Are the documents written by a language model?

Not on the hosted service. Documents are assembled from your records by a deterministic template engine: the same data produces the same draft, and gaps appear as clearly marked items to complete. No language-model provider is used on the hosted service today, as the subprocessors page states. The software does contain optional AI assistance that a self-hosted customer can enable with their own provider key. It can draft questionnaire answers, classify an unrecognised app from its name and public domain, tailor remediation steps and reword the explanation of why a regulation applies; these features never receive employee activity data: no usage events, employees, devices or seat lists. Separately, a configured model can refine the wording of a document draft; names, email addresses and device counts are replaced with placeholders before the draft is sent and restored afterwards. In every case the output is checked, a failure falls back to the rule-based result, and a person approves before anything is final.

Can we edit a generated document?

Yes. Generated documents are drafts that you edit, send for review and approve. Each edit creates a new version.

Do these replace legal review?

No. They give counsel a complete, specific draft to review, which is faster than starting from a blank page or a generic template.

The documents auditors ask for, written from your own records.

GhostAudit generates 17 governance documents from your inventory, assessments and controls. They name your systems, your owners and your gaps, then go through review and approval before anything is final.

Start 14-day trial

Example workspace. Names and figures are illustrative.

Algorithmic Impact Assessment

Candidate screening

3. Intended purpose and affected people

The system ranks applicants for customer-support roles against the posted job requirements. A recruiter reviews every ranked list before any candidate is contacted; no application is rejected without human review.

Generated from inventory record, assessment and controls · v3

Status

Approved

Approved by

M. Okafor

6 Nov 2026, after review

PDFWord

01Templates

Sixteen templates, each tied to the rules that call for it.

A policy template downloaded from the internet describes a generic company. An auditor wants to see yours: which systems are approved, who owns them, what data they may handle, where the gaps are.

Each GhostAudit template is filled from your workspace. The acceptable use policy lists your approved systems with their conditions of use. The inventory report is your register. The impact assessment is about one named system and the people it affects. Where a document needs a fact that your records do not hold, it says so and marks the place for you to complete, instead of inventing something plausible.

Templates state their regulatory basis, so a reader can see which article or control each document answers.

