AI

Acuna AI Governance

Preview — ISO/IEC 42001 and the EU AI Act in one module

Acuna AI Governance gives you a single register of every AI system your organization builds or buys, and the management system around it that ISO/IEC 42001 and the EU AI Act demand, from first pilot to retirement. Record each system's provider, purpose, autonomy level and the people it affects, classify it under the EU AI Act, run structured impact assessments, assign human oversight, and log incidents. Nothing reaches Approved for use without an approved impact assessment behind it. The module is in preview and not yet generally available; the capabilities below describe the build now in validation.

Capabilities

What Acuna AI Governance does.

AI System Register

One inventory of every AI system, in-house or from a vendor, with lifecycle stage, autonomy level, affected parties, risk tier, and EU AI Act classification: role, risk class, Annex III use case, and the rationale behind each. The audit question is always "on what basis?", so the rationale is a field, not a footnote.

Governed Lifecycle with Gated Approval

Every system moves through Draft, In assessment, Approved for use, Restricted use, and Withdrawn. Approval is gated on a completed impact assessment, and every transition is dated and kept. Nothing reaches Approved for use without an approved assessment behind it.

AI Impact Assessments

A structured, guided assessment of the harm a system can do to the people it affects. Approved assessments are frozen for the record; reassessments supersede them rather than overwrite them, so you always know what was approved, when, and on what evidence.

Human Oversight Register

Name who supervises each system and what authority they actually hold, including the power to override a decision or suspend the system. Acuna flags any system in production with nobody empowered to stop it.

Supplier Data Provenance

For vendor-supplied AI, link the supplier's assurance evidence directly from Acuna's third-party risk module and see at a glance whether it is current, stale, or missing. No separate vendor questionnaire cycle just for AI.

AI Incident Register

Log malfunctions, unexpected behaviour, and harm events against the system that caused them, building the incident history both ISO/IEC 42001 and the EU AI Act expect.

Built Into the GRC Program, Not Beside It

AI systems connect to the assets they run on, the business processes they support, the processing activities they touch in the Privacy module, and the risks, issues, and controls in your existing registers. Both framework trees ship in Acuna's catalog: ISO/IEC 42001 with its full set of management clauses and Annex A controls, and the EU AI Act at article level.

Related panes

complyoperateassure

FAQ

Common questions about Acuna AI Governance.

Is the AI Governance module available today?

Not yet. The module is in preview and running in staging while the register, assessment, and oversight records are validated. This page describes the build now in test. Contact us to see it and to be told when general availability lands.

What is AI governance software?

Software that inventories the AI systems an organisation builds or buys, classifies them by risk, records the assessments and oversight behind each one, and keeps the evidence a regulator or auditor will ask for. It is the operational layer under standards like ISO/IEC 42001 and laws like the EU AI Act.

Does Acuna cover both ISO/IEC 42001 and the EU AI Act?

Yes, as separate framework trees in the same catalog. ISO/IEC 42001 ships with its full set of management clauses and Annex A controls; the EU AI Act ships at article level. A control mapped once counts against both, and against the other frameworks you already run.

What goes in an AI system register?

Each system's provider, purpose, autonomy level, lifecycle stage, and the people it affects, plus its EU AI Act classification: role, risk class, Annex III use case where one applies, and the rationale for each. Vendor-supplied systems also carry a link to the supplier's assurance evidence.

Is Acuna for AI providers or AI deployers?

Deployer-first. It is built for organisations that buy and run AI systems in decisions affecting people, such as hiring, credit, customer service, safety, and operations, and is designed to grow with providers who build them.

Do I need this if I already run ISO 27001 in Acuna?

Most of the groundwork carries over: asset inventories, access control, change management, supplier oversight, and incident response all apply to AI systems too. This module adds what those do not cover, namely the AI-specific register, impact assessment, and human oversight records that ISO/IEC 42001 and the EU AI Act ask for.

See Acuna AI Governance in action.

Get access and our team will walk you through Acuna AI Governance and the full Acuna platform.

Get a demo