Governance software for AI. Every decision on record.

Built for banks, insurers and health systems that answer to a regulator. One named person signs each AI decision, and the evidence is captured at that moment. Designed so that when the examiner asks, the answer comes from the records in minutes, and can be checked without us.

See where you are, free Book a Fit Call

Four questions. No email, no key, no sales call. Your answers stay in your browser.

An examiner's question, answered from the records

Meet Nebula Mutual, our fictional insurer

A Canadian life insurer we made up. Every example on this site comes from its records.

Learn more about Nebula Mutual

Federally regulated, about 400 staff, with AI in underwriting, claims and customer service. It answers to OSFI Guideline E-23 and the AMF AI guideline. Its people appear as roles, never names. About the examples

which approvals and deployments passed at nebula-mutual between July and September 2026

Customer assistant, G3 approvalnebula-mutual/customer-assistant2026-07-19
Claims routing, G3 approvalnebula-mutual/claims-routing2026-08-14
Claims routing, G4 deploymentnebula-mutual/claims-routing2026-08-30
Customer assistant, G4 deploymentnebula-mutual/customer-assistant2026-09-02
Underwriting triage, G3 approvalnebula-mutual/underwriting-triage2026-09-12

5 records. Each carries the person who signed it, the hashes of its evidence and its place in the chain. The examiner's view

Find your regulator

Five sectors. Each instrument named and dated.

Pick your sector. The instruments that reach you are listed below, each with where it stands and a link to its full row.

Learn more about these rows

A row is one instrument from one regulator: its name, where it stands, the date it was checked, and the source it was read from. Where a regulator has issued nothing, the row says none issued and carries the date that was checked, so the absence is on record rather than assumed. When a row changes, the records that relied on it are reopened for review, by design. The rows live on the regulation page; this band shows the ones that reach your sector.

See every row

Who this is for

Three readers. One set of records.

The same records serve the person who keeps them, the person who checks them, and the institution that answers for them.

Practitioners

Will this hold up in front of the committee, and can I run it for more than one client?

Every entry is append-only, with a date, a person and a reason. Findings stay on the record. What moved between submission and approval is listed, and "nothing moved" is written when nothing did. A practitioner keeps one workspace per client and hands it over when the client claims its own tenant.

Heads of model risk, validators, AI governance leads, independent consultants

For practitioners

Examiners

Can I check this without the vendor in the room?

Yes, by design. A read-only key with an expiry. One query returns a quarter, or the state of a system on any past date. The evidence pack verifies offline with an open-source verifier, and every read is logged. The chain proves integrity; the institution proves truth.

Prudential, conduct, insurance and health regulators

How an examiner verifies

Institutions

Can we use this without opening a third-party file we cannot close?

Your administrator claims the tenant through your own sign-in; nobody holds a vendor password. Records live in a Canadian region or in your own cloud account. Reads and exports never stop, for any reason, and your records leave with you. Until SOC 2 Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account.

CRO, CIO, CISO, the board's risk committee

Security and trust

How governance works here

Five signed gates, and a receipt for every AI call.

GovernanceOS keeps the governance records of an institution's AI systems and agents: who decided, on what evidence, under which regulator's words. A system passes five gates in its life. One named person signs each gate, the evidence is captured at that moment, and each record is chained to the one before it. An examiner verifies the chain offline, without us.

Gate record, one named approver
Evidence hash, captured before the decision
Chain link to the record before

The record spine. Each gate record holds one named approver and the hashes of its evidence, taken when the gate was passed. Nothing is overwritten: a loop-back, a rollback or a retirement is a new record.

Your systems
Boundary Gateway
Written by the system
Evidence log
Examiner

One AI call. The gateway writes a signed receipt for it beside the call, so writing it adds no wait, and the receipt joins the chain. Payloads never leave your boundary. When the gateway sits in the path, the delay it adds will be published once it is measured. How it works · Plain words

Nothing is typed that the system can produce. Every field says whether a person entered it or the system wrote it from what happened.
An approval does not last forever. It carries an expiry, and it is reviewed when the system changes.
Silence is recorded, never guessed. Where a regulator has issued nothing, the row reads "none issued", with the date it was checked.

We can block a call when you ask. We always record it.

The day the examiner asks

One question. Two answers.

What was this system's risk classification on 14 March, who approved its deployment, and on what evidence?

Both answers exist. The difference is what each one is made of.

Today, in most institutions

From a binder

Find the version of the spreadsheet that was current in March.
Email the system's owner. Wait.
Ask the vendor which model version was live that week.
Rebuild the approval from meeting minutes and screenshots.
Hope nothing was overwritten in between.

