Scope
A support chatbot and a model that prices health insurance face different obligations. Working out which controls fit which system is slow, manual work.
Mitigation
A review finds a risk and adds it to a spreadsheet. Whether the fix was made goes unchecked.
Audit
Test results, policies and sign-offs sit in shared drives and chat threads until someone chases them before an audit.
Each risk is scored before treatment and again after it.
Why it matters
Compliance with AI rules isn’t a one-time sign-off. For a high-risk system, the EU AI Act treats risk management as a process that runs for the system’s whole life, with regular review.1 Its provider must keep the technical documentation for ten years after launch.2 Once those rules apply, from December 2027, breaking them can cost up to 15 million euros or 3% of worldwide annual turnover.3 The record has to keep pace with the work.
What is AI risk and compliance management?
AI risk and compliance management is the work of checking AI systems against the laws and standards they fall under, treating their risks, and keeping evidence that the work was done. It turns frameworks like the EU AI Act into tasks with owners and deadlines.
Which frameworks does Enzai cover?
Enzai runs assessments against the EU AI Act, ISO 42001 and NIST AI RMF. You can also build your own, such as an internal AI policy, with its own controls and classifications.
Does using Enzai make us compliant?
Enzai does the organizing: assessments, risks and evidence in one place, with your reviewers approving the work. Whether you meet a law or pass an audit is for your auditors and regulators to decide.
What counts as evidence?
It depends on the control: a completed form, a document, or metrics recorded on a system or its models, which fill in automatically. For risks, evidence is the links, notes or files that show a mitigation is done.
How are risks scored?
Each risk is scored by impact and likelihood, before and after treatment, so you can see what a mitigation changed. The register shows both, side by side.
What happens when a framework changes?
The assessment shows a new version is out, and you switch when ready. Keep your existing responses or start from scratch, and new or updated controls are marked.
