Assess each system at the level an auditor reads. Article by article.
A score out of 100 does not survive an audit. GhostAudit assessments work on individual articles and controls: each has a response, the evidence for it, and a plan when there is a gap.
Example workspace. Names and figures are illustrative.
| Art. 9 | Risk management systemRisk register v4 | Risk register v4 | Met |
| Art. 10 | Data and data governanceRemediation planned | Remediation planned | Partial |
| Art. 12 | Record-keeping and logsJira GOV-212 | Jira GOV-212 | Gap |
| Art. 13 | Transparency to deployersVendor documentation | Vendor documentation | Met |
| Art. 14 | Human oversightRecruiter review step | Recruiter review step | Met |
| Art. 26 | Deployer obligationsRemediation planned | Remediation planned | Partial |
- Frameworks
- 6 built in
- Requirements
- 56 across them
- Unit of work
- One system, one framework
- Gaps
- Suggested next steps, plan, Jira ticket
Six frameworks, broken into the requirements that matter for AI.
GhostAudit ships with a requirement library for six frameworks. Each requirement carries its reference, such as Art. 14 or MEASURE 2, a plain statement of what is expected, and whether it is mandatory.
- EU AI Act (Regulation (EU) 2024/1689): AI literacy, prohibited practices, the high-risk requirements in Articles 9 to 15, deployer obligations in Article 26, fundamental rights impact assessment and Article 50 transparency.
- NIST AI RMF 1.0: categories across Govern, Map, Measure and Manage.
- ISO/IEC 42001:2023: management-system clauses and Annex A control areas.
- SOC 2: the Trust Services Criteria that bear on AI systems processing customer data.
- NYC Local Law 144: bias audit, publication and notice duties for automated employment decision tools.
- Colorado ADMT Act (SB 26-189): notice, explanation, correction and human-review duties for automated decisions, applying from 1 January 2027.
The library is a working selection for assessing AI systems, not a reproduction of each standard. Where a framework's full text is licensed, as with ISO standards, you will still need your own copy.
| Framework | Requirements | |
|---|---|---|
| EU AI Act | Regulation (EU) 2024/1689 | 12 |
| NIST AI Risk Management Framework | AI RMF 1.0 | 12 |
| ISO/IEC 42001 | 2023 | 11 |
| SOC 2 (AI-relevant criteria) | 2017 TSC (rev. 2022) | 7 |
| NYC Local Law 144 (AEDT) | 2023 | 5 |
| Colorado ADMT Act (SB 26-189) | C.R.S. 6-1-1701 to 6-1-1709 (effective 1 Jan 2027) | 9 |
Answer, attach evidence, plan the fix.
An assessment pairs one system from your inventory with one framework. For each requirement you record whether it is met, partially met or a gap, describe the evidence, and, for anything short of met, write the remediation plan.
Progress is visible as you go: how many requirements are met, partial and open. When the assessment is submitted it becomes part of the system's record and its history. You can export it for an auditor.
Gaps do not have to stay inside GhostAudit. With Jira connected, a gap opens a ticket in the project you choose, and the assessment keeps the link.
- Met, partial or gap per requirement, with notes and evidence
- Remediation plan per gap, and optional Jira ticket
- Exportable for auditors; changes recorded in the audit log
Example workspace. Names and figures are illustrative.
- 09:42M. Okafor approved Algorithmic Impact Assessment v3
- 09:15J. Lindqvist set status Unsanctioned on Cursor
- FriR. Patel marked Met EU AI Act Art. 14 · Candidate screening
- FriS. Brandt generated AI Acceptable Use Policy v1
A gap comes with a suggestion for what to do about it.
Knowing that Article 12 is a gap is the easy part. The harder question is what to do on Monday.
For every requirement marked partial or a gap, the assessment shows suggested next steps: two to four concrete actions, such as switching on event logging, setting a retention period and testing that a past decision can be traced. For the built-in frameworks they come from a remediation library written for each control. For a framework you defined yourself, they come from the guidance you entered for the control, or from general steps for that kind of control.
The suggestions are a starting point for your own plan. They do not change the score, and nothing is recorded as done until you record it. From there you can send the steps you choose to Jira as one ticket for the gap, or generate a remediation plan document that lists the open gaps across your systems with their next steps, owner and due date.
