VERITRAIL exists because AI adoption has outrun the ability of most organizations to answer simple questions about it — what AI they run, who owns it, how risky it is, what stops an agent from doing harm, and whether they could prove any of it tomorrow.
We build software and structured services that help enterprises inventory AI, assess risk, govern the lifecycle, protect LLM applications and agents at runtime, and evidence responsible AI continuously.
What we believe
Evidence over assertion. A policy that nobody can show is followed is not a control. Every VERITRAIL finding carries an evidence label, and only evidence reviewed by a named person is Verified.
Proportionality. Governance should be light for low-risk AI and rigorous for high-risk AI. Risk tiers decide the path, and humans confirm the tiers.
Controls at the point of action. Agents act; some governance has to run at runtime. Policy-as-code, least privilege and human approval for high-impact actions are part of governance, not an add-on.
Humans decide. Our software drafts, suggests and enforces approved policy. Changing risk tiers, approving exceptions, changing production runtime policy, exporting sensitive evidence and sending external communications are human decisions.
Honesty about limits. We do not certify organizations, we do not determine legal compliance, and we do not publish results we cannot support. Our framework mappings are indicative and labelled as such. Our case studies page says plainly that pilots are still in progress.
What we build
- The VERITRAIL Framework — five pillars and a versioned library of 64 controls with owners, evidence requirements and indicative mappings. See the framework.
- Six modules — Assess, Register, Control, Shield, Assurance and the VERITRAIL Agent.
- The Governance Baseline — a fixed-scope 4–6 week engagement that establishes an evidenced starting point.
- Free tools — the maturity self-assessment, risk triage and guardrail generator.
Who we work with
CISOs, CIOs and CTOs, chief risk and compliance officers, AI CoE heads, engineering leads and the consultants who advise them — mainly in regulated industries and in organizations deploying AI agents at scale. We are currently working with a small group of design partners.
How we use AI ourselves
We hold our own product to the standard we recommend. Our Responsible AI statement explains how VERITRAIL uses AI, what safeguards apply and what we will not claim.
VERITRAIL controls cited
- AO-01 AI governance policyNIST AI RMF: GOVERN 1.1, GOVERN 1.2ISO/IEC 42001: 5.2, A.2.2, A.2.4EU AI Act: Art. 17, Art. 26
- IS-13 Human approval for high-impact actionsNIST AI RMF: GOVERN 3.2, MANAGE 2.2ISO/IEC 42001: A.9.2, A.6.2.6EU AI Act: Art. 14
- SE-08 Immutable action loggingNIST AI RMF: MEASURE 2.8, MANAGE 4.1ISO/IEC 42001: A.6.2.8EU AI Act: Art. 12, Art. 19, Art. 26
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.