Govern the AI your business already depends on
Your teams are using AI. Your customers are starting to ask what governs it. Greypike AI GRC turns NIST AI RMF and ISO/IEC 42001 into assigned work, connects to the AI systems you actually run, and puts a compliance analyst behind the answers.
AI GRC runs in its own module with its own connectors into your AI stack. It's sold separately from the Greypike Compliance App and stands on its own.
AI arrived before the governance did
Nobody ran a procurement process for most of the AI in your business. It came in through a browser tab, a vendor's product update, or an engineer trying something. Most teams can name three. Try the scan.
Eight of these nobody bought. They arrived inside products you already pay for, switched on by a vendor release note. Every one of them is in scope.
They don't carry the same risk
Resume ranking decides who gets hired. Copy generation writes a subject line. Treating them the same means either governing everything to the strictest standard or governing none of it — and most organizations quietly pick the second.
The questionnaires have started
Enterprise security reviews now ask how you govern AI, what data it touches, and who reviews its output. "We're working on it" is increasingly the sentence that loses the deal.
Writing an AI policy takes an afternoon. Keeping the inventory current, classifying each system by risk, evidencing the controls, and being able to show your work when a customer asks — that's an ongoing program. It's the problem Greypike already solves, pointed at a different set of obligations.
How AI GRC is delivered
The same model as the rest of Greypike — obligations become assigned work, and a compliance analyst reviews it. What changes is what's being governed, and what the module connects to.
Discover the AI you're actually running
The module connects into your AI stack and builds an inventory — the assistants, models and embedded features in tools you already pay for. Most organizations are surprised by the length of the list.
Classify each system by risk
A resume screener and a copy generator carry different obligations. Each system is classified, scoped, and mapped to the requirements that apply to it — with a practitioner confirming the call rather than a model guessing.
Do the work as tasks
Requirements become tasks with owners, instructions, evidence and acceptance criteria — impact assessments, data governance, human oversight, monitoring, incident handling. The same task format used everywhere else in Greypike.
Answer the question when it's asked
When a customer questionnaire, an insurer or an auditor asks how you govern AI, the inventory, the classifications and the evidence are already there — current, dated, and reviewed by a named analyst.
Two frameworks, one program
NIST AI RMF gives you the risk model. ISO/IEC 42001 gives you a management system you can be certified against. Which one you need depends entirely on who's asking — so tell us who, and we'll tell you which.
WHAT'S DRIVING THIS FOR YOU?
NIST AI RMF 1.0
Voluntary risk framework — the common language for AI riskOrganized around four functions. Greypike turns each into assigned work against the specific systems in your inventory.
Best for showing a credible posture to customers and insurers, fast.
How we run NIST AI RMFISO/IEC 42001
Certifiable AI management system standardA management system you can be audited and certified against — the AI equivalent of what ISO 27001 is for information security.
Best for organizations that need a certificate, not just a posture.
How we run ISO 42001Who needs this now
AI governance stops being optional at the point somebody external asks about it. For most organizations that has already happened.
Companies selling AI-enabled products
If your product uses AI, enterprise security reviews now include AI questions. ISO 42001 is becoming the answer buyers want, the way SOC 2 became the answer for security.
Anyone using AI in hiring or lending
Decisions about people carry the heaviest obligations and the most regulatory attention. These systems need classification, documented oversight and evidence — not an acceptable-use policy.
Regulated industries adopting AI
Healthcare, financial services and government suppliers are adopting AI into environments that already carry obligations. Your existing regulator will ask how the new tooling is governed.
Organizations that have lost track
If nobody can produce a current list of the AI running in your business, start with the inventory. Everything else in an AI program depends on knowing what's in scope.
Frequently asked questions
Something not covered here? Ask us directly — a compliance analyst answers, not a support queue.
Is this part of the Greypike Compliance App?
No. AI GRC is a separate product in its own module, with its own connectors into your AI stack and its own frameworks. It's sold separately from the Compliance App and doesn't require it. It's also still in development — early access customers get in before general availability.
Do we need NIST AI RMF, ISO 42001, or both?
It depends on what you're being asked for. AI RMF establishes a credible risk posture and is usually enough for customer questionnaires and insurers. ISO/IEC 42001 is certifiable, so it's the answer when a buyer or regulator wants a certificate. The work overlaps heavily, so starting with one doesn't waste effort on the other.
We don't build AI, we just use it. Does this apply?
Yes, and that's the more common case. Obligations attach to deploying and using AI systems, not only to building them — including the AI embedded in products you already license. Most of what a customer questionnaire asks about is use, not development.
Is a compliance analyst included here too?
Yes. Risk classification and scoping are judgment calls with real consequences, so a practitioner confirms them rather than a model. The same review model applies as everywhere else at Greypike: software does the volume, people own the decisions.
Find out what AI you're actually running
Start with the inventory. We'll show you where the module stands today, what it finds against your own stack, and which framework the answer needs to be. AI GRC is in development — early access customers help decide what ships first.
