AIGovQ: AI governance your board can price

The gap

AI use has outrun AI governance

88%of organisations use AI in at least one business function

63%of breached organisations had no AI governance policy, or were still writing one

$670Kextra cost per breach where shadow AI use was high

Sources: McKinsey, The state of AI in 2025; IBM, Cost of a Data Breach Report 2025.

How it works

Five steps from inventory to board-ready dollars

Each step leaves a record that the next step, the board and your regulator can use.

Step 1
Register
Every AI system, built, bought, embedded in SaaS or adopted by staff, with an owner. A short intake before anything new.
Step 2
Classify
EU AI Act tier and internal risk level, with the reasons and dated obligations.
Step 3
Price
Estimated exposure in dollars through ValuRisQ: residual risk, data theft and interruption.
Step 4
Control
Lifecycle gates, committee decisions, signed policies, ISO/IEC 42001 and NIST AI RMF controls.
Step 5
Monitor and report
Monitoring checks, incidents, regulator notice deadlines and a quarterly board pack.

AIGovQ dashboard for the Northwind demo: 8 AI systems, 5 deployed, 1 intake blocked for Legal review, 2 classified high-risk, 77.5% acceptable-use acknowledgment, 29 of 38 ISO/IEC 42001 Annex A controls met, next committee meeting and 90-day plan progress

Product tour

See the product, not a mock-up

Every screen below is the real application, running the fictional Northwind Insurance demo organisation.

AI register · Intake

Find every AI system, and stop problems at the door

One list for models you build, AI you buy, AI inside SaaS tools and tools staff adopt on their own.

Owner, unit, source, decision role, people affected and status for each system
Filters for high-risk, prohibited, unclassified and out-of-date entries
CSV import and export to bring in your existing list
A short intake before anything new; possible prohibited practices go to Legal automatically

AI register listing Northwind's AI systems with owner, unit, source, risk level, EU AI Act tier, decision role, status and FATES score

Intake list showing call-centre voice emotion analytics flagged as a possible prohibited practice under Art. 5 and blocked for Legal review

Classification · ValuRisQ

Classified with reasons, priced in dollars

Each system gets an EU AI Act tier and an internal risk level, with the reasons and obligations. Connected to ValuRisQ, it shows the exposure a board can weigh against a budget.

Impact, likelihood, inherent and residual risk against your threshold
Data-theft and interruption exposure through the systems it touches
AI laws that apply, with indicative statutory ceilings and start dates
The answers that would lower the residual most

Risk in ValuRisQ panel: impact 0.50, likelihood 0.50, residual 0.04 within threshold, data theft reachable $192,000,000, interruption $1,680,000, EU AI Act high-risk from 2 December 2027, and the questions that would lower the residual most

Lifecycle gates · Committee

Nothing high-risk goes live without evidence and approval

Five gates from problem definition to monitoring. A high-risk system cannot be set to Deployed until gates 1 to 4 have their evidence and the committee has approved.

Required evidence per gate, linked to where the document lives
Committee approvals and time-limited exceptions, recorded once
Agendas built from open intakes, gate gaps and incidents

Lifecycle gates panel listing required evidence for each gate with links, and committee decisions

Policies · Frameworks

Policies people sign, controls auditors can follow

Approvers sign with their typed name, staff acknowledge the acceptable-use policy without an account, and every ISO/IEC 42001 and NIST AI RMF control has a status, owner and evidence.

Starter templates for the AI policy, principles and acceptable use
Acknowledgment tracking by department, with reminders
A versioned Statement of Applicability; published policies count as evidence

Policies page: AI governance policy, AI principles and acceptable-use policy with versions, acknowledgment counts and review dates

AI frameworks page: 29 of 38 ISO/IEC 42001 Annex A controls met, NIST AI RMF progress and the Statement of Applicability

Monitoring · Incidents · Notices

When something goes wrong, the record is already there

Monitoring checks record drift, bias and accuracy over time. A breach opens an incident in one click, with an owner, timeline, root cause and any regulator notice deadline.

EU AI Act Art. 73 deadlines, with the decision recorded
A note on which US state laws were checked, and when
An evidence pack in Word for a regulator or insurer

Monitoring page: checks per AI system with thresholds, owners, last result including a breached fraud detector precision of 0.54, and next due dates

Regulator notifications section of an incident, explaining which notices apply and the US state laws checked in October 2026

Board pack · 90-day plan

What the board sees, every quarter

One Word document: register, classifications, dollar exposure, gates, AI-law obligations, incidents, policies, frameworks and the top actions. Every pack is stored and regenerates exactly as it was.

