Give your AI governance work a home.
One workspace to register every AI system, plan the risks and controls, get the right people to sign off, and keep a record you can hand over.
Covers every kind of AI you run
Every AI system
Risks & controls
Collections Copilot
SYS-024 · A. Fernandes
Evidence linked to the record
Human sign-off
Connected evidence
Governance work has no shape until you give it one.
No one place to look
AI systems live in spreadsheets, tickets, and inboxes. Nobody can answer who owns a system, what data it touches, or where it is in the process.
Every tool treated the same
Without a structured review, a low-risk chatbot and a high-risk decisioning system get the same attention - or none. You only notice the difference when something goes wrong.
Policies that never reach the work
You know a regulation applies somewhere. But nothing turns a policy clause into an obligation someone owns, tracks, and closes with a real control.
Nothing to hand over
When a customer or auditor asks how a system was governed, all you have is screenshots and a best-effort story. There is no clean record of who did what, when, and why.
Register, plan, review, sign off. In one workspace.
Give every AI system a home.
- One record for each system: owner, category, hosting, data sensitivity
- Structured context, then a draft plan of risks, gaps, controls, and exceptions
- AI helps draft; your team reviews and confirms
Claims Triage Model
Registered 4 Mar- Purpose
- Prioritises incoming claims by urgency.
- Data
- Claimant records, policy history.
- Affects people
- Yes
- Dependency
- Core claims system
- Fallback
- Manual triage queue
- Risk tier
- High
One register for everything: the models you build, the AI inside software you already buy, and the tools a team signed up for last week. Same record, same review, same sign-off. The depth of scrutiny follows the risk, not where the AI came from.
Not a spreadsheet. Not a slide deck. Not a big-bang GRC project.
Not a spreadsheet
Spreadsheets do not stop the same person from submitting and approving their own work, do not link evidence, and do not keep a clean history you can hand over.
Not a consulting report
A consulting engagement gives you a point-in-time deck. Vigil24 keeps the register, plan, controls, and recorded activity current as the work happens.
Not an enterprise GRC suite
Enterprise GRC platforms assume you have a dedicated team and a long implementation. Vigil24 is sized for the teams who do not.
Policies set the rules. The record shows what happened.
A policy says what should happen. Your governance record shows who reviewed the risks, which controls were verified, and what evidence supported approval.
Vigil24 links each action to the AI system as the work happens. When a customer, auditor or regulator asks, the decisions and their supporting evidence are already connected.
Customer support assistant
Owner: Customer operations · Record version 3
Context submitted
04 Mar · 09:12System owner
Purpose, data sources and risk assessment recorded
Plan approved
11 Mar · 14:30Independent reviewer
Risk plan v2 approved with required controls
Control evidence linked
18 Mar · 10:05Control owner
Human review procedure · evidence v1
Control verified
18 Mar · 10:18Independent reviewer
Evidence reviewed and governance gap closed
Readiness signed off
22 Mar · 16:42System approver
Required controls verified before approval to operate
The governance lifecycle in five steps.
- Step 1
Register the system
Add the AI system with its owner, category, hosting, and whether it makes decisions about people.
- Step 2
Complete the context
Answer a structured set of questions about the system so the plan starts from real facts, not guesses.
- Step 3GATE
Plan risks and controls
Draft the risks, gaps, controls, and exceptions, then send the package to a reviewer for approval.
- Step 4
Verify the controls
Put approved controls in place, attach the evidence they need, and clear any blockers before sign-off.
- Step 5GATE
Sign off and monitor
Get final approval, move the system into monitoring, and re-open the plan only when things change.
Find AI tools nobody registered
Optional discovery capabilities surface AI tools that were never registered. Which sources are available depends on your deployment. Anything found lands in the same review queue as systems you added manually.
Intake queue
11 waiting| Tool | Found by | First seen | Status |
|---|---|---|---|
| Notion AI | Browser extension | 3 Mar | In review |
| Perplexity | Browser extension | 3 Mar | In review |
| Claude | Desktop app | 28 Feb | Registered |
| Grammarly | Browser extension | 26 Feb | Dismissed |
| Otter.ai | Desktop app | 24 Feb | In review |
What the platform enforces
Separate approvals
Plan approval first. Readiness sign-off before operation.
No self-approval
Submitters cannot approve their own work. Attempts are blocked and logged.
Locked during review
Submitted plans stay unchanged while awaiting review.
Evidence before closure
Gaps close only with working controls and required evidence.
Expiring exceptions
Time-limited exceptions reopen gaps automatically on expiry.
Logged overrides
Every override records who, when and why.
A regulation library your team can lean on.
Every regulation comes with a plain-language summary, mapped obligations, and links to control templates. We review the library on a schedule and release updates as regulations change.
regulations
8+ regions
Articles and versions
Mapped to control templates