Weeks.The answer is a reconstruction, and the examiner knows it.

With GovernanceOS, by design

From the record

Run one query, as of 14 March.
The entry returns as it stood that day: classification, owner, tier.
The gate record returns with it: the named approver, the evidence hashes, the timestamp.
Export the quarter as an evidence pack.
The examiner verifies the pack offline, without us.

Minutes.The answer is the record, and the examiner can check it alone.

Two ways to answer the same question. Left, the reconstruction most institutions make today. Right, the answer GovernanceOS is designed to return.

What the records give you

Eight things a binder cannot give you.

Each one is a property of the record itself, and each is visible on a surface you can open.

The eight properties
#	What you get	What it means	Where you see it
01	One named person per gate	A person, never a committee, signs each of the five gates with the evidence attached. A board resolution is recorded with its number and signed for the board by its chair.	Every gate record
02	A refusal is a dated value	Where a regulator has issued nothing, the row reads "none issued, checked" and the date. It never goes blank and never guesses.	Every regulation row
03	Canada, the United States, six GCC states, the EU, the UK, Switzerland and Asia-Pacific	OSFI and the provinces; US federal and state rows; SAMA, CBUAE, QCB, CBB, CBK and CBO, with a Sharia board as a second authority for Islamic finance.	Your regime profile
04	Every field points to a published standard	Each record field cites the line of a deposited specification with a permanent reference, a DOI, so an examiner can read the rule the field comes from.	Every record field
05	Your assistant reads and drafts; a person signs	Microsoft Copilot, Claude or ChatGPT can read the records and draft an entry. A gate passes only with the named approver's signature, outside the chat.	The audit log of every call
06	Agents are records too	An agent's authorizations, keys and limits are records of their own. A key that expires stops the agent.	The agent register
07	Regulation rows that run inside your boundary	Rows arrive as a signed release that runs in your tenant or your own cloud account, without calling us.	The release notice in your tenant
08	Self-declared, or independently certified	Conformance is a self-test run on your own records, reported with its result and called self-declared. Certification comes only from an assessment body independent of GovernanceOS, by design. No score.	The trust table

Read the eight in full

Three pillars

Record. Evidence. Exit.

A record says who decided. Evidence says on what. Exit says the records are yours, whatever happens to us.

Record

One named person per gate. Evidence hashed at passage. Every field marked typed or produced.

typed entered by a personproduced written by the system

Example record, fictional institution nebula-mutual/customer-assistant/g4 Effective 2026-09-02Author CRO, Nebula MutualReason: deployment approved

System: nebula-mutual/customer-assistant; typed
Gate: G4 Deployment, passed; produced
Approver: CRO, Nebula Mutual, signed with key cro-nm-01, Ed25519; produced
Approval token: signed by the CRO, Nebula Mutual, 2026-09-02 19:12 UTC; produced
Evidence: 52e4b24fa803… show full hash
52e4b24fa803b96452f12e54b51de3a8d7916e8d105cdf0a53033c235ebd7927; produced

Evidence

A chain, not a binder. Every record carries the hash of the one before it. An examiner's quarter is one query.

Example record, fictional institution nebula-mutual/evidence/chain Effective 2026-10-16Author Boundary GatewayReason: declaration appended

Chain head, live, 2026-10-16: 072daf29a5a0… show full hash
072daf29a5a0e4fd8de18bb09045bb7015b2b7b7186c5c7989d134cf6eb15b9f; produced
Previous: 34e06fd07e55… show full hash
34e06fd07e55be7433ad8c83c94851923b3a0527e9ca65c4d1eed6a8d5eefed2; produced
Last outside anchor: [anchor operator], [cadence]; typed
Verify: offline, with the open-source verifier (Apache 2.0)

Exit

Your records leave with you. Two export forms, a perpetual license to your own records, and reads that never stop.

Example record, fictional institution nebula-mutual/exit/covenant Effective 2026-10-16Author the CISOReason: covenant on file

Export forms: GovernanceOS schema, and flat JSON and CSV with an embedded dictionary
Schema license: perpetual, irrevocable, for your own records; extends to your examiners
Reads and exports: never stop, for any reason
Termination: return, verify, then destroy the per-tenant key

Who it answers to

The people who sign, test, secure and examine.

Each role gets the one thing it has to be able to show.

Chief risk officer

Signs the gates that carry risk, as one named person, with the evidence in front of them. Every evidence pack opens with a one-page summary written for the board: systems, gates, approvers, lapses.

