Do we need a consultant or special training to use it?

No. It is written for the person who was handed AI governance without specialist training. Every step is in plain language, and every policy clause shows the control it came from.

Do we have to connect any systems?

No. Nothing has to be connected to start. The browser extension and the imports are optional, and you add them when you want a live inventory.

Do our teams have to change how they work?

No. Staff keep their tools. GOVERNBOX records which tools are in use and gives staff a plain-language acceptable-use standard.

Is this legal advice?

No. GOVERNBOX gives you a cited, reviewable draft. A person in your organization approves every document before it is used.

Do I have to talk to sales?

No. Every price is on this page and you can check out online. If you need a custom setup, such as extra workspaces or procurement paperwork, the Agency / Enterprise card has a door for that too.

Is it priced per user?

No. You pay per organization. Starter includes 10 admin seats, Pro 15 and Agency / Enterprise 20, and staff who report tools, sign policies and complete training never need a seat.

By card or U.S. bank account (ACH) through Stripe, or by invoice with your purchase order number. Nonprofits enter NONPROFIT20 at checkout for 20% off every plan.

Starter can be billed monthly. Pro and Agency / Enterprise are billed once a year.

Yes. Cancel any time in your organization's billing settings. Your plan stays active to the end of the period you paid for, and fees are not refunded except where the law requires it or we agree in writing.

Is our organization's data kept separate?

Yes. Each organization's records are walled off from every other organization's in the database itself, and changes are written to an audit log that cannot be edited.

The original and comprehensive AI governance and management system of record™

Prove who owns every AI tool — and what happens when one fails.

Name: GOVERNBOX.ai
Brand: GOVERNBOX.ai
Price: 3500 USD
Availability: InStock

For the compliance, risk or IT leader handed AI governance

Mitigate your AI risks: identify your Shadow AI, manage your AI agents, and do it all in an audit-ready AI Governance System of Record connecting organizational policy to AI inventory.

Auditors don’t stop at “is there a policy?” They ask who owns each system, what data it uses, how it was tested, how it’s monitored, and what the plan is when it breaks. GOVERNBOX keeps all five answers in one place, each one cited to a control.

See plans ↓See it work ↓Not ready? Take the free scorecard →

Creating an account takes a work email and no card. Every plan bills by card or U.S. bank account (ACH) through Stripe, and you can cancel any time; your plan runs to the end of the period you paid for. Billing terms

✓ Plans from $3,500 (≈ £2,590) a year✓ 20% nonprofit discount

app.governbox.ai/use-casesEXAMPLE DATA

AI Use Case InventoryRiverbend Community Health (example)

8

AI uses logged

8 / 8

With a named owner

1

High-risk

ID	AI use	Owner	Vendor	Data	Tier	Status	Review
UC-001	Patient intake chatbot	M. Ortiz	Chat platform	Health	Limited	Active	Jan 2027
UC-002	Grant-writing assistant	D. Park	Office suite	Internal	Minimal	Active	Mar 2027
UC-003	Résumé screening	HR Director	HR platform	Personal	High	Under review	Nov 2026
UC-004	Meeting transcription	COO	Transcription app	Confidential	Limited	Under review	Dec 2026
UC-005	Donor email drafting	Development	AI assistant	Personal	Minimal	Active	Feb 2027
UC-006	Eligibility pre-screen	Programs	In-house	Health	Limited	Draft	—
UC-007	Invoice coding	Finance	Accounting suite	Financial	Minimal	Active	Apr 2027
UC-008	Personal chatbot accounts	IT Director	Consumer AI apps	Unknown	Shadow AI	Under review	Oct 2026

Example data · a fictional organizationProhibited-use screen passed for all 8

Crosswalks to the frameworks your board, funders and auditors ask about

NIST AI RMFAI Risk Management FrameworkStarter+

ISO/IEC 42001AI management systemsStarter+

SOC 2 TSCTrust Services Criteria mappingPro+

EU AI ActRegulation (EU) 2024/1689Agency / Enterprise

GDPREU data protectionAgency / Enterprise

HIPAASecurity & Privacy RulesAgency / Enterprise

CCPACalifornia consumer privacyPro+

Current U.S. State Laws ▾43 state lawsStarter+

NAIC AI Model BulletinInsurers' use of AI systemsPro+

Encrypted in transit & at restNo training on your contentNo consultant or special training required

See it work

From the auditor’s question to your first answer

Hover to pause. Use the tabs, the arrows or your keyboard to move between slides.

What an auditor actually checks

Five questions. One system of record.

1

Who owns each AI system?

The Use Case Log and vendor registry give every AI use a named owner, a risk tier and a review date. Shadow AI Discovery finds the tools staff use that nobody logged, before an auditor or a board member asks about them.

2

What data does it use?