AI acceptable use policy
Governance and policy · whole organization
Organization-wide rules for selecting and using AI: approved systems, data handling, prohibited uses, risk-tier controls, training and enforcement.
Basis: EU AI Act Art. 4, 5, 50; NIST AI RMF GOVERN 1-2; ISO/IEC 42001 A.2, A.9
AI system inventory report
Inventory and reporting · whole organization
Complete register of AI systems with risk distribution, data sensitivity, owners, control coverage, review schedule and vendor concentration.
Basis: NIST AI RMF GOVERN 1, MAP 1-2; ISO/IEC 42001 A.4; EU AI Act Art. 26
Algorithmic impact assessment
Risk and impact · one system
Per-system assessment of impacts on individuals and groups: fairness, privacy, transparency, oversight, safety; applicability screening (FRIA, DPIA, ADMT laws) and mitigation plan.
Basis: EU AI Act Art. 27; GDPR Art. 35; ISO/IEC 42001 6.1.4, A.5; NIST AI RMF MAP 5; Colorado SB 26-189; CCPA ADMT
AI risk assessment
Risk and impact · one system
Per-system risk register with likelihood x impact scoring, existing controls, residual risk and dated treatment plan.
Basis: NIST AI RMF MAP 4, MEASURE 1-3, MANAGE 1; NIST AI 600-1; ISO/IEC 42001 6.1.2; EU AI Act Art. 26
AI system card
System documentation · one system
Model / AI system card: intended and out-of-scope uses, model and data, evaluation, limitations, oversight, monitoring and change log.
Basis: ISO/IEC 42001 A.6.2.7, A.8.2; NIST AI RMF MAP 2-3, MEASURE 2; EU AI Act Art. 26
Third-party AI vendor assessment
Third-party risk · one system
Due-diligence assessment of an AI vendor across all its services in use: criticality, evidence requests, contract clauses and monitoring.
Basis: ISO/IEC 42001 A.10; NIST AI RMF GOVERN 6, MANAGE 3; EU AI Act Art. 26
AI incident response plan
Operations · whole organization
Severity model, roles, systems in scope with response priority and forensic readiness, response phases, notification obligations and playbooks.
Basis: EU AI Act Art. 73, 26(5); GDPR Art. 33; ISO/IEC 42001 A.8.4; NIST AI RMF MANAGE 4
Board AI risk report
Inventory and reporting · whole organization
Board-level summary: posture rating, key metrics, top risks, programme status, regulatory horizon, decisions requested and 90-day plan.
Basis: NIST AI RMF GOVERN 2; ISO/IEC 42001 cl. 5, 9.3; EU AI Act timeline; Colorado SB 26-189; CCPA ADMT
NIST AI RMF gap analysis
Framework alignment · whole organization
Evidence-based rating of all 19 NIST AI RMF categories across GOVERN, MAP, MEASURE and MANAGE with a prioritised remediation plan.
Basis: NIST AI 100-1; NIST AI 600-1
ISO/IEC 42001 statement of applicability
Framework alignment · whole organization
Summary SoA covering all 38 Annex A controls with applicability, justification, implementation status and evidence.
Basis: ISO/IEC 42001:2023 cl. 6.1.3, Annex A
EU AI Act Article 50 transparency notice
Transparency and disclosure · selected systems
Article 50 applicability by system plus approved wording for AI-interaction, AI-generated content, deep-fake and public-interest text disclosures.
Basis: EU AI Act Art. 50 (from 2 Aug 2026); Regulation (EU) 2026/1744
Consumer automated-decision disclosure
Transparency and disclosure · one system
Consumer pre-use notice, rights statement and adverse-outcome letter for an AI system supporting consequential decisions, with a compliance checklist.
Basis: Colorado SB 26-189 (eff. 1 Jan 2027); California CCPA ADMT regulations; GDPR Art. 22
Employee AI monitoring notice
Workforce and employee notices · whole organization
Written notice to employees that AI tool use on company devices and browsers is monitored: what is and is not collected, identity mode, purpose, retention, access, rights and an acknowledgment block, with employer notes for New York, Connecticut, Delaware and GDPR / UK GDPR. Template, not legal advice.
Basis: NY Civil Rights Law s. 52-c; Conn. Gen. Stat. s. 31-48d (PA 26-73); Del. Code tit. 19 s. 705; GDPR / UK GDPR Art. 6, 13, 35
Works council / employee representative briefing
Workforce and employee notices · whole organization
Factual briefing pack for employee representatives: what AI usage monitoring can and cannot observe, the current configuration, settings that limit monitoring, proposed safeguards and points for a works agreement. Template, not legal advice.
Basis: BetrVG s. 87(1) no. 6 (Germany); Code du travail art. L2312-38 (France); GDPR Art. 6, 13, 35
AI governance fact sheet
Third-party risk · whole organization
One page to attach to a customer's security questionnaire: how the organization governs AI, with its inventory, policies, assessments, controls and monitoring, taken from your records.
Basis: NIST AI RMF GOVERN 1, GOVERN 6; ISO/IEC 42001 A.8, A.10
Remediation plan
Risk and impact · selected systems
Open gaps from completed assessments for the selected systems (all systems by default), each with 2 to 4 next steps, owner and due date.
Basis: NIST AI RMF MANAGE 1; ISO/IEC 42001 10.2
AI incident report
Operations · whole organization
One incident from the incident register as a report: what happened, AI systems involved, containment and corrective actions with owners and due dates, notification obligations considered, lessons learned and the timeline.
Basis: ISO/IEC 42001 A.8.4, 10.2; NIST AI RMF MANAGE 4; EU AI Act Art. 73, 26(5)

02Workflow

Draft, review, approve. Every version kept.

A generated document is a draft. It moves through review to approval, or back with a rejection and a reason, and each step records who did it and when. Edits create versions, and earlier versions stay available.

Approved documents carry a review date according to their type; an acceptable use policy is due for review after a year. Documents export to PDF and Word for the people who need them outside GhostAudit.

Review, approve or reject, with the reviewer recorded
Version history for every document
PDF and Word export
You can also upload documents you already have, so the record is in one place

Example workspace. Names and figures are illustrative.

Audit log

Newest first

09:42M. Okafor approved Algorithmic Impact Assessment v3
09:15J. Lindqvist set status Unsanctioned on Cursor
FriR. Patel marked Met EU AI Act Art. 14 · Candidate screening
FriS. Brandt generated AI Acceptable Use Policy v1

03Transparency

Notices for the people your AI affects.