On the hosted service the steps come from the library. The product also has an optional AI mode that rewords them for the specific system; it is not enabled on the hosted service (see the questions below).
- Two to four actions per open control
- One Jira ticket per gap, with the steps you select
- A remediation plan document across systems
Example workspace. Names and figures are illustrative.
- 1Switch on the system’s event logging and confirm the logs capture inputs, outputs, the user and the time of each use.
- 2Set a retention period of at least six months, or longer where another law requires it, and restrict who can alter or delete logs.
- 3Test that a past decision can be traced from the logs end to end.
From this control’s own guidance.
Start with the systems where an assessment is actually due.
Not every system needs every framework. A writing assistant used by marketing and a ranking model used in hiring are different problems.
The regulation tracker tells you which obligations reach which systems and from what date, so the assessment queue can follow the calendar: hiring tools subject to NYC Local Law 144 today, automated decisions covered by Colorado SB 26-189 before 1 January 2027, Annex III systems under the EU AI Act before 2 December 2027.
For voluntary frameworks the logic is commercial. If enterprise customers ask about ISO/IEC 42001 or NIST AI RMF in security questionnaires, assess the systems those customers touch first.
Assessments feed the documents.
Completed assessments are inputs to document generation. The NIST AI RMF gap analysis and the ISO/IEC 42001 statement of applicability are built from them. Impact assessments and risk assessments pull the system's assessment results in alongside its inventory record.
That keeps the paperwork consistent with the work: the document says what the assessment found, because it was written from it.
Example workspace. Names and figures are illustrative.
The system ranks applicants for customer-support roles against the posted job requirements. A recruiter reviews every ranked list before any candidate is contacted; no application is rejected without human review.
Requirement library
Counts are the requirements built into the product today.
- EU AI Act
- Regulation (EU) 2024/1689. 12 requirements: Art.4, Art.5, Art.9, Art.10, Art.11, Art.12, Art.13, Art.14, Art.15, Art.26, Art.27, Art.50.
- NIST AI Risk Management Framework
- AI RMF 1.0. 12 requirements: GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 6, MAP 1, MAP 3, MAP 5, MEASURE 1, MEASURE 2, MEASURE 3, MANAGE 1, MANAGE 4.
- ISO/IEC 42001
- 2023. 11 requirements: 4.1, 5.2, 6.1.2, 6.1.4, 9.2, A.2, A.3, A.6, A.7, A.8, A.10.
- SOC 2 (AI-relevant criteria)
- 2017 TSC (rev. 2022). 7 requirements: CC1.1, CC3.2, CC6.1, CC7.2, CC8.1, CC9.2, P4.1.
- NYC Local Law 144 (AEDT)
- 2023. 5 requirements: §20-871(a)(1), §20-871(a)(2), §20-871(b)(1), §20-871(b)(2), §20-871(b)(3).
- Colorado ADMT Act (SB 26-189)
- C.R.S. 6-1-1701 to 6-1-1709 (effective 1 Jan 2027). 9 requirements: §6-1-1701, §6-1-1702, §6-1-1703, §6-1-1704(1), §6-1-1704(3), §6-1-1704(8), §6-1-1705(1)(a)(I), §6-1-1705(1)(a)(II), §6-1-1706.
- Plans
- Assessments are part of Govern and Enterprise. See pricing.
Questions
- Does completing an assessment make us compliant?
No tool can make that promise. An assessment in GhostAudit is your organization's documented evaluation against a requirement, with evidence. Whether that satisfies a regulator or certifies against a standard is decided by the regulator or an accredited auditor.
- Can we add our own framework or controls?
Yes. Alongside the built-in frameworks you can define your own, by form or CSV import, or clone a built-in one as a starting point. Custom frameworks are scored the same way and appear in assessments and the compliance overview. Govern includes up to three; Enterprise has no limit.
- Are the suggested next steps written by a language model?
Not on the hosted service. They come from a built-in library of actions for each control. The product includes an optional AI mode that tailors the steps to the system and to your existing documents; it is off on the hosted service, where no language-model provider is used, and a self-hosted customer can enable it with their own API key. Scoring is rule-based in every case.
- Is SOC 2 here a SOC 2 audit?
No. It is a set of SOC 2 criteria applied to your AI systems, to help you prepare evidence. A SOC 2 report can only be issued by a licensed CPA firm.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.