about your organization's own data — "what is our biggest open risk right now?", "how mature is our access control dimension?" — instead of hunting across several pages for the answer.

Before you start

Important — the AI Governance Pack is not purchasable on any plan today. It is a real, built page — the inventory, the register, and both frameworks' readiness checks all work once the add-on is attached — but the add-on itself has not shipped in the pricing catalog yet (it isn't one of the two add-ons Command and Enterprise customers can currently attach). If you reach /ai-governance and see an upgrade prompt, that is not specific to your plan: no CMDash customer can self-serve this feature yet. Ask your CMDash contact if you need it before it is generally available.

AI Suggestions and Ask do not require an add-on — only the Command tier and up. Generating suggestions is capped at 10 requests per hour per organization, and each "Generate" call produces up to 20 suggestions (5 by default).

How to

Record an AI system in the inventory

1. Open AI Governance from the Compliance section of the sidebar.
2. Click New AI asset.
3. Fill in a name and a plain-English Purpose — both required.
4. Optionally set the foundation model (e.g. "GPT-4o", "in-house fine-tune"), a model/API provider (this links to an existing TPRM vendor — it will only offer choices if you have vendors on file), criticality, data classification (CUI, PHI, PII, Confidential, Internal, Public, or None), and human oversight (Human in the loop, Human on the loop, or Autonomous).
5. Click Create AI asset. Every field here is self-declared — CMDash does not scan your infrastructure to find AI systems for you.

Check NIST AI RMF or ISO/IEC 42001 readiness

1. On the AI Governance page, scroll to Readiness. Both frameworks are already in your framework scope, so no separate setup is needed.
2. Click Assess now under either framework's card to run a fresh check, or wait for the daily background assessment.
3. Each open finding shows a severity, a kind (unmapped control, stale evidence, CCM drift, policy issue, or missing evidence), and — where relevant — the specific control ID.
4. Click Resolve once you've closed the gap, or Dismiss if it doesn't apply. There is no automated evidence-mapping for either AI framework yet (no mainstream integration category answers "AI posture" the way one exists for identity or vulnerability scanning), so every open finding here reflects what you've assessed and attached evidence to yourself, not a connected tool.

Generate and act on an AI remediation suggestion

1. Open AI Suggestions from the Security section.
2. Click Generate New Suggestions. CMDash reviews your open, highest-priority risks and drafts a rationale and an effort estimate (hours/days/weeks) for each.
3. Review the rationale under each card — it is free-text reasoning from the model, not a validated, re-checked citation the way /ask answers are. A small note under each rationale makes this distinction explicit.
4. Click Accept or Reject on each suggestion. Both choices are recorded with who decided and when, visible under History on the same page.

Ask a question about your posture

1. Open Ask from the Security section.
2. Type a specific question — the more specific, the better the citations (e.g. "How mature is our access control dimension?" rather than "How are we doing?").
3. Click Ask. The answer is grounded only in your organization's own retrieved records — never general knowledge — and every claim in the answer carries a clickable [1]-style citation chip, repeated in a Sources list underneath so you can verify it.
4. If CMDash can't produce a properly cited answer, it says so plainly rather than guessing — this is an honest refusal, not an error.

Common questions

Why does my Ask answer say "Sample answer — AI not configured"? This CMDash deployment has no AI provider key configured. The answer is still built the same way — the same retrieval, the same real citations back to your own records — but the text itself is a fixed sample rather than a live model response. This is a deployment-level state, not a bug in your question.

What is the AI budget shown next to Generate/Ask, and where else does it show up? Every AI-backed surface in CMDash — Ask, AI Suggestions, evidence-mapping proposals, policy drafting, and more — shares one tenant-wide request budget per hour, shown as a small meter (e.g. "AI budget: 940/1000 left") next to the action button on each page. It is the same live number everywhere it appears, never a per-page estimate. For a token-level breakdown (prompt tokens and output tokens, by week), go to Settings → Usage, which also tracks other metered activity like integration syncs and evidence packages generated. See docs/developers/usage-metering.md for the full metric list if you need the underlying detail.

Does my AI Governance Pack readiness percentage reflect automated scanning? No. Both AI frameworks currently rely entirely on the assessments and evidence you enter yourself — there is no automated evidence-mapping for either one today.

Can I delete an AI asset by mistake? Deleting an AI asset also deletes the underlying asset-inventory row, not just the AI-specific profile, and cannot be undone — CMDash asks you to confirm before deleting.

Related

• Evidence Collection — how automated evidence mapping works for the frameworks that do have it
• Posture Score — the five signals /ask most often cites
• Risk Register — the risks AI Suggestions drafts remediations for
• Developer reference: docs/developers/usage-metering.md