Two templates produce text that is meant to be published, not filed.

The EU AI Act Article 50 transparency notice works out which of your systems Article 50 applies to and gives wording for each case: telling people they are interacting with AI, marking AI-generated content, and disclosing deepfakes. Article 50 has applied since 2 August 2026.

The consumer automated-decision disclosure produces a pre-use notice, a statement of rights and an adverse-outcome letter for a system that supports consequential decisions. It is built for Colorado SB 26-189, whose core obligations apply from 1 January 2027, and California's automated decision-making regulations.

Both should be reviewed by counsel before they are used. They are a well-structured first draft built on your facts.

EU AI Act Article 50 transparency notice
Transparency and disclosure · selected systems
Article 50 applicability by system plus approved wording for AI-interaction, AI-generated content, deep-fake and public-interest text disclosures.
Basis: EU AI Act Art. 50 (from 2 Aug 2026); Regulation (EU) 2026/1744
Consumer automated-decision disclosure
Transparency and disclosure · one system
Consumer pre-use notice, rights statement and adverse-outcome letter for an AI system supporting consequential decisions, with a compliance checklist.
Basis: Colorado SB 26-189 (eff. 1 Jan 2027); California CCPA ADMT regulations; GDPR Art. 22

04Workforce

The notice employees get, and the briefing their representatives get.

Monitoring AI use at work is itself something you have to tell people about. Two templates cover that, and both are filled from your actual sensor settings, so the document describes the monitoring you have configured and not monitoring in general.

The employee AI monitoring notice states what is recorded and what never is, the identity mode in effect, whether warnings or blocking are on, how long records are kept, who can see them, and what rights employees have. It ends with an acknowledgment block. A second part, for the employer only, summarises the notice laws of New York, Connecticut and Delaware and the GDPR points to settle before rollout. Our guide explains those three statutes.

The works council briefing is written for employee representatives in countries where they must be informed, consulted or asked to agree, with the German and French provisions cited.

Both are templates and not legal advice, and both mark the decisions that are yours to make.

Employee AI monitoring notice
Workforce and employee notices · whole organization
Written notice to employees that AI tool use on company devices and browsers is monitored: what is and is not collected, identity mode, purpose, retention, access, rights and an acknowledgment block, with employer notes for New York, Connecticut, Delaware and GDPR / UK GDPR. Template, not legal advice.
Basis: NY Civil Rights Law s. 52-c; Conn. Gen. Stat. s. 31-48d (PA 26-73); Del. Code tit. 19 s. 705; GDPR / UK GDPR Art. 6, 13, 35
Works council / employee representative briefing
Workforce and employee notices · whole organization
Factual briefing pack for employee representatives: what AI usage monitoring can and cannot observe, the current configuration, settings that limit monitoring, proposed safeguards and points for a works agreement. Template, not legal advice.
Basis: BetrVG s. 87(1) no. 6 (Germany); Code du travail art. L2312-38 (France); GDPR Art. 6, 13, 35

05Reporting

A board report that is two clicks from the data.

The board AI risk report summarises posture, key metrics, top risks, programme status, the regulatory horizon and the decisions you need from the board, with a 90-day plan. It is assembled from the same records as everything else, so the numbers in it match the numbers in the product on the day it was generated.

The NIST AI RMF gap analysis rates all 19 categories across the four functions against your evidence. The ISO/IEC 42001 statement of applicability covers all 38 Annex A controls with applicability, justification and status.

