# GovernanceOS for Superintelligence, the Defensible AI Platform

> GovernanceOS is AI governance software designed to keep the governance record of each AI decision at a regulated institution: one named approver per lifecycle gate, evidence hashed at the moment of decision, chained so an examiner can verify it offline, and regulatory rows that record a refusal with its date where a regulator has issued nothing. It is designed for the path from today's AI to superintelligence. Canada-based; serves Canada, the United States and the GCC.

## Entity

- GovernanceOS (https://governanceos.si/) is a separate entity from its founder's site. Founder: Nabeel Khan, https://nabeelkhan.com/ (Wikidata Q140932324), linked as its own entity, never merged with GovernanceOS.

## What it is not

- Not a compliance certificate, and never a score. It states what the records show; conformance with any framework is self-declared. Certification of people and institutions is described at https://governanceos.si/certification: institutions are certified only by an assessment body independent of GovernanceOS, by design.
- Not a risk score. The readiness instrument gives a position on four altitudes, never a score.

## Product

- [GovernanceOS: AI Governance Software | Defensible AI Platform](https://governanceos.si/): AI governance software: every AI decision on record, signed by one named person. For practitioners, the institutions they serve and their examiners.
- [How AI governance records work](https://governanceos.si/how-it-works): How GovernanceOS keeps AI governance records: five gates with one named approver each, evidence hashed at passage, and a chain your examiner verifies offline.
- [Eight properties of AI governance records](https://governanceos.si/moat): Eight properties of GovernanceOS records, each proved by a record field: DOI-cited fields, dated refusals, GCC and Sharia rows, one approver per gate.
- [Cloud and VPC AI governance software](https://governanceos.si/products): Run GovernanceOS in a Canadian region or in your own AWS, Azure or Google Cloud account, on the same signed image. Your records leave with you.
- [Register tier](https://governanceos.si/register): The free GovernanceOS Register tier for institutions.
- [Security, hosting and attestations](https://governanceos.si/security): GovernanceOS security posture: attestations and their state, hosting in Canada, per-tenant keys, subprocessors, testing, incident notice and exit.
- [Engineering: deploy, pin and verify](https://governanceos.si/engineering): Deploy GovernanceOS as a pilot, or with Helm or Terraform. Signed images with an SBOM, a signed tool manifest, and an offline verifier under Apache 2.0.
- [Ask from your assistant](https://governanceos.si/assistant): Connect Claude, Claude Code, ChatGPT or Microsoft Copilot to your GovernanceOS tenant.
- [GovernanceOS for Superintelligence | Defensible AI Platform](https://governanceos.si/about): GovernanceOS for superintelligence: AI governance software designed to turn AI policy into enforced controls and regulation into evidence.

## AI governance resources

- [AI Governance Resources](https://governanceos.si/resources): AI governance resources: a certification path, the Defensible AI Library, learning paths, plain-word definitions, regulation rows and answers.
- [Defensible AI Library](https://governanceos.si/library): Governance documents that fill themselves from your records, by job and by role. For members, after sign-up.
- [AI Governance Agents](https://governanceos.si/library-agents): Ten AI governance agents, one for each GovernanceOS module. They work in your own assistant and read a client's workspace read-only. For members.
- [AI and Superintelligence Governance Certification](https://governanceos.si/certification): An AI governance certification from the foundations to superintelligence: four levels, assessed on records, with OSFI E-23, GCC and Sharia endorsements.
- [The GovernanceOS AI Governance Handbook](https://governanceos.si/handbook): The GovernanceOS AI Governance Handbook: free and practical, from the operating model and the lifecycle to regulation by region and superintelligence.
- [Learn](https://governanceos.si/learn): One short learning path per role, practiced on the GovernanceOS demo.
- [Regulation rows](https://governanceos.si/regulation): AI regulation rows for Canada, the US, six GCC states, the EU, the UK, Switzerland, Asia-Pacific and international standards, each dated and sourced.

## For practitioners

- [For practitioners](https://governanceos.si/practitioners): The GovernanceOS practitioner tier: workspaces per client, three findings, templates and handover.
- [Expertise as a Service for AI governance](https://governanceos.si/expertise-as-a-service): AI governance as a service: one subscription gives practitioners prefilled templates, policies and an evidence trail for every client.
- [Practitioner directory](https://governanceos.si/directory): A directory of AI governance practitioners. Listed, not endorsed.

## For examiners

- [Verify a pack](https://governanceos.si/verify): How an examiner verifies a GovernanceOS evidence pack offline: the key, the verifier and its checksum, and the result.

