Enterprise AI governance platforms assume a dedicated risk team and a six-figure budget. Free templates don’t hold up to a board or a regulator. GOVERNBOX.ai is the guided, affordable, sector-aware program in between — built for nonprofits, associations, public-sector bodies, and small business.
One governance program, not a stack of tools
No consultant, no enterprise platform — a guided program built for the accidental AI owner, mapped to whichever frameworks actually apply to your organization.
AI use policy, acceptable-use standard, and more — tailored to your sector and selected frameworks, with every clause traced to a cited control, not a generic template.
Dedicated compliance crosswalks for NIST AI RMF, ISO/IEC 42001 and 42005, SOC 2 (Pro), every U.S. state AI law (Colorado's ADMT and Chatbot Safety Acts, Connecticut, Texas, California ADMT, Hawaii, Illinois), the EU AI Act, GDPR, CCPA and HIPAA — plus jurisdiction reports for U.S. National (Starter), Canada and the AI-standards pack (Pro), and Europe and Global (Agency). Each requirement is mapped to the specific policy clause (or gap) that addresses it.
A quarterly Board Report built around the five questions every board asks, plus a shareable governance badge that proves your program to funders and partners.
Track every AI system, score it by likelihood × impact, and keep an incident log ready before any framework's reporting clock starts.
Transparent pricing
Start with the free Scorecard, then choose the plan that fits. One flat price for your whole organization, never per seat.
Prices below are for the AI Governance module — the first of four GOVERNBOX modules. See modular pricing →
NONPROFIT20 at checkoutBilled in US dollars. £ figures are approximate, at exchange rates from 4 September 2026.
Agency / Enterprise includes one advisory session with the founder. Working sessions, half-day module training and a guided program launch can also be bought on their own, on any plan — see GOVERNBOX.ai Advisory Services →
| Feature | Starter | Pro Most Popular | Agency / Enterprise |
|---|---|---|---|
| Core Platform | |||
| AI Readiness Scorecard | ✓ | ✓ | ✓ |
| AI Use Case Log (inventory + named owner per system) | Unlimited | Unlimited | Unlimited |
| Grounded document generation — every clause cites a reviewed control | ✓ | ✓ | ✓ |
| EU AI Act risk tier classification + Art. 5 prohibited-use screen | — | ✓ | ✓ |
| Dashboard — My Workspace | ✓ | ✓ | ✓ |
| Notifications center (review countdowns, alerts) | ✓ | ✓ | ✓ |
| Append-only audit log | ✓ | ✓ | ✓ |
| Multi-tenant security + row-level isolation | ✓ | ✓ | ✓ |
| Document Generation | |||
| AI Use Policy | ✓ | ✓ | ✓ |
| AI Acceptable Use Standard | ✓ | ✓ | ✓ |
| AI Incident Response Plan | ✓ | ✓ | ✓ |
| Vendor AI Risk Assessment | ✓ | ✓ | ✓ |
| AI Strategic Plan (wizard) | — | ✓ | ✓ |
| CAIO Position Statement (wizard) | — | ✓ | ✓ |
| AI Committee Charter (wizard) | ✓ | ✓ | ✓ |
| Privacy Policy (consumer / data-subject rights) | NIST Privacy Framework | NIST Privacy Framework + GDPR | NIST Privacy Framework + GDPR + CCPA |
| OMB AI Compliance Plan (M-25-21 / M-25-22) | — | — | ✓ |
| Compliance Crosswalk export — five shelves: Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global | NIST AI RMF + ISO/IEC 42001 + United Kingdom AI law & guidance + Canada | + ISO/IEC 42005 + AI frameworks, standards & healthcare guidelines + EU AI Act + European Union AI law & guidance + Italy AI law & guidance + GDPR + Global privacy laws + Switzerland AI law & guidance + Norway AI law & guidance + NIST SP 800-53 Rev. 5 + NIST Cybersecurity Framework (CSF) 2.0 | + Colorado ADMT Act (SB 26-189) + Colorado Chatbot Safety (HB 26-1263) + Connecticut SB 5 (PA 26-15) + Texas TRAIGA + California ADMT Regulations + Hawaii AI Acts (247 / 248) + Alabama AI laws + Arizona AI laws + California AI laws (other statutes) + Colorado AI laws (other statutes) + Connecticut AI laws (other statutes) + Delaware AI laws + Florida AI laws + Georgia AI laws + Idaho AI laws + Illinois AI law & guidance + Indiana AI laws + Iowa AI laws + Kansas AI laws + Kentucky AI laws + Louisiana AI laws + Maine AI laws + Maryland AI laws + Minnesota AI laws + Montana AI laws + Nebraska AI laws + Nevada AI laws + New Hampshire AI laws + New Jersey AI laws + New York AI laws + North Dakota AI laws + Oklahoma AI laws + Oregon AI laws + Rhode Island AI laws + South Carolina AI laws + Tennessee AI laws + Texas AI laws (other statutes) + Utah AI laws + Vermont AI laws + Virginia AI laws + Washington AI laws + Wisconsin AI laws + Wyoming AI laws + United States — federal law & state landscape + CCPA + U.S. state privacy laws + SOC 2 (Trust Services Criteria) + New York DFS cybersecurity regulation (23 NYCRR 500) + NAIC AI model bulletin (insurance) + NAIC Insurance Data Security Model Law (#668) + HIPAA + Global — Americas, Middle East, Asia-Pacific, Central Asia & international |
| Word (.docx) export | ✓ | ✓ | ✓ |
| PDF export | ✓ | ✓ | ✓ |
| Organization logo on document exports | — | ✓ | ✓ |
| Compliance Frameworks | |||
| NIST AI RMF | ✓ | ✓ | ✓ |
| ISO/IEC 42001 | ✓ | ✓ | ✓ |
| U.S. State AI Laws — all states, added as they pass | — | — | ✓ |
| · Colorado ADMT Act (SB 26-189) — eff. January 1, 2027 | — | — | ✓ |
| · Colorado Chatbot Safety (HB 26-1263) — eff. January 1, 2027 | — | — | ✓ |
| · Connecticut SB 5 (PA 26-15) | — | — | ✓ |
| · Texas TRAIGA — eff. January 1, 2026 | — | — | ✓ |
| · California ADMT Regulations — eff. January 1, 2027 | — | — | ✓ |
| · Hawaii AI Acts (247 / 248) | — | — | ✓ |
| · Alabama AI laws | — | — | ✓ |
| · Arizona AI laws | — | — | ✓ |
| · California AI laws (other statutes) | — | — | ✓ |
| · Colorado AI laws (other statutes) | — | — | ✓ |
| · Connecticut AI laws (other statutes) | — | — | ✓ |
| · Delaware AI laws | — | — | ✓ |
| · Florida AI laws | — | — | ✓ |
| · Georgia AI laws | — | — | ✓ |
| · Idaho AI laws | — | — | ✓ |
| · Illinois AI law & guidance — eff. January 1, 2027 | — | — | ✓ |
| · Indiana AI laws | — | — | ✓ |
| · Iowa AI laws | — | — | ✓ |
| · Kansas AI laws | — | — | ✓ |
| · Kentucky AI laws | — | — | ✓ |
| · Louisiana AI laws | — | — | ✓ |
| · Maine AI laws | — | — | ✓ |
| · Maryland AI laws | — | — | ✓ |
| · Minnesota AI laws | — | — | ✓ |
| · Montana AI laws | — | — | ✓ |
| · Nebraska AI laws | — | — | ✓ |
| · Nevada AI laws | — | — | ✓ |
| · New Hampshire AI laws | — | — | ✓ |
| · New Jersey AI laws | — | — | ✓ |
| · New York AI laws | — | — | ✓ |
| · North Dakota AI laws | — | — | ✓ |
| · Oklahoma AI laws | — | — | ✓ |
| · Oregon AI laws | — | — | ✓ |
| · Rhode Island AI laws | — | — | ✓ |
| · South Carolina AI laws | — | — | ✓ |
| · Tennessee AI laws | — | — | ✓ |
| · Texas AI laws (other statutes) | — | — | ✓ |
| · Utah AI laws | — | — | ✓ |
| · Vermont AI laws | — | — | ✓ |
| · Virginia AI laws | — | — | ✓ |
| · Washington AI laws | — | — | ✓ |
| · Wisconsin AI laws | — | — | ✓ |
| · Wyoming AI laws | — | — | ✓ |
| · U.S. state law landscape — specific statutes from 27 states | — | — | ✓ |
| EU AI Act | — | ✓ | ✓ |
| ISO/IEC 42005 (AI impact assessment) | — | ✓ | ✓ |
| SOC 2 Trust Services Criteria (AI controls mapped into your SOC 2 program) | — | — | ✓ |
| NIST SP 800-53 Rev. 5 and NIST CSF 2.0 (cybersecurity, each with its own crosswalk) | — | ✓ | ✓ |
| CCPA / CPRA privacy statute (California) | — | — | ✓ |
| GDPR (EU data protection) | — | ✓ | ✓ |
| HIPAA Security & Privacy Rules | — | — | ✓ |
| OMB M-25-21 / M-25-22 (Federal AI) | — | — | ✓ |
| Regulatory Jurisdictions — enabled as one unit on the Organization Profile | |||
| United States — federal law & state landscape — 2 frameworks, enabled as one unit | — | — | ✓ |
| Canada — 1 framework, enabled as one unit | ✓ | ✓ | ✓ |
| AI frameworks, standards & healthcare guidelines — 2 frameworks, enabled as one unit | — | ✓ | ✓ |
| Europe — EU regulation, Italy, UK, Switzerland, Norway — 5 frameworks, enabled as one unit (United Kingdom AI law & guidance from Starter) | — | ✓ | ✓ |
| Global — Americas, Middle East, Asia-Pacific, Central Asia & international — 21 frameworks, enabled as one unit | — | — | ✓ |
