Open source
Open-source tools, free and offline
Two command-line tools under the Apache 2.0 license. They run on your own machine, need no account and make no network calls. goslint also runs free in your browser, here on governanceos.si.
Released 20 October 2026: governanceos 0.3.0 on PyPI, with goslint 0.2.0 and its 23 rule packs, and gos-verify 1.2.1.
pip install "governanceos[lint]"In your browser
Check a register now, free.
No terminal at hand? goslint also runs free in your browser, with no account and nothing to install. Choose your register, tick the regulators that supervise it, and read what to fix.
The page runs the same governanceos package from PyPI, so its findings match the command line, and your register stays on your computer.
goslint
Check the register you keep today.
Many AI and model inventories live in a spreadsheet. goslint reads yours, as .xlsx, .xlsm or .csv, and checks it against the fields a regulator names, on your own machine. The workbook is read, never written.
- Missing fields
- each field the instrument names, with its basis in the instrument’s own words (required, expected or recommended) and a citation
- Next review date
- dates that have passed, and dates that cannot be read, where the instrument names a next review date
- Typed or derived
- whether each cell was typed by a person or derived by a formula
- What a spreadsheet cannot prove
- no history, no signers, no hashes
goslint lint register.xlsx --pack osfi-e2323 rule packs and 246 fields, across Canada, the United States, the GCC, the European Union, the United Kingdom, Switzerland and Asia-Pacific. Each field carries its basis in the instrument’s own words and a citation. Name the packs for the jurisdictions your register answers to; goslint packs lists them.
| Region | Pack | Instrument | Fields |
|---|---|---|---|
| Canada | amf-ai | AMF Guideline for the Use of Artificial Intelligence (March 2026), s. 6, 6.1, 6.2 and Annex 2 | 13: 5 expected, 8 recommended |
| Canada | osfi-e23 | OSFI Guideline E-23 (2027), Appendix 1: information tracking for models | 17: 6 required, 11 expected |
| United States | nist-ai-600-1 | NIST AI 600-1, Generative AI Profile, GV-1.6-003: items for GAI system inventory entries | 7: 7 recommended |
| United States | nist-ai-rmf-playbook-gv16 | NIST AI RMF Playbook, GOVERN 1.6 (companion to NIST AI 100-1): inventory attributes | 7: 7 recommended |
| United States | us-co-3ccr702-10 | Colorado 3 CCR 702-10 (Regulation 10-1-1, amended), s. 5.A.9 and 5.A.10: inventory of ECDIS, algorithms and predictive models | 6: 6 required |
| GCC | cbuae-ai-gn | CBUAE Guidance Note on Consumer Protection and Responsible Adoption and Use of AI and ML by LFIs (2026), para 2(f): AI inventory minimum | 4: 3 required, 1 expected |
| GCC | cbuae-mms | CBUAE Model Management Standards, Part II, 4.4 Model inventory and grouping, plus 10.5.2 | 12: 12 required |
| GCC | qcb-ai | QCB Artificial Intelligence Guideline (2024), Article 10 Register | 20: 17 required, 3 expected |
| European Union | ecb-egim-model-register | ECB Guide to internal models (version 4.1, June 2026), General topics, paras 6 and 13: register of internal models | 10: 8 required, 1 expected, 1 recommended |
| European Union | esma-ai-investment-records | ESMA Public Statement on AI in retail investment services (ESMA35-335435667-5924), paras 23 and 24: records on AI use | 6: 6 expected |
| European Union | eu-aia-annex8-a | EU AI Act, Annex VIII Section A: provider registration of Annex III high-risk AI systems (Art. 49(1)) | 13: 12 required, 1 recommended |
| European Union | eu-aia-annex8-b | EU AI Act, Annex VIII Section B as amended by Regulation (EU) 2026/1744: registration of Art. 6(3) systems (Art. 49(2)) | 7: 7 required |
| European Union | eu-aia-annex8-c | EU AI Act, Annex VIII Section C: registration by deployers that are public authorities or EU bodies (Art. 49(3)) | 5: 5 required |
| United Kingdom | pra-ss1-23 | PRA SS1/23 Model risk management principles for banks, Principle 1.2 model inventory, with related recording clauses | 21: 11 expected, 10 recommended |
| Switzerland | finma-08-2024 | FINMA Guidance 08/2024, Governance and risk management when using AI, 2.1 and 2.2: inventory and risk classification | 4: 3 expected, 1 recommended |
| Asia-Pacific | au-ai-register-template | Australia National AI Centre AI register template (XLSX, sheet 'Template') | 12: 12 recommended |
| Asia-Pacific | au-gaia-register | Australia Guidance for AI Adoption, Implementation guidance 4.1 Maintain an AI register (4.1.1) | 11: 11 recommended |
| Asia-Pacific | au-vaiss-guardrail9 | Australia Voluntary AI Safety Standard (2024), Guardrail 9, requirement 9.1.1: AI system inventory | 11: 11 recommended |
| Asia-Pacific | cn-algorithm-filing | China algorithm filing content: Algorithm Recommendation Provisions Art. 24 (via Generative AI Interim Measures Art. 17), plus labeling materials (Labeling Measures Art. 12) | 7: 7 required |
| Asia-Pacific | mas-ai-mrm-ip-2024 | MAS Information Paper, AI Model Risk Management (Dec 2024), 5.2 Inventory: attributes banks capture | 17: 17 recommended |
| Asia-Pacific | mas-airm-gl-2026 | MAS Guidelines on AI Risk Management for Financial Institutions (7 Oct 2026), 4.5 to 4.9: AI inventory | 15: 15 recommended |
| Asia-Pacific | rbi-free-ai-inventory | RBI FREE-AI Committee Report (2025), 4.4.48, 4.4.67 to 4.4.69 and Recommendation 23: AI inventory within regulated entities | 11: 11 recommended |
| Asia-Pacific | rbi-mrm-draft-2026 | RBI draft Guidance on Regulatory Principles for Model Risk Management, 2026, paras 21 to 23: model inventory (DRAFT) | 10: 8 required, 1 expected, 1 recommended |
It checks that fields are present, that review dates have not passed, and where values come from. Whether the values are true is for the review.
History, signers and hashes cannot be added to a spreadsheet. That is what GovernanceOS™ keeps.
gos-verify
Verify an evidence pack, without us.
An examiner checks a GovernanceOS evidence pack offline: the hash chain, the Ed25519 signature over the whole pack, and the pack key against the one the institution sent by another route. It needs Python 3 and nothing else.
gos-verify pack.json --key KEYHASHThe same verifier is the single-file download on the verify page; the two are byte-identical.
Source
Read it, run it, change it.
Both tools are one package, governanceos, under the Apache License 2.0. The tools are open source so that practitioners can use them in banks and on other client work without license concerns. Commercial use, changes and redistribution are all allowed. Keep the copyright notice, the license and the NOTICE file with any copy, and mark the files you change. The license grants no rights to the GovernanceOS name or marks.
In return, a word about GovernanceOS is appreciated: a post or a tweet that links to governanceos.si. It is a request, not a condition of the license.