AI governance that produces remediation. Referee inventories your AI systems, tiers their risk, maps the controls — and sends the gaps out as fixes, not register entries.
Every AI system is registered: what it does, the data it touches, who owns it.
Each system is tiered against the TAI-01..TAI-10 starter crosswalk — high, minimal, or flagged unacceptable — with the reasoning shown.
Controls are mapped once; gaps leave as remediation — fix diffs through Setright — not as another quarter's heat map.
Tiers, control maps, and evidence flow to Dossier. A named risk owner approves every tier; GRC approves every external answer.
Three sample systems go through inventory and tiering — the lite flow that runs today.
Tier: HIGH — remediation required
Customer PII plus write tools. Controls mapped; the gaps leave as fixes.
Tier: MINIMAL — controls in place
Spec-bound repo write with human-gated merges. Mapped and monitored.
Tier: UNACCEPTABLE — flagged
Vendor payments with no human gate. Flagged for the risk owner before it runs.
Controls mapped — TAI-01..TAI-10 starter crosswalk — EU AI Act / NIST AI RMF / ISO 42001 / SOC 2
Remediation dispatched — the HIGH tier's gaps leave as Setright fix diffs — governance that produces remediation
Evidence filed — tiers and control maps land in Dossier; the risk owner approves every tier
Per AI system