AI governance: what we already measure and what is in preparation.
If you use or integrate AI systems, the AI Act and ISO/IEC 42001 expect you to govern them. Today HodeiShield measures your coverage of both among its 17 frameworks. The AI Governance module is in preparation: no date to announce.
- AI Governance module: in preparation, no date
- EU AI Act and ISO/IEC 42001: coverage measured against the canonical controls
AI governance
Status todayEU AI Act
Available
Coverage measured against the canonical controls
ISO/IEC 42001
Available
Coverage measured against the canonical controls, with evidence that expires
Cross-framework crosswalk
Available
Reuses evidence across the 17 frameworks
HodeiAI, governed AI
Available
It proposes, a person approves; an administrator can switch it off
AI Governance module
In preparation
AI systems register and its link to the AI Act, ISO 42001 and GDPR. No date
What exists today, with its proof and its scope
This is what you can use now to govern AI, and how far each thing goes.
HodeiShield maps your evidence to the canonical controls of 17 frameworks, including the EU AI Act (Regulation (EU) 2024/1689) and ISO/IEC 42001.
Docs · Compliance (opens in a new tab)Scope. Coverage measured against each framework's canonical controls; never a clean bill of health.
Both ISO/IEC 42001 and the EU AI Act are reported as coverage measured against the canonical controls.
Docs · Compliance (opens in a new tab)Scope. It is coverage measured from your evidence, not a clean bill of health or a certification.
The evidence engine gives each piece of evidence an owner, a validity date and a status. Expired evidence stops counting and the crosswalk reuses it across frameworks.
Docs · Compliance (opens in a new tab)Scope. Evidence is uploaded or linked by hand; there are no automatic cloud collectors.
HodeiAI, an example of governed AI
What you would ask of any AI that touches your data, applied to ours.
- Model
- Mistral AI.
- Personal data
- HodeiAI and the virtual CISO pseudonymise the personal data they recognise before sending; the mapping lives in memory only. The risk analysis of supplier scans does not pseudonymise: it sends the supplier's domain and the findings.
- Conversations
- Kept for 90 days at most.
- Administrator control
- An administrator can switch it off.
- Authority
- It never acts without a person's explicit confirmation.
What «in preparation» means
The AI Governance module, with the AI systems register and its link to the AI Act, ISO/IEC 42001 and GDPR, is not available today. We do not announce a date or a fixed scope.
Today you cannot inventory your AI systems in HodeiShield. You can measure your coverage of the frameworks that regulate them and see what evidence is missing and in what order.
If that is your use case, tell us in the coverage session: we show you what exists today and note down your need.
Keep going
AI governance: straight questions
The ones asked by people who have to answer for their organisation's AI.
Do you have an AI systems register?
Not yet. The AI Governance module, which would include that register, is in preparation and we do not announce a date or availability.
What does HodeiShield cover of the EU AI Act today?
It measures your coverage of Regulation (EU) 2024/1689 against the canonical controls, using your evidence, and tells you what is missing. It is measured coverage, not a clean bill of health.
And ISO/IEC 42001?
It measures your coverage of ISO/IEC 42001's canonical controls, with evidence that carries an owner, a validity date and a status. Expired evidence stops counting.
Do you guarantee AI Act compliance?
No. HodeiShield measures your coverage and orders what is missing. Being ready for an audit depends on your evidence.
Does HodeiAI send personal data to a model?
It pseudonymises the personal data it recognises (emails, phone numbers, national IDs, IBANs and the names of people in your organisation) before sending, and the mapping lives in memory only. We do not claim that no personal data leaves: it depends on what it recognises. The risk analysis of supplier scans does not pseudonymise: it sends the supplier's domain and the findings.
Can I ask to be considered for the module?
Yes: request a demo and tick AI governance as an interest. It is the route we have today; it is not a waitlist with a date.
Tell us which AI you have to govern
Request a demo and we cover what HodeiShield measures today for the AI Act and ISO/IEC 42001, and note your case for the module in preparation.
We do not announce a date for the AI Governance module.