Specification

All templates

AI acceptable use policy: Organization-wide rules for selecting and using AI: approved systems, data handling, prohibited uses, risk-tier controls, training and enforcement. Uses: ai inventory, risk tiers, data classifications, system owners, control gaps.
AI system inventory report: Complete register of AI systems with risk distribution, data sensitivity, owners, control coverage, review schedule and vendor concentration. Uses: ai inventory, controls, assessments, review dates, vendors.
Algorithmic impact assessment: Per-system assessment of impacts on individuals and groups: fairness, privacy, transparency, oversight, safety; applicability screening (FRIA, DPIA, ADMT laws) and mitigation plan. Uses: selected ai system, controls, data classification, organization industry.
AI risk assessment: Per-system risk register with likelihood x impact scoring, existing controls, residual risk and dated treatment plan. Uses: selected ai system, risk score, controls, assessment history.
AI system card: Model / AI system card: intended and out-of-scope uses, model and data, evaluation, limitations, oversight, monitoring and change log. Uses: selected ai system, controls, audit trail.
Third-party AI vendor assessment: Due-diligence assessment of an AI vendor across all its services in use: criticality, evidence requests, contract clauses and monitoring. Uses: selected ai system and all systems from the same vendor, data shared, users, control gaps.
AI incident response plan: Severity model, roles, systems in scope with response priority and forensic readiness, response phases, notification obligations and playbooks. Uses: ai inventory, risk tiers, audit logging coverage, owners.
Board AI risk report: Board-level summary: posture rating, key metrics, top risks, programme status, regulatory horizon, decisions requested and 90-day plan. Uses: inventory metrics, control coverage, assessments, approved documents.
NIST AI RMF gap analysis: Evidence-based rating of all 19 NIST AI RMF categories across GOVERN, MAP, MEASURE and MANAGE with a prioritised remediation plan. Uses: inventory, controls, assessments, approved documents, audit trail.
ISO/IEC 42001 statement of applicability: Summary SoA covering all 38 Annex A controls with applicability, justification, implementation status and evidence. Uses: inventory, control coverage, generated governance documents.
EU AI Act Article 50 transparency notice: Article 50 applicability by system plus approved wording for AI-interaction, AI-generated content, deep-fake and public-interest text disclosures. Uses: selected ai systems (defaults to generative / interactive systems).
Consumer automated-decision disclosure: Consumer pre-use notice, rights statement and adverse-outcome letter for an AI system supporting consequential decisions, with a compliance checklist. Uses: selected ai system, oversight, bias monitoring and logging controls.
Employee AI monitoring notice: Written notice to employees that AI tool use on company devices and browsers is monitored: what is and is not collected, identity mode, purpose, retention, access, rights and an acknowledgment block, with employer notes for New York, Connecticut, Delaware and GDPR / UK GDPR. Template, not legal advice. Uses: fleet settings (identity mode, warnings, blocking), enrolled sensors, in-product employee notice, ghostaudit user accounts.
Works council / employee representative briefing: Factual briefing pack for employee representatives: what AI usage monitoring can and cannot observe, the current configuration, settings that limit monitoring, proposed safeguards and points for a works agreement. Template, not legal advice. Uses: fleet settings (identity mode, warnings, blocking), enrolled sensors, ai tool catalog, ghostaudit user accounts.
AI governance fact sheet: One page to attach to a customer's security questionnaire: how the organization governs AI, with its inventory, policies, assessments, controls and monitoring, taken from your records. Uses: ai inventory, approved documents, assessments, control coverage, monitoring settings.
Remediation plan: Open gaps from completed assessments for the selected systems (all systems by default), each with 2 to 4 next steps, owner and due date. Uses: assessments and responses, remediation plans, owners and due dates, framework control library.
AI incident report: One incident from the incident register as a report: what happened, AI systems involved, containment and corrective actions with owners and due dates, notification obligations considered, lessons learned and the timeline. Uses: incident register, incident actions and timeline.
Plans: Document generation is part of Govern and Enterprise. See pricing.

FAQ

Questions

Are the documents written by a language model?: Not on the hosted service. Documents are assembled from your records by a deterministic template engine: the same data produces the same draft, and gaps appear as clearly marked items to complete. No language-model provider is used on the hosted service today, as the subprocessors page states. The software does contain optional AI assistance that a self-hosted customer can enable with their own provider key. It can draft questionnaire answers, classify an unrecognised app from its name and public domain, tailor remediation steps and reword the explanation of why a regulation applies; these features never receive employee activity data: no usage events, employees, devices or seat lists. Separately, a configured model can refine the wording of a document draft; names, email addresses and device counts are replaced with placeholders before the draft is sent and restored afterwards. In every case the output is checked, a failure falls back to the rule-based result, and a person approves before anything is final.
Can we edit a generated document?: Yes. Generated documents are drafts that you edit, send for review and approve. Each edit creates a new version.
Do these replace legal review?: No. They give counsel a complete, specific draft to review, which is faster than starting from a blank page or a generic template.

See what is in use before you decide anything.

Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.

Start 14-day trial Talk to us See pricing