GovernanceOS, Nebula Mutual control center: Defensible AI Platform Nebula Mutual
CI

Signed in as the CISO, administrator, Nebula Mutual, through Microsoft Entra.

Your role and gate authorityHelp and supportSign out

Regime profile

Prototype states

Profile

Jurisdiction
Canada, federal and Quebec
Sector
Insurer, life
Regimes
  • OSFI E-23
  • AMF AI guideline
Version
v2, effective 2026-08-20, reason: AMF guideline added
Change the profile, with a reason

The CISO or the Compliance lead changes the profile; each change is a versioned record.

Crosswalks

EU AI Act, NIST AI RMF, ISO/IEC 42001.

Informative only. A crosswalk is never a compliance claim.

Versions

  • v2 · 2026-08-20 · Compliance lead

    AMF guideline added

  • v1 · 2026-05-04 · CISO

    first profile at onboarding: Canada, insurer, OSFI E-23

Regulatory change triggers

RowLast firedReturn
OSFI Guideline E-232026-10-16re-checked, no change; effective 2027-05-01
AMF AI guideline2026-10-16re-checked, no change; effective 2027-05-01
Federal AI statute, Canada2026-10-16re-checked, still none in force checked 11 Oct 2026

Tier profile: the records each gate requires

Nebula Mutual's own tier profile, version v2. The institution writes it; GovernanceOS enforces it and never sets a tier. Every system is inventoried; each carries only its tier's obligations.

GateTier 1, highest riskTier 2Tier 3, lowest risk
EntryEntry, owner, classification, intended useEntry, owner, classification, intended useEntry, owner and classification only
G1 Data and designData sources and lineage, design record; signed by the Data leadData sources and design record; signed by the Data leadNot required
G2 ValidationIndependent validation by a validator who is not the developer; what was not examined is listed; dissent is its own recordValidation report, narrower scope allowed; the same independenceNot required
G3 ApprovalApproved by the CRO, with conditions and an expiryApproved by the CRO's delegate, with conditions and an expiryNot required
G4 DeploymentSigned deployment record, rollback plan, declarations from a boundarySigned deployment record and rollback planNot required
G5 OperationRe-assertion at least every 90 days and after any vendor change; monitoring evidence each cycleRe-assertion at least every 90 daysOwner confirms the classification at least every 365 days

An example of an institution's setting, on a fictional institution. Changing the tier profile is a versioned record, signed by the CISO or the Compliance lead.

Write a new regime profile version

Jurisdiction
Sector
Regimes
Effective from
Reason

You sign as the CISO, administrator, Nebula Mutual, with your identity provider.