| Risk & Impact | |||
| Risk Register (CRUD + likelihood × impact scoring) | ✓ | ✓ | ✓ |
| Risk heat map visualization | — | ✓ | ✓ |
| AI Impact Assessment (7-section questionnaire) | ✓ | ✓ | ✓ |
| Auto-create risk entries from assessments | — | ✓ | ✓ |
| AI Project Management Module | |||
| AI project list & per-project board | Up to 2 | Up to 5 | Unlimited |
| 7-phase AI development lifecycle checklist | ✓ | ✓ | ✓ |
| 45-item NIST/ISO/EU grounded task checklist | ✓ | ✓ | ✓ |
| Kanban board (drag-drop, task detail, Edit mode) | ✓ | ✓ | ✓ |
| Cross-links: Use Cases / Projects / Risk Register | ✓ | ✓ | ✓ |
| Agentic AI Governance Module | |||
| AI Agents inventory — basic registration (identity, ownership, data access) | ✓ | ✓ | ✓ |
| 12-item zero-trust controls checklist (NIST SP 800-207) | — | — | ✓ |
| Zero-trust score + low-score alerts | — | — | ✓ |
| Agent registration wizard (3-step) | ✓ | ✓ | ✓ |
| Agent metrics in Board Report governance block | ✓ | ✓ | ✓ |
| Cross-links: Agents / Use Cases / Risk Register | ✓ | ✓ | ✓ |
| Training, Incidents & Operations | |||
| Training plan + completion tracking | ✓ | ✓ | ✓ |
| Acceptable-use acknowledgment sign-off | ✓ | ✓ | ✓ |
| Incident log + severity codes | ✓ | ✓ | ✓ |
| EU AI Act Art. 73 serious-incident flag | — | ✓ | ✓ |
| Reporting & Governance | |||
| Quarterly Board Report (full — maturity score + quarterly history) | ✓ | ✓ | ✓ |
| AI Cost Tracking & Roll-Up (per use case + program office, 60-day renewal alerts, Board Report totals) | ✓ | ✓ | ✓ |
| Board Report — AI Agents governance section | ✓ | ✓ | ✓ |
| Governance maturity score + stars (dashboard/badge) | ✓ | ✓ | ✓ |
| Shareable governance badge | ✓ | ✓ | ✓ White-labeled |
| Live public Trust Page + embeddable live badge | ✓ | ✓ | ✓ White-labeled |
| Employee Attestation Portal (unlimited signers) | ✓ | ✓ | ✓ |
| Regulatory horizon feed ("What's Changing") | ✓ | ✓ | ✓ |
| Gap report with advisory CTAs | ✓ | ✓ | ✓ |
| Integrations & API | |||
| Vendor registry — approval lifecycle, terms on file, backfill from your records | ✓ | ✓ | ✓ |
| AI System registry — model, vendor, hosting, training-data notes | ✓ | ✓ | ✓ |
| REST API with scoped keys (every change audited as the key) | Read | Read + write | Read + write |
| Outbound webhooks — HMAC-signed, retried for up to a day | — | ✓ | ✓ |
| Intake connector — Zapier, Jira, ServiceNow, email or any webhook | — | ✓ | ✓ |
| Shadow AI Discovery — browser extension shows which AI tools staff use | ✓ | ✓ | ✓ |
| Shadow AI Discovery+ — Okta / Google Workspace / Entra / Netskope / Zscaler / Cloudflare One imports | — | ✓ | ✓ |
| Vendor questionnaires answered through a private vendor portal | — | ✓ | ✓ |
| Use-case approval gate — an Admin signs off before a use case goes active | ✓ | ✓ | ✓ |
| Interactive API reference (OpenAPI) | ✓ | ✓ | ✓ |
| Administration | |||
| Admin Console (full data inventory & controls) | Owner + Admin | Owner + Admin | Owner + Admin |
| User roles (Owner / Admin / Member) | ✓ | ✓ | ✓ |
| User invite & role management | ✓ | ✓ | ✓ |
| Enterprise SSO (SAML / OIDC) | — | — | ✓ |
| Data export (full org snapshot) | ✓ | ✓ | ✓ |
| Retention policy + danger zone (Owner only) | ✓ | ✓ | ✓ |
| Admin seats included (people who log in) | 10 | 15 | 20 |
| Staff participants — report AI tools, sign policies, complete training (no seat needed) | Unlimited | Unlimited | Unlimited |
| Staff AI-tool reporting portal (anonymous shadow-AI intake) | ✓ | ✓ | ✓ |
| Support & Advisory | |||
| Email support | ✓ | ✓ | ✓ |
| Onboarding walkthrough | — | ✓ | ✓ |
| Priority support | — | — | ✓ |
| Advisory session (1:1 with the founder) | — | — | ✓ Included |
Agency / Enterprise includes one advisory session. Working sessions, half-day module training and a guided program launch are also available on their own, at published fees — see GOVERNBOX.ai Advisory Services →
Common questions
Start free with the Readiness Scorecard — no credit card, no sales call required.