Start with AI Governance. Add what you need.
Every plan is built on the AI Governance module. Your tier sets the depth, and you switch on the management modules — Risk, IT, Data — as you need them. Flat pricing per tier, never per seat.
Instant access · 15 days free · no credit card · nothing to cancel
AI Governance plus one management module — a real program in place.
- ✓ NIST AI RMF + ISO 42001 crosswalks
- ✓ Every U.S. state AI law, added as they pass
- ✓ Risk register, impact assessments, incident log
- ✓ Cost tracking with 60-day renewal alerts
- ✓ Board report, governance badge, Trust Page
- ✓ Unlimited staff participants and attestations
- ✓ 10 admin seats
Growing programs with privacy obligations.
- ✓ Everything in Starter, plus CCPA / CPRA and ISO/IEC 42005
- ✓ NIST SP 800-53 Rev. 5 / CSF 2.0 crosswalk
- ✓ Risk heat map
- ✓ Assessments auto-populate the risk register
- ✓ AI Strategic Plan, CAIO and Privacy Policy wizards
- ✓ Branded document exports
- ✓ 15 admin seats
Public agencies and regulated organizations.
- ✓ Everything in Pro, plus the EU AI Act framework
- ✓ HIPAA and GDPR data-privacy frameworks
- ✓ OMB M-25-21 / M-25-22 compliance pack
- ✓ Zero-trust agent checklist and scoring
- ✓ White-labeled Trust Page & badge, and Enterprise SSO
- ✓ Priority support and an advisory session
- ✓ 20 admin seats
Every plan includes AI Governance, multi-tenant security and an append-only audit log. Nonprofits save 20% on every plan, applied at checkout once status is confirmed. Not legal advice.
The more you add, the more you save
Every configuration includes AI Governance. Add Enterprise Risk, IT Inventory, and Data Management on top — each with its own scorecard, wizards, board-report chapter, and unlimited-signer attestations.
Monthly from $339/mo. The 15-day free trial is the way in.
Five programs, one shared graph
AI Governance runs through all four management programs, which is why it is in every plan rather than sold beside them.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from ProEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
AI runs through all four — so it’s the foundation, not a fifth box.
AI runs through all four below — it’s the foundation, not a fifth box.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from ProEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
Every plan is built on AI Governance. You switch on the management modules — Risk, IT, Data — as you need them, and Privacy comes with Pro and above (CCPA from Pro; GDPR and HIPAA on Agency). Price your configuration →
Pick a tier, switch on the modules
Platform spine
Every tier · every module- ✓Its own readiness scorecard
- ✓Guided document wizards
- ✓A dedicated chapter in your quarterly Board Report
- ✓Unlimited-signer attestations
- ✓Admin Console, append-only audit log & MFA
- ✦NIST AI RMF · ISO 42001 · Colorado AI Act frameworks
- ✦Risk register, impact assessments, incident log
- ✦Full quarterly Board Report + Governance Badge
- ✦Word + PDF export
- ✦10 admin seats
- ✦Monthly payment option available
- ✓Free AI Readiness Scorecard + gap report
- ✓AI Use Case Log — inventory every AI tool, incl. shadow AI (EU prohibited-use screen)
- ✓Grounded document generation — 11 policy & plan types, every clause cited to a control
- ✓AI Risk Register + 7-section Impact Assessments
- ✓AI Incident Log — severity + EU AI Act Art. 73 flagging
- ✓AI Agents inventory — 12-item zero-trust checklist
- ✓AI Cost Tracking & Roll-Up — 60-day renewal alerts, board totals
- ✓Training Plan + Employee Attestations — unlimited signers
- ✓AI Project Management — Kanban + 7-phase lifecycle checklist
- ✓Compliance Crosswalks — NIST AI RMF · ISO 42001 · Colorado AI Act
- ✓Quarterly Board Report — maturity score + history
- ✓Governance Badge + public Trust Page
- ✓Regulatory “What’s Changing” feed
- ✓Org-wide risk register — 6 plain-language categories
- ✓Guided risk discovery — draft register in ~30 minutes
- ✓One-page risk appetite statement
- ✓Treatments & actions with named owners
- ✓Simple KRIs — green / amber / red
- ✓Quarterly board risk report chapter
- ✓Your AI risk register becomes the ‘technology & AI’ category
Where the tiers differ
Colorado readiness, before the clock runs out
SB 26-189 and HB 26-1263 take effect January 1, 2027. Starter and up include a dedicated Colorado crosswalk, so the work is grounded well ahead of the deadline.
Not ready to pick a plan?
Test drive GOVERNBOX free for fifteen days, then choose your modules.