OSFI E-23, SR 26-2, NAIC AI Bulletin

Validator and head of model risk

Records what was tested and what was not, apart from the approver. Findings stay on file and are never resolved away. Dissent is a record of its own, with an escalation route that does not run through the approver.

G2 validation, the unexamined set

CISO

Claims the tenant through your own identity provider and holds the keys, the assistant policy and the audit log of every call. For banks, cloud assistants are denied until the CISO records the decision to allow them.

Per-tenant key, connector allow-list

Examiner

Reads with a read-only key that expires, asks for a quarter or for a system as it stood on any date, and verifies the pack offline. No sign-up, and every read is logged.

Read-only, logged, verified without us

Sharia board

Holds a second authority over the same records. A board resolution is recorded with its number, signed for the board by its chair, beside the approver's own signature.

SAMA, CBUAE, QCB, CBB

Clinical AI lead

Signs the gates for clinical decision support, and keeps on each system the source attributes HTI-1 asks for.

ONC HTI-1, health systems

Products

A free register first. Then our cloud, or yours.

Institution terms are discussed on a call.

Register tier, free

Your administrator claims the tenant with your own sign-in. Import the inventory spreadsheet you already keep. Get back three findings: which fields a person typed and which the system produced, what the register said on any past date, and which entries nobody has re-confirmed.

In this tier, monitoring status and next review date are typed; nothing in this tier produces them. The register is stored in Canada.

GovernanceOS Cloud

A tenant in a Canadian region, under your own sign-in, with a per-tenant key. Your Boundary Gateway sends proofs up and never payloads.

Until SOC 2 Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account.

Cloud

GovernanceOS VPC

The same signed image in your own cloud account. You hold the keys, the region and the egress allow-list. The route for residency-bound institutions, and for everyone until Type 1.

Nothing leaves your account but proofs.

VPC

Ask from where you already work

Your assistant reads and drafts. One named person signs the gate.

Connect Microsoft Copilot, Claude, Claude Code or ChatGPT to your tenant. Ask what a system's classification was on a date, which gates are waiting for a signature, or what changed in a regulation row.

An assistant may read and may draft. It never passes a gate: a draft becomes a passed gate only when the named approver signs it, outside the chat. Every call is logged with the assistant's identity, so "which records has the assistant seen" is a query, not a guess.

Bank tenants deny cloud assistants by default. Allowing one is a recorded decision by the institution.

Ask from your assistant

Regulation rows

Where a regulator has issued nothing, the row says so.

Rows for Canada, the United States, six GCC states, the EU, the UK, Switzerland and Asia-Pacific. Each names the instrument, its status and the date it was checked. A regulator's silence reads "none issued" in red, with the date, so nobody has to guess what applies. When a row changes, the records that cite it are reopened for review.

Jurisdiction	Instrument	Status	Checked
Canada, federal	OSFI Guideline E-23	Final; effective 2027-05-01	2026-10-11
Canada, federal	Statute governing AI systems	none issued	2026-10-11
United States, federal	SR 26-2	Guidance; issued 2026-04-17	2026-10-16
United States, federal	Statute regulating private-sector AI use	none issued	2026-10-16
Saudi Arabia	AI directive for banks, SAMA	none issued	2026-10-18
Bahrain	AI directive, CBB	none issued	2026-10-18

All regulation rows

Trust

What is attested, and by whom.

Each attestation says whose it is and where it stands. Nothing is claimed before it exists. No score: conformance is a self-test run on your own records, reported with its result and called self-declared. Certification comes only from an assessment body independent of GovernanceOS, by design.

Attestation	Whose	State
SOC 2 Type 1	GovernanceOS, by an independent auditor	Not started. Target quarter [quarter]. Until Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account.
SOC 2 Type 2	GovernanceOS, by an independent auditor	Observation window [window], after Type 1
ISO/IEC 27001	GovernanceOS	Only on a named buyer's requirement
Framework conformance	Self-declared by GovernanceOS	Self-tests published per framework
Chain verifier	Open source, Apache 2.0	Runs without us

Every capability on this page is a design commitment, and every record shown is an example on a fictional institution. Read the posture

Talk

Four questions first. Then talk.

The readiness check places your institution on four altitudes: Regulatory Floor, Strategic Compass, Operational Machinery and Technical Substrate. A position, not a score. It asks for no email and no key.

When it helps, book a Fit Call: thirty minutes on your regime, your gaps and whether GovernanceOS fits. Institution terms are discussed there.

See where you are, free Book a Fit Call