1Discover
Find every AI system, including shadow AI
Build a live AI inventory of models, AI tools and AI agents across cloud providers, local runtimes and developer tools, with an owner for every system.
AI governanceYou can't govern AI you don't know exists
The AI governance platform for every AI system and agent.
ReguLattice is an AI-native governance platform that helps organizations discover, assess, govern, monitor, and improve AI systems and AI agents. It finds shadow AI, keeps people in charge of high-risk AI decisions, and maintains live, audit-ready evidence mapped to ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
ISO/IEC 42001 · NIST AI RMF · EU AI Act · Runs on your own infrastructure
app.regulattice.com/governance
LIVEAI assets discovered
0
Shadow AI flagged
0
Controls verified
0%
Open risks
0
Compliance postureupdated 5s ago
92%
88%
95%
Flight Recorderstream · 5s
- WARNollama/llama3Prompt drift +12% vs. baseline
- HALLUCINATION_FLAGsupport-botAnswer contradicts policy KB §4.2
- INFOgemini-1.5-proEgress check passed · PII redacted
- SECURITY_ALERTcursor-ideUnapproved model endpoint detected
- INFOclaude-codeAgent tool call: git.diff · policy OK
AI systemOwnerRisk tierStatus
gpt-4o · Customer SupportCX PlatformHigh● Verified
claude-code · EngineeringDev ProductivityLimited● Monitoring
llama3-70b · On-prem RAGData ScienceHigh● In Review
cursor-ide · Shadow AIUnassignedUnknown● Flagged
Illustrative product view with sample data.
Governs AI across your entire stack
OpenAIAnthropic ClaudeGoogle GeminiClaude CodeCursorGitHub CopilotOllamaMistralDeepSeekvLLMWindsurfPerplexityCoherexAI GrokOpenAIAnthropic ClaudeGoogle GeminiClaude CodeCursorGitHub CopilotOllamaMistralDeepSeekvLLMWindsurfPerplexityCoherexAI Grok
4
Autonomous governance agents
Discover · Verify · Monitor · Remediate
2-pass
Evidence verification
Deterministic RAG + model consensus
5s
Telemetry granularity
Live Flight Recorder event stream
3
Frameworks mapped natively
EU AI Act · ISO/IEC 42001 · NIST AI RMF
How it works
How AI governance works in ReguLattice.
You can't govern AI you don't know exists. ReguLattice follows one continuous lifecycle: discover, assess, govern, monitor and improve.
- 2Assess
Understand AI risk
Classify each AI system's purpose, data and risk level, including EU AI Act risk categories, and see which controls apply.
- 3Govern
Apply policies and human oversight
Manage AI policies and controls mapped to ISO/IEC 42001, NIST AI RMF and the EU AI Act, with human sign-off for high-risk AI actions.
- 4Monitor
Watch AI at runtime
Track what AI systems and agents actually do after deployment, and keep compliance evidence current as it ages.
- 5Improve
Close the loop
Turn incidents, human overrides and audit findings into remediation tasks, stronger controls and audit-ready evidence.
New to the category? Read what an AI governance platform is and how to choose one.
The platform
Four AI governance agents. One platform.
Specialized agents for AI discovery, evidence verification, AI risk monitoring and remediation work together across your entire AI footprint, without slowing your engineers down.
Discovery Agent · live
OpenAI
Claude
Gemini
Ollama
Cursor · unapproved
Copilot
Use cases
AI governance use cases, from shadow AI to AI agents.
From unapproved AI tools to autonomous coding agents, ReguLattice turns every AI interaction into governed, verifiable evidence.
- ChatGPT Enterpriseapproved
- Claude Codeapproved
- Personal Gemini key shadow AI
- GitHub Copilotapproved
- Unknown local LLM :11434 shadow AI
Shadow AI detection
Find every model, API key, and AI tool in use — sanctioned or not — and route unapproved usage into review automatically.
$ claude "refactor billing service"
Agentic IDE governance
Govern coding agents like Claude Code, Cursor, and Copilot with tool-call telemetry and policy guardrails engineers don't feel.
support-bot · 30d+18% semantic drift
Prompt & model drift
Catch semantic drift before customers do, with thresholds mapped to your risk appetite.
Auto-remediation: rotate exposed key
ACompliance OfficerJ. Alvarezpending…
CAI Safety EngineerP. Chenpending…
awaiting 2 of 2 gates
Human-in-the-loop approvals
Dual sign-off gates keep high-risk remediations under accountable human control.
Art. 9 Risk management100%
Art. 14 Human oversight92%
Art. 72 Post-market84%
Audit pack exported · SHA-256 sealed
Audit-ready evidence
Every control backed by traceable, verified evidence — exportable for regulators in one click.
Architecture
From AI systems to audit-ready evidence.
Live model endpoints, agentic IDEs and evidence pipelines flow through one governance engine and come out as verified evidence mapped to your AI compliance frameworks.
Ecosystem inputs
Claude Code
Admin API telemetry
Cursor & Antigravity
Agentic IDEs
OpenAI · Anthropic · Gemini
Model endpoints
GitHub
Repos & REST API
ReguLattice
AI governance engine
DiscoveryDual-pass RAGFlight RecorderGated remediation
Verified outputs
EU AI Act Art. 9, 14 & 72
Audit-ready logs
ISO/IEC 42001
Control verification
Flight Recorder
5-second event stream
Human approvals
Multi-role gated sign-off
AI compliance frameworks
Mapped to ISO/IEC 42001, NIST AI RMF and the EU AI Act.