## How-to guides

- [Guides](https://governanceos.si/guides): Step-by-step GovernanceOS guides for practitioners, institutions, examiners and every account: each task, with the screen where it happens.
- [What GovernanceOS records, and what a gate is](https://governanceos.si/guide-what-gos-records): The record of each AI decision: five gates, one named approver at each, and evidence hashed as the gate passes.
- [Sign up as a practitioner](https://governanceos.si/guide-sign-up-practitioner): Sign up with your work email, request your access code, and start the 7-day trial when you enter the access code.
- [Claim your institution’s tenant](https://governanceos.si/guide-claim-tenant): An administrator signs in with the institution’s identity provider, names the register owner and claims the tenant.
- [Start a client workspace](https://governanceos.si/guide-start-client-workspace): Create one workspace per client, or one for your own institution, with its regime profile and a reason.
- [Import a register from a spreadsheet](https://governanceos.si/guide-import-register): Upload a CSV or XLSX register, map its columns, and import every row as a typed value.
- [Read the import receipt and the findings](https://governanceos.si/guide-read-receipt-findings): See what an import wrote, then read the findings: typed versus produced, point in time, and re-assertion lapses.
- [Draft a finding](https://governanceos.si/guide-draft-finding): Write a finding that cites records, says what they show and who decides, then share it with the client.
- [Bring files in](https://governanceos.si/guide-bring-files): Record the client’s authorization, then upload documents or connect a GitHub repository, read-only.
- [Hand a workspace to the client](https://governanceos.si/guide-hand-over-workspace): Send the claim to the client’s administrator. After the claim, you keep a read-only copy.
- [Apply to be listed in the directory](https://governanceos.si/guide-apply-directory): Consultants apply at the last step of sign-up, or later from Account. A Directory editor approves each listing by hand.
- [Set the regime profile](https://governanceos.si/guide-set-regime-profile): Say where you are supervised, what you are and what you answer to, and sign each change with a reason.
- [Invite members and give gate authority](https://governanceos.si/guide-invite-members): The CISO invites people at the institution’s domain and gives each a role, with the gate authority it carries.
- [Sign a gate with a reason](https://governanceos.si/guide-sign-gate): Read the gate record and its evidence, then sign, return or reject it with a reason, as the named approver.
- [Record a validation (G2)](https://governanceos.si/guide-record-validation): Attach the report, record the findings, what was not examined and any dissent, then sign G2.
- [Re-assert evidence before it lapses](https://governanceos.si/guide-reassert-evidence): As the model owner, confirm an entry is still true, say what that rests on, and sign before the interval runs out.
- [Build and share an evidence pack](https://governanceos.si/guide-build-evidence-pack): Choose the systems and dates, sign the pack with a cover note, and share it with an examiner key.
- [Issue an examiner key](https://governanceos.si/guide-issue-examiner-key): Give an examiner read-only, time-boxed access, with every read logged, and revoke it at any time.
- [Open an examiner key](https://governanceos.si/guide-open-examiner-key): Open the records an institution shared with you, with a one-time code. No sign-up and no password.
- [Ask a point-in-time question](https://governanceos.si/guide-ask-point-in-time): Ask in plain words, check how the question was read, and keep a permalink to the answer.
- [Verify a pack offline](https://governanceos.si/guide-verify-pack-offline): Download the verifier and the pack, check their SHA-256, run it with --key and the pack key hash you were sent, and read the result.
- [Sign in with codes or an authenticator](https://governanceos.si/guide-sign-in): Sign in with a code from your email, or turn on an authenticator app and keep your recovery codes.
- [Check that an email came from us](https://governanceos.si/guide-check-email): Every email from GovernanceOS carries a check code. Look it up yourself before you trust the email.
- [Get support or report a barrier](https://governanceos.si/guide-get-support): Use the support form on Help. Any address works for a barrier report, with no plan and no account.

## Company

- [See where you are, then talk](https://governanceos.si/talk): See where you are on four altitudes, free, and book a thirty-minute Fit Call.
- [Status](https://governanceos.si/status): GovernanceOS service status, release and manifest hash.
- [Help and support](https://governanceos.si/help): Help by role, verifying a pack offline, and how to reach GovernanceOS support.
- [Accessibility](https://governanceos.si/accessibility): The GovernanceOS accessibility statement: WCAG 2.2 AA commitment and known gaps.
- [Privacy](https://governanceos.si/privacy): GovernanceOS privacy.
- [Terms](https://governanceos.si/terms): GovernanceOS terms.

## How it differs, by category

- AI governance platforms (IBM watsonx.governance, ServiceNow AI Control Tower, OneTrust, Credo AI, ModelOp, Monitaur, Holistic AI, Saidot, Truyo, Airia, Cranium AI, Relyance AI, SAP): they keep inventories, assessments and approval workflows, and several enforce policy at the tool call. GovernanceOS keeps the decision itself, with one named approver per gate (G1 to G5) and evidence hashed at passage.
- AI security and runtime tools (Lakera, part of Check Point since October 2025; HiddenLayer; Pillar Security; WitnessAI; Prediction Guard; Arthur): they stop unsafe calls. GovernanceOS keeps the governance record those controls sit inside and can take their signals as evidence.
- Data and risk platforms (Microsoft Purview, Collibra, Dataiku, SAS, Asenion, Vanta): broad control, data and model risk work. GovernanceOS is narrower and deeper: the record of each AI decision, the regulator's words behind it, and evidence checkable offline.

## Facts about others, stated positively

- OSFI Guideline E-23 is also covered by ModelOp (an E-23 template), Asenion (formerly Fairly AI; an E-23 page), VerifyWise (an E-23 page) and Collibra (a mapping to the draft guideline).
- Meilynx publishes an offline verifier, under Apache 2.0, for its runtime call records.
- ServiceNow describes tamper-evident audit logs; Dataiku can bind a sign-off to a model version; Arthur flags agents whose policy is no longer running.

## What we found no one else stating (27 vendors, own pages, 16 and 18 October 2026)

- One named approver per lifecycle gate with evidence hashed at the moment of passage.
- Regulatory rows that record a refusal with its date where a regulator has issued nothing.
- The AI instruments of SAMA, CBUAE, QCB, CBB, CBK and CBO, and a Sharia supervisory board as a second authority over the same records.
- Record fields that cite specifications deposited with DOIs.

These describe public pages on those dates, not anyone's roadmap.