Govern every AI system, from register to regulator.
Your teams are already using AI. XGRC® AI Governance software shows what each system is, what the law expects of it, and whether it is under control. EU AI Act, ISO/IEC 42001, POPIA and GDPR in one place.
- EU AI Act
- ISO/IEC 42001
- POPIA
- GDPR
XGRC® AI Governance is AI governance software built into the XGRC® platform. It takes each AI system from "what is it?" to "approved, controlled and monitored", runs the organisation-level ISO/IEC 42001 management system on top, and is rule-driven end to end: the classification decides what applies, and a change decides what must be reviewed.
- 18question EU AI Act decision tree
- 39editable change rules
- 34editable health rules
- 7approval types, separate from edit rights
- 12AI risk categories
- 13AI incident types
AI moved faster than your governance.
New tools arrive every month. Models change without notice. Regulators now expect you to know which AI you use, what risk it carries and who is watching it. A policy on paper is no longer enough. You need evidence.
No single view of the AI in use
Tools arrive through procurement, SaaS updates and teams trying things. Nobody can list every system, what it does and who owns it.
No defensible answer to "is this high risk?"
The EU AI Act turns on role, purpose and use area. Without a recorded decision, every audit and customer questionnaire starts from zero.
Changes and incidents slip past review
A model is swapped, a data source added, a new capability switched on. Nothing forces the risk, impact or legal review that change should trigger.
Six steps from "what is it?" to "approved and in hand".
Every AI system follows the same guided path. XGRC® works out where each system stands from the records you already have.
- 1
About the system
Pulled from your AI register, so nothing is typed twice.
- 2
What it is
Its EU AI Act tier and your role: provider or deployer.
- 3
What applies
Only the requirements that fit that tier and role.
- 4
Where we stand
Met, partly met or not met, with the evidence attached.
- 5
What to do
Every gap becomes an owned, dated action.
- 6
Approvals
Signed off by the right approver, then locked.
- ✓About the systemFrom the AI register
- ✓What it isLimited risk, deployer · approved and locked
- ✓What applies2 of 32 EU AI Act requirements · POPIA scoped
- 4Where we stand9 met · 3 partly met · 1 not met
- 5What to do4 owned actions
- 6ApprovalsAwaiting compliance sign-off
Is your AI system high risk? Find out in five questions.
A simplified version of how XGRC® classifies an AI system under the EU AI Act. Answer for one system and see the indicative tier and the obligations it brings.
Governance that runs itself, with people in charge.
Classify in minutes, defend for years.
A guided, 18-question EU AI Act decision tree records every answer against its article, then locks the approved result. Re-classifying creates a new version, never an overwrite.
Requirements that scope themselves.
The approved classification decides what applies, so a low-risk system is not buried in high-risk obligations. A limited-risk deployer sees a short list, not the whole Act.
Change triggers governance.
A new model, data source or purpose opens the right reviews, with due dates, through 39 editable rules. A person always decides the outcome.
Oversight you can evidence.
Human decisions, overrides and interventions are recorded, including events sent from your AI tools. A tool-reported event only counts once a person promotes it.
Ready for ISO/IEC 42001.
The AI management system, a Statement of Applicability, and one control library mapped once across every framework you run.
- Transparency to users Art. 50
- AI literacy for operators Art. 4
- Legal re-classificationAI Act ClassificationDue in 7 days
- Impact reassessmentImpact AssessmentDue in 21 days
39 editable rules · a person decides every outcome
Everything AI governance software needs, in one module.
Assess
- EU AI Act classification
- Compliance and applicability
- AI impact assessment
- AI risk management
Run and watch
- Human oversight evidence
- AI incident management with regulator clocks
- AI change governance
- Controls and evidence testing
Govern
- ISO/IEC 42001 management system
- Governance library: frameworks and policies
- Approval authority matrix
- Dashboard and health rules
Connect your AI register, monitoring tools and AI agents so XGRC® stays in step automatically. Connections are configured per source.
See an AI governance dashboard running.
An interactive demonstration dashboard with fictitious data: EU AI Act classification, ISO/IEC 42001 controls and the gaps between systems. Filter it, open any KPI and export a board pack.
Already on XGRC? Add AI Governance.
AI Governance uses the same platform, users, business units, Document Manager and approval flows you already run. It works alongside XGRC® Risk, Incident and Compliance, so AI is governed like everything else in your business. No new system to buy, host or train on.
Where do you stand on the EU AI Act?
One checklist covering what ISO/IEC 42001 and the EU AI Act actually require: classification and role, management system essentials, Statement of Applicability, impact, controls, oversight, incidents and change.
New to the standard? Read what ISO/IEC 42001 is, or see the eight steps to AI governance readiness.
AI governance questions, answered.
What is AI governance software?
AI governance software keeps a governed record of every AI system an organisation builds or uses: what it is, which rules apply to it, its risks and impacts, the controls and evidence behind it, who oversees it and how changes are reviewed. XGRC® AI Governance does this inside the XGRC® platform, for the EU AI Act, ISO/IEC 42001, POPIA and GDPR.
Do we need the EU AI Act if we are in South Africa?
If you offer AI outputs into the EU, or serve EU customers, it can apply. XGRC® helps you decide whether it applies to each system and records why, so the answer is defensible later.
Does XGRC certify us for ISO/IEC 42001?
No tool certifies you; only an accredited certification body can. XGRC® gives you the AI management system, the evidence and the Statement of Applicability an auditor looks for.
Can we use our own AI policies?
Yes. Upload your AI policy and map its requirements alongside the standards, so one control can satisfy your policy and the regulations at the same time.
Is the framework content kept up to date automatically?
XGRC® includes starter content for ISO/IEC 42001, the EU AI Act, GDPR and POPIA. Your team adopts it and maintains its own copy, and every published version is recorded with what changed, why, by whom and which records need updating.
How is this different from MAIA®?
MAIA® is governed AI you use inside XGRC®, an AI copilot with a full interaction audit trail. AI Governance governs every AI system your organisation builds or uses, including MAIA®, third-party models and in-house builds. MAIA® is itself one more AI system that goes through the same classification, risk and compliance process.
Does XGRC replace our AI register?
No. Your AI register stays the source of truth for what AI exists. XGRC® connects to it and attaches governance on top: classification, compliance, impact, risk, controls, oversight, incidents and change. If you have no register, systems can be recorded in XGRC® directly.
What happens if an AI system changes after it was classified?
Change Governance judges the change in governance terms. A new capability, for example, forces a legal re-classification within 7 days and an impact reassessment within 21 days; a model replacement forces risk, compliance, control re-testing, oversight and classification reviews. The 39 rules are editable, and a person decides every outcome.
Do we need a separate risk register for AI?
No. AI risk uses the same risk discipline you already run in XGRC®, pointed at 12 AI failure categories such as bias, fabrication, data leakage, performance drift and security or adversarial attacks. A legally prohibited use can never be accepted as a risk.
Know your AI. Prove it is under control.
See every AI system, its EU AI Act position and its evidence in one place, inside the platform you already trust.
Book an AI Governance demo