ReguLattice maps AI systems, telemetry events and developer tools to the controls and requirements of the major AI governance frameworks, so one piece of evidence can support several of them.
EU mandate
EU Artificial Intelligence Act
Art. 9 · Art. 14 · Art. 72
- Article 9 — Risk management systemContinuous risk identification and remediation pipeline.
- Article 14 — Human oversightTwo-stage approval override gates on all automated remediations.
- Article 72 — Post-market monitoringUnified Telemetry Flight Recorder capturing live model events.
EVIDENCE MAPPINGCONTROLS MAPPED
International standard
ISO/IEC 42001
AIMS control verification · Clause A.10 supplier controls
- A.2.2 / A.3.2Organizational AI policies & roles.
- A.6.2.6 / A.6.2.8Operational monitoring and event logging.
- A.7.2 / A.7.3Data provenance & egress boundaries.
- A.10.2 / A.10.3Third-party supplier and developer tool governance.
EVIDENCE MAPPINGCONTROLS MAPPED
US framework
NIST AI RMF 1.0
Govern · Map · Measure · Manage
- GOVERNInstitutional policies and AI tool adoption registries.
- MAPAI asset inventory and data exposure categorizations.
- MEASUREDual-pass semantic evidence evaluation.
- MANAGEGated autonomy risk remediation Kanban.
EVIDENCE MAPPINGCONTROLS MAPPED
Integrations
Govern AI across every model, everywhere it runs.
Connect live cloud models, local LLMs, code repositories, and IAM policy engines directly to your governance plane — public cloud, private VPC, or fully air-gapped.
01
Private & self-hosted models
- Private on-prem LLM clusters
- Self-hosted runtimes (vLLM, TGI)
- Fine-tuned enterprise models
- Kubernetes & air-gapped weight repos
02
Local & open-source LLMs
- Ollama (Llama 3, Mistral, Qwen)
- DeepSeek-R1 & open weights
- Local workstation runtimes
- Edge & on-device AI deployments
03
Public LLMs & commercial APIs
- ChatGPT / OpenAI
- Anthropic Claude
- Google Gemini Pro & Ultra
- xAI Grok, Perplexity & Cohere
04
Developer AI & coding tools
- Cursor IDE & Windsurf
- Claude Code (Admin API telemetry)
- Antigravity agentic IDE
- GitHub Copilot & coding assistants
FAQ
AI governance, answered.
Straight answers about AI governance platforms, shadow AI, AI agents and the frameworks ReguLattice supports.
What is an AI governance platform?
+
An AI governance platform is software that gives an organization one place to see, assess and control the AI systems it builds, buys and uses. It typically covers an AI inventory, risk assessment, policies and controls, monitoring after deployment, and the evidence that auditors and regulators ask for. ReguLattice is an AI-native governance platform built around that full lifecycle: discover, assess, govern, monitor and improve.
Why do organizations need AI governance?
+
AI is adopted faster than it can be reviewed. Teams connect new models, AI tools and agents without approval, models change after deployment, and compliance evidence goes out of date. At the same time, regulations such as the EU AI Act, standards such as ISO/IEC 42001 and enterprise customers increasingly expect organizations to show how their AI is controlled. AI governance answers that with records rather than assumptions.
How is AI governance different from traditional GRC?
+
Traditional GRC tools manage policies, risks and controls for IT and business processes, usually through periodic assessments. AI governance adds what those tools were not designed for: discovering AI systems and agents, assessing AI-specific risks such as drift, bias and hallucination, monitoring behavior at runtime, and keeping people accountable for AI-driven decisions. ReguLattice focuses specifically on that AI layer.
How does ReguLattice discover shadow AI?
+
ReguLattice builds an AI inventory by connecting to the places where AI is used: model provider APIs such as OpenAI, Anthropic and Google Gemini, local runtimes such as Ollama, code repositories, and developer tools such as Claude Code and Cursor. AI that is in use but not registered or approved is flagged as shadow AI, so it can be given an owner, assessed and brought under policy.
How does ReguLattice govern AI agents?
+
ReguLattice records what AI agents do at runtime, including their tool calls, and checks actions against deterministic policy rules. High-risk actions can be held and routed to designated people for sign-off before they proceed, and every decision is logged together with its evidence so it can be reviewed later.
How does ReguLattice support ISO/IEC 42001?
+
ReguLattice maps AI inventory records, runtime telemetry and documents to ISO/IEC 42001 controls, verifies that each piece of evidence actually supports its control, and tracks how current the evidence is. This helps teams prepare for an ISO/IEC 42001 audit. ReguLattice does not certify organizations; certification is issued by accredited certification bodies.
Which AI frameworks and regulations does ReguLattice map to?
+
ReguLattice currently maps controls and evidence to ISO/IEC 42001, the NIST AI Risk Management Framework (AI RMF 1.0) and the EU AI Act. A single piece of evidence can be linked to matching requirements in more than one framework.
Can ReguLattice run on our own infrastructure?
+
Yes. ReguLattice is designed to be local-first. It can be deployed in your own environment and use locally hosted AI models, so governance data can stay inside your infrastructure. It can also connect to cloud AI providers.
Don't just document your AI governance. Prove it.
See how ReguLattice discovers your AI systems, assesses AI risk, keeps compliance evidence current and puts people in charge of high-risk AI decisions.