Data sensitivity on every use case, plus a data inventory. Impact assessments cover privacy and people's rights in plain language.

3

How was it tested?

Seven-section impact assessments, with every mitigation recorded straight into the Risk Register.

4

How is it monitored?

Review dates and notifications keep it current. On Pro, the Control Evidence Ledger grades each control from your own records.

5

What happens when it fails?

The Incident Log records severity and status, and feeds the quarterly Board Report.

Every clause cites a real control

1584 authored controls. The AI tailors them to you and never invents one.

Your first three minutes

One quick win before you set anything up

Nothing to install and nothing to connect. Tick the steps to see how the setup guide keeps track.

🔒 You only connect a live system when you choose to, and each connection says exactly what it reads.

Quick setup25% complete

Try it before you sign up

Four clicks from “nobody owns this” to a board-ready answer

Example screens from a fictional organization. Click each step — no email needed.

app.governbox.aiEXAMPLE DATA

Shadow AI Discovery · last 30 days

Tool	Devices	Policy status
General chat assistant	41	Conditional
Office suite assistant	63	Approved
Meeting transcriber	9	Unreviewed
AI companion app	2	Prohibited

Daily counts per tool only. Never the pages staff visit or what they type.

● Playing

Do this with your own organization →

What the law asks of you, and what does the work

From obligation to evidence

What you’re worried aboutWhat GOVERNBOX doesWhat you can prove

“We don't know which of our AI uses are high-risk.”Use Case Log with a prohibited-use screen and plain-language risk tieringA dated inventory with an owner and a tier for each use

“We've never done an impact assessment.”Guided impact assessment in seven sectionsCompleted assessments, with mitigations in the Risk Register

“What do we have to tell the people affected?”Notices and decision records with the 30-day explanation clockA record of every notice and every adverse-outcome explanation

“Our AI evidence lives in spreadsheets.”Use Case Log with Import Excel / CSV for the spreadsheet you already haveOne dated inventory instead of a folder of spreadsheets

“The board will ask whether we're compliant.”Compliance crosswalks and the Board ReportCoverage by requirement, quarter over quarter

Published pricing. No sales call to learn a number.

Less than the cost of one week of consulting gets you the whole year

One flat price for your whole organization, never per seat. Nonprofits take 20% off every plan.

Starter

For the org standing up its first AI governance program

$3,500/yr

≈ £2,590

billed annually, or $339 (≈ £251)/mo billed monthly

🏛️ Nonprofit: $2,800 (≈ £2,070)/yr

AI Governance plus one management module — a real program in place.

✓ Frameworks and laws: NIST AI RMF · ISO/IEC 42001 · United Kingdom AI law & guidance · Canada
✓ Grounded policy generation — every clause cites a control
✓ Risk register, impact assessments, incident log
✓ Privacy program, privacy impact assessments and a Privacy Policy
✓ Vendor and AI System registries — approval status, terms on file
✓ Shadow AI Discovery
✓ Approval gate for use cases; staff AI-tool reporting link
✓ Cost tracking with 60-day renewal alerts
✓ Board report, governance badge, Trust Page
✓ Unlimited staff participants and attestations
✓ AI Training & Certification — all 7 AI Leadership Course credentials
✓ REST API (read)
✓ Pay by card or ACH bank transfer
✓ 10 admin seats

Subscribe to Starter →

ProMost popular

For growing programs with privacy obligations

$12,000/yr

≈ £8,870

billed annually — equates to $1,000 (≈ £739) per month

🏛️ Nonprofit: $9,600 (≈ £7,100)/yr

✓ Everything in Starter, plus:
✓ ISO/IEC 42005
✓ AI frameworks, standards & healthcare guidelines
✓ EU AI Act
✓ European Union AI law & guidance
✓ Italy AI law & guidance
✓ GDPR
✓ Global privacy laws
✓ Switzerland AI law & guidance
✓ Norway AI law & guidance
✓ NIST SP 800-53 Rev. 5
✓ NIST Cybersecurity Framework (CSF) 2.0
✓ Risk heat map
✓ Assessments auto-populate the risk register
✓ AI Strategic Plan and CAIO wizards
✓ GDPR privacy paperwork — processor agreements, notices and consent, privacy requests
✓ Branded document exports
✓ Shadow AI Discovery+
✓ Vendor questionnaires answered through a private vendor portal
✓ REST API (read + write) and signed outbound webhooks
✓ AI Agent Analysis
✓ Pay by card or ACH bank transfer
✓ 15 admin seats

Subscribe to Pro →

Agency / Enterprise

For public agencies and regulated organizations

$25,000/yr

≈ £18,480

starting at, billed annually — always all four core modules + full Privacy

🏛️ Nonprofit: $20,000 (≈ £14,780)/yr

Buy the plan online, or get a written quote for a custom setup.