A 12-step, 90-day starter plan with owners and evidence
Maturity across 12 domains, from ad hoc to optimizing
Email alerts for incidents, concerns, notice deadlines and overdue checks

Board pack page with a generated quarterly pack ready to download as Word

90-day quick-start plan at day 61 with 7 of 12 steps done, each with owner, date and evidence

Risk classification questions for an AI system — Risk classification

FATES risk questionnaire with scores for fairness, accountability, transparency, ethics and safety — FATES questionnaire

AI governance committee page with members, cadence and meetings — Governance committee

Staff concerns and public reports page with the staff link and the public reporting link — Staff and public concerns

Who it’s for

Built for the people who answer for AI

CISO and CRO

See every AI system, including vendor and staff tools. Put AI exposure in dollars beside cyber risk. Know who owns what, with an audit trail.

Insurers and financial services

Classify underwriting, claims and hiring models for the EU AI Act. Gate them before go-live. Keep the written AI programme state insurance regulators ask for.

General Counsel and compliance

Signed policies, minuted decisions, ISO/IEC 42001 readiness with a Statement of Applicability, incident notices and evidence packs in Word.

What’s included

One application, from intake to board pack

AI registerCSV import and export, owners, decision roles

Intake and triagePossible prohibited practices blocked for Legal

Risk classificationEU AI Act tiers with reasons and obligations

FATES questionnaireFairness, accountability, transparency, ethics, safety

Bias and drift metricsCalculated in your browser from a CSV

Lifecycle gatesEvidence and committee approval before go-live

Policies and sign-offTyped-name approvals, staff acknowledgments

Roles, RACI, committeeAgendas built from live data, decisions minuted

FrameworksISO/IEC 42001 and NIST AI RMF, with evidence

Monitoring and incidentsBreaches open incidents; notice deadlines tracked

Staff and public concernsAnonymous reporting links, with email alerts

Board and evidence packsWord documents, stored and reproducible

Regulation

The dates are fixed. The evidence has to exist.

EU AI Act dates as amended by Regulation (EU) 2026/1744, checked October 2026.

Applies from	Obligation
2 Feb 2025	Prohibited practices
2 Aug 2025	General-purpose AI models
2 Aug 2026	Transparency duties (Art. 50)
2 Dec 2027	High-risk systems: insurance pricing, hiring, credit
2 Aug 2028	High-risk systems under product-safety law

Serious incidents

For high-risk systems used in the EU, AIGovQ shows the Art. 73 deadline (15, 10 or 2 days) and records your decision.

Insurance regulators

27 states and D.C. have adopted the NAIC AI Model Bulletin, which expects a written AI programme with controls and vendor oversight.

US state laws

Checked against primary sources. Colorado’s consumer-notice rules for automated decisions apply from 1 January 2027.

Security

Built for the data you govern

What is in place today, stated plainly. The full security FAQ and data processing agreement are available on request.

Password plus authenticator app for every user, with lockout on repeated failures
Each organisation’s data isolated by forced row-level security in the database
Full audit log; evidence, approvals and signatures are append-only
Hosted in the United States: Vercel and Neon Postgres on AWS US East
Whole-application security review, with every high and medium finding fixed
Optional AI evidence review only; a person always decides, and admins can turn it off
Not yet held: SOC 2, ISO/IEC 27001, third-party penetration test

FAQ

Common questions

How does AIGovQ show risk in dollars?

Through ValuRisQ. You link each AI system to the systems, processes or vendors it touches, and AIGovQ shows a residual risk score and data-theft and interruption exposure in dollars. The figures are estimates for setting priorities. Without ValuRisQ, everything else works and no dollar figures are shown.

Will it make us compliant or certified?

No product can. AIGovQ is decision support: every rule shows its source and the date it was checked, and your counsel decides. It supports readiness for ISO/IEC 42001 and the NIST AI RMF; certification is done by an accredited body.

Can it stop a risky system going live?

Yes. A high-risk system cannot be set to Deployed until the evidence for gates 1 to 4 is in place and the committee has approved gate 4, or granted a time-limited exception.

Does it connect to our ML platform?

Not yet. Monitoring results are entered or uploaded, and bias and drift metrics can be calculated in your browser from a CSV that never leaves your computer.

How do we get started?

Import your AI inventory by CSV, invite your team and follow the built-in 90-day plan. Starter templates cover the AI governance policy, principles and acceptable-use policy.

How much does it cost?

Pricing depends on your number of AI systems and users. Contact us for a proposal.

Whitepaper

Pricing AI Risk

From an AI inventory to board-ready dollars: what regulators expect now, why boards need dollars, five steps, a worked example, a 90-day plan and a board checklist.

Request your copy

Email us with “Whitepaper” in the subject and we’ll send the PDF.

Request the whitepaper

ariel@evansipholdings.com

AI governance your board can price.

Underwriting Risk Scorer