Govern AI like everything else you govern.
Find every AI tool your people sign in to and every agent your teams build. See what each one can reach, assess it against the NIST AI RMF, ISO 42001, and the EU AI Act, and keep its evidence current in the same inventory as everything else.
TruOps puts AI in the same inventory as your apps and vendors. Connect Okta or Entra and TruPilot lists the AI tools people sign in to, including ones nobody approved. Agents built on your own platforms show up with the data and systems they can reach. Assess any of them against the NIST AI RMF, ISO/IEC 42001, or the EU AI Act with answers pre-filled from your evidence, reuse the controls you already run for ISO 27001 or SOC 2, and track AI risks in the same register. A person approves every decision.
The problem
AI shows up faster than anyone can list it. People sign up for AI tools with their work accounts, teams build agents that act on their own, and vendors add AI to products you already approved. The answer to what AI you use, and what it can touch, ends up in a spreadsheet nobody keeps current.
The challenge
Treat each AI system like anything else you assess: an inventory, owners, NIST AI RMF or ISO 42001, and risks on the same register. Keep your model risk and responsible AI tools for model validation.
- You have an AI policy but no inventory of AI systems.
- Everyone assumes ISO 27001 controls cover 42001, and nobody has mapped them.
- Vendor AI features arrive covered by a SOC 2 report that never mentions them.
What you're probably using today
AI governance often starts in slides, a new point tool, or a copy of the ISO 27001 spreadsheet.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| A consultant-built binder | The program was accurate the week the engagement ended. After the next surveillance audit, new framework, or acquisition, it's out of date. | Your binder becomes a working program, with recurring assessments that pre-fill, controls checked from your tools, and findings that keep an owner. |
| Point tools that don't connect | A TPRM portal here, a risk register there, findings in your ticketing tool, and the board pack in slides. Each tells its own story, so leadership gets three different answers. | One place for assessments, evidence, and risk. Upload a document, answer a question, or check a control once, and it counts everywhere it applies. |
How it works in TruOps
- FindTruPilot lists the AI tools people sign in to through Okta or Entra, and the agents built on your own platforms. Nothing to set up and no owners to assign first.
- TieEach one is tied to the data, apps, and vendors it can reach, so you see which agents touch customer data or production.
- AssessRun NIST AI RMF, ISO 42001, or EU AI Act assessments pre-filled from your evidence. AI vendors answer only what their documents leave open.
- ReuseControls you already run for ISO 27001 or SOC 2, such as access control, count toward the AI frameworks too.
- WatchAccess, keys, and approvals are checked on a schedule. New AI tools and over-permissioned agents become findings with a recommended fix.
What you end up with
- Every AI tool and agent in one inventory, approved or not.
- What each one can reach, and who is responsible for it.
- AI risks in the same register as everything else.
- Evidence ready when a customer or an auditor asks about your AI.
How TruOps helps
- AI tool discovery
- From Okta and Entra sign-ins, including tools nobody approved.
- Agent access checks
- What each agent can do, next to what it uses.
- AI frameworks
- NIST AI RMF, ISO/IEC 42001, the EU AI Act, or your own AI policy.
- AI vendor reviews
- Read the vendor’s documents first, then ask only what is left.
Questions
Which AI frameworks does TruOps support?
The NIST AI RMF, ISO/IEC 42001, and the EU AI Act, plus your own AI policy as a custom framework.
How does TruOps find AI tools nobody approved?
Connect Okta or Entra. TruOps reads which apps people sign in to and which apps they have granted access, matches them against known AI services, and lists each one with how many people use it and what it can reach.
Do we have to assign an owner to every AI tool first?
No. AI tools land in the inventory as a list. TruPilot suggests owners when your connected tools know them, and you add them as you go.
Can we govern AI agents we build ourselves?
Yes. Agents built on platforms such as Amazon Bedrock or Azure OpenAI show up with the service accounts and keys they use, so you can see what each one can reach and whether it needs that access.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Related
Everything you govern and how it connects, with compliance and residual risk in dollars on each item.
→FrameworksNIST AI RMFGovern, Map, Measure, Manage for AI risk.
→FrameworksISO/IEC 42001The certifiable AI management system standard.
→LearnWhat is AI GRC?When AI does the work of governance, risk, and compliance.
→LearnHuman-in-the-loop AI in GRCWhy AI should draft and people should decide.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.