✓ Everything in Pro, plus:
✓ Every U.S. state law, added as they pass
✓ United States — federal law & state landscape
✓ CCPA
✓ U.S. state privacy laws
✓ SOC 2 (Trust Services Criteria)
✓ New York DFS cybersecurity regulation (23 NYCRR 500)
✓ NAIC AI model bulletin (insurance)
✓ NAIC Insurance Data Security Model Law (#668)
✓ HIPAA
✓ Global — Americas, Middle East, Asia-Pacific, Central Asia & international
✓ OMB M-25-21 / M-25-22 compliance pack
✓ Zero-trust agent checklist and scoring
✓ White-labeled Trust Page & badge, and Enterprise SSO
✓ Priority support and an advisory session
✓ Pay by card or ACH bank transfer
✓ 20 admin seats

Subscribe to Agency / Enterprise →Need a custom setup? Starting at $25,000/yr — talk to us →

Every plan includes AI Governance, multi-tenant security and an append-only audit log. Nonprofits save 20% on every plan: enter NONPROFIT20 at checkout. Not legal advice.

Creating an account takes a work email and no card. Every plan bills by card or U.S. bank account (ACH) through Stripe, and you can cancel any time; your plan runs to the end of the period you paid for. Billing terms →

Billed in US dollars. £ figures are approximate, at exchange rates from 4 September 2026.

Want someone alongside you? GOVERNBOX.ai Advisory Services → publishes a fee for every engagement — working sessions, half-day module training, a guided program launch — so you never need a call to learn a number.

Comparing tools? See GOVERNBOX vs OneTrust and GOVERNBOX vs Credo AI, side by side.

About the founder

Jim TunnessenFounder & CEO, GOVERNBOX.ai

Former 2× Federal CIO / CAIO / CTO / CPO

Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.

Before you start

Questions people ask first

It stores the governance records you create, encrypted in transit and at rest. It does not collect what your staff type into AI tools, and your content is never used to train or fine-tune a model.

Where should I start?

Your first hour

The shortest path from an empty account to something you could put in front of a board. It’s the same eleven steps the in-app Field Guide walks you through.

Steps 1–3

Get your baseline

1
Take the AI Governance scorecard
Fifteen questions. It gives you a baseline and, honestly, tells you which module you need.
2
Fill in the Organization Profile
Paste your website and let it propose the answers, then correct them. Set your country — your region’s own law comes with your entry tier. Select your frameworks, or your jurisdiction, which selects them as a set.
3
Open your Compliance Roadmap
Your scorecard gaps are already sequenced into dated actions. Tick milestone one and they land on your board with due dates — and therefore on your calendar and in your notifications.

Steps 4–5

Find your AI

4
Log five use cases — or import the lot
The five AI tools you already know about. Owner and department are the fields that matter most. If you already have a spreadsheet, use Import Excel / CSV instead.
5
Turn on the staff intake portal and send the link
This is how you find the other fifteen. No seats required.

Steps 6–9

Write it and prove it

6
Generate the AI Use Policy
Walk the wizard. Read every section. Approve the ones you agree with — approval is what makes them count downstream.
Paid plan
7
Run coverage on it
See the gaps, accept the drafted inserts you want, and waive the rest with a reason. Waived gaps are tracked as a risk for their framework, which is the honest outcome.
Paid plan
8
Open the crosswalk for your jurisdiction
This is the coverage number you will be asked about.
Paid plan
9
Launch an attestation campaign on the approved policy
Everyone signs by link. Completion rate becomes board evidence and appears on your Trust Page.
Paid plan

Steps 10–11

Report and automate

10
Open the Board Report and export it
Everything above is already in it. Nothing was entered twice.
11
Turn on the weekly digest and, if you use Slack, the channel
The last step is making sure you do not have to remember any of this. Both live on the Organization Profile.

Pick a plan ↑Not ready? Take the free scorecard →

Steps marked “Paid plan” need a plan: writing and approving policies, the crosswalks and attestations unlock when you pick one.

Grounded in NIST AI RMF · ISO/IEC 42001 · ISO/IEC 42005 · EU AI Act · HIPAA · GDPR · CCPA · SOC 2 (Trust Services Criteria) · NIST SP 800-53 Rev. 5 · NIST Cybersecurity Framework (CSF) 2.0 · U.S. state privacy laws · Global privacy laws · New York DFS cybersecurity regulation (23 NYCRR 500) · NAIC Insurance Data Security Model Law (#668) · NAIC AI model bulletin (insurance) · Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws · United States — federal law & state landscape · Canada · AI frameworks, standards & healthcare guidelines · Europe — EU regulation, Italy, UK, Switzerland, Norway · Global — Americas, Middle East, Asia-Pacific, Central Asia & international. A defensible starting point that you review and approve, not legal advice.