Risk committee
Each team rates AI risk its own way, so the spreadsheets don’t add up to a single picture.
Internal audit
Teams say the mitigations are done, and the proof is spread across inboxes and shared drives.
First line
The chatbot runs on a newer model now, and its rating still says medium.
How it works todayWhat it needs to be
- How it works today
AI filed as one entry under technology risk
What it needs to beEvery AI system tracked, with the risks it carries
- How it works today
Ratings refreshed once a year
What it needs to beReassessed when the model, the use or the vendor changes
- How it works today
The second line chasing the first for updates
What it needs to beFirst-line owners keeping their own records current
- How it works today
Evidence gathered in the weeks before audit
What it needs to beProof attached to controls as the work gets done
Is this one more platform my team has to feed?
It moves the updating to the people who run each system. Each control gets an owner and a due date, dashboards show what’s due soon and what’s overdue by AI product, and your team sets the frameworks and reviews the work instead of chasing updates by email.
Do we have to move AI risk out of our GRC platform?
No. Your GRC platform stays the record for enterprise risk. Enzai holds the AI detail beneath it: each system, its owner, assessments and risks, scored by impact and likelihood. Your team decides what to carry up, using Enzai’s reports, and can run its own control framework beside the EU AI Act and ISO 42001.
How much is automated, and how much still lands on my team?
Evidence from recorded metrics fills in on its own, and a system gets only the controls its classification calls for. The judgment stays with people: your reviewers score each risk and approve each control, and owners add proof that each mitigation was done. An assessment isn’t complete until every control is approved.
What data goes into Enzai, and what stays out?
Enzai holds the governance record: systems, owners, assessments, risks, decisions and the evidence your team attaches. Imports from cloud AI platforms bring in model records, not the data behind them. If you add AI discovery, it reports which AI tools are in use in aggregate, without naming people.
We’re early. Do we need a clean inventory before we start?
No. Start from the list you have. Add those systems, give each an owner, and run one framework against the few that carry the most risk. New AI then arrives through requests, so the record grows as people ask. Turn on AI discovery later to find the tools nobody listed.
Will the trail stand up when internal audit tests it?
It’s built to be sampled. Every request keeps who reviewed it, who approved it, under what conditions and when, and downloads as a report. Each risk shows its rating before and after treatment, with the mitigations and proof behind the change. Whether that satisfies audit is their call.
Where to start
