Your team is already using AI. But who is governing it? GOVERNBOX.ai walks you through the first hour, then keeps the program running: the policy, the list of tools, the risks, the training, and the report your board reads.
Written in plain language, because the people who have to read it are directors, not data scientists.
No consultant. No bare template. No copied policy. And no need for a $100K system.
Watch the real product at work: the inventory of AI tools, a cited policy, the risk register, and the quarterly board report that comes out the other end. No sign-up, no sales call.
Your sector, your size, the kinds of data you hold. No technical questions.
It comes back written, with a note on each clause showing where it came from.
Each tool gets an ID, an owner, and a date to look at it again.
Staff read a short training, then sign. You can see who hasn't.
Nine things happen after the policy is signed. They all happen here, and they all feed the same quarterly report.
One record per tool, with an owner and a review date.
How likely, how bad, who owns it, what you're doing about it.
Seven short sections per system, guided the whole way.
Per-person completion, tied to the version they read.
A logged incident, a severity, and a flag if it has to be reported.
What it can reach, what it can do, and whether it's been tested.
Line by line, the answer to “where do you address this?”
A score, the history, and what changed since last time.
A live public trust page and a badge for funders and members.
Your board is asking about AI. The tools that could help were built for someone else — too big on one side, too thin on the other.
Accountable to a board or funder. No AI risk team. No six-figure software budget. Handed AI governance on top of your real job.
$0, and it shows. Generic documents with no guidance, no workflow, and no way to prove compliance when an auditor or funder asks.
$100K–$500K/yr. Credo AI, IBM, OneTrust — built for Fortune 500 ML teams, with multi-month implementations to match.
A guided, sector-aware workflow that produces board-ready governance — where every clause traces to a real control.
Risk, IT, data and privacy each have their own module here — and AI sits in the middle of all four, because that is where it actually shows up in your organization.
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from ProOne register, six plain categories, named owners.
Every tool, asset and admin account, with a renewal date.
What you hold, where it flows, how long you keep it.
AI runs through all four — so it’s the foundation, not a fifth box.
AI runs through all four below — it’s the foundation, not a fifth box.
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from ProOne register, six plain categories, named owners.
Every tool, asset and admin account, with a renewal date.
What you hold, where it flows, how long you keep it.
Every plan is built on AI Governance. You switch on the management modules — Risk, IT, Data — as you need them, and Privacy comes with Pro and above (CCPA from Pro; GDPR and HIPAA on Agency). Price your configuration →
Customer questionnaires, insurers, and contracts that now ask about AI. →
Board and funder pressure, a small team, and 20% off. →
Public records, council questions, and decisions that affect residents. →
A state AI law is coming into force. Here's what it asks of you. →
AI risk in the same language as the rest of your register. →
Tools nobody told you about, and agents with real access. →
What you hold, where it flows, and how long you keep it. →
The privacy duties AI stretched, and the crosswalk for each. →
Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.
Gradient Descent LLC is an independent company. GOVERNBOX.ai is not affiliated with, endorsed by, or produced on behalf of any government agency.
The free AI Readiness Scorecard tells you where you stand and what to fix first. Nothing to install, nobody to call.
Take the free scorecard →Grounded in NIST AI RMF · ISO/IEC 42001 · ISO/IEC 42005 · EU AI Act · HIPAA · GDPR · CCPA · Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · United States — federal law & state landscape · Canada · AI frameworks, standards & healthcare guidelines · Europe — EU regulation, UK, Switzerland, Norway · Global — Americas, Middle East, Asia-Pacific & international. A defensible starting point that you review and approve, not legal advice.