Everything the job needs, and nothing you’d never open
Every tool, arranged the way the work happens: find out where you stand, build the package, run it every quarter, then show your work. Read this page top to bottom and you’ll know exactly what you’re buying.
Find out where you stand
Ten minutes, free, and nobody calls you afterwards.
AI Readiness Scorecard
FreePlain questions about how your organization uses AI today. You get a score out of 100, your gaps ranked worst first, and a preview of how you’d map to NIST AI RMF.
Take the free scorecard →Build the package
About an hour. Every clause cites a control, and nothing leaves the building without your approval.
Your policy, and 36 more documents
AI use policy, acceptable-use standard, data management policy, committee charter, CAIO position description, OMB compliance plan, and more.
Written for directors, not data scientists. Edit anything, then approve. Export as Word or PDF with the framework version stamped on it.
A list of every AI tool you use
Each tool gets an ID, a named owner, the data it touches, and a review date.
New requests get screened before anyone signs up, so the list stays true instead of going stale the week after you build it.
Where you cover each rule
A line-by-line map from your controls to each framework you've selected.
This is the page you open when a funder or auditor asks “where do you address this?” Every row points at the document and clause that answers it.
Run it, quarter after quarter
A policy states intent. A program proves practice. These seven are the practice.
Risk register
How likely, how bad, who owns it, what you're doing about it.
Impact assessment
A guided check before you launch anything that affects people. Seven short sections per system.
Training and sign-off
Per-person completion and a dated signature tied to the version they read.
Incident log
Severity, the tool involved, and a flag if it has to be reported to a regulator.
AI agent oversight
For AI that acts on its own: what it can reach, what it may do, whether it's been tested.
Vendors and AI systems
One record per supplier, with an approval decision and the terms you hold; one record per model or tool, linked to the vendor and to every use case and agent that runs on it. A use case cannot go active behind a restricted vendor.
Projects board
The governance work itself, tracked, so last quarter's follow-ups don't vanish.
Show your work
To your board, your funders, your members, and anyone else who asks.
Quarterly board report
A maturity score, what changed, and the open items. It knows your fiscal quarters and keeps the history.
Public trust page and badge
A live page you can link from your site. Proof for funders without emailing anyone a PDF.
Cost roll-up
What your AI and technology actually costs, grouped by program office, with renewals flagged 60 days out.
API, webhooks and connectors
Scoped API keys for your own scripts (read from Starter, write on Pro), plus — on Pro — signed webhooks when a record changes and an intake connector so a Jira, ServiceNow or Zapier request lands in your triage queue, plus an MCP server so your own AI agents can read your inventory and file records into your queues. Every change made through a key is audited as that key.
The system retrieves controls. It never invents them.
500+ curated controls, spanning the eight core governance domains and every jurisdiction named below, all versioned. Framework versions are stamped on every document you export, and your approval sits on all of them.
Not sure which piece you need first?
The free scorecard takes ten minutes and tells you exactly that.
Take the free scorecard →