VERITRAIL is built as six modules that share one control library, one inventory and one evidence store. You can start with the module that addresses your most pressing gap and add the rest as your programme matures — every module cites the same 64 controls and writes to the same tamper-evident audit trail.
| Module | Core message | Primary buyers | Key controls |
|---|---|---|---|
| VERITRAIL Assess | Know where you stand, with evidence labels on every finding | Chief Risk Officer, AI Governance Lead, consultants | GL-02, EI-02, AO-04 |
| VERITRAIL Register | One owned, classified system of record for every AI system and agent | CIO office, AI CoE, CISO | EI-01, EI-03, EI-07 |
| VERITRAIL Control | Risk-proportionate gates from intake to retirement | AI CoE, Risk, Compliance | GL-01, GL-03, GL-04 |
| VERITRAIL Shield | Runtime guardrails for LLM apps and agents, with human approval for high-impact actions | CISO, Platform Engineering | IS-11, IS-12, IS-13 |
| VERITRAIL Assurance | Control testing, incidents and audit-ready evidence packs | Second line, Internal Audit, Compliance | SE-01, SE-05, SE-08 |
| VERITRAIL Agent | A governance copilot that cites controls and labels evidence | AI Governance Lead, consultants, CoE | All pillars |
How the modules connect
- Assess establishes the baseline and identifies which gaps matter most.
- Register creates the inventory every other module depends on — you cannot gate, protect or evidence what is not registered.
- Control routes new use cases and material changes through risk-tiered workflows that produce evidence by default.
- Shield enforces the conditions of approval at runtime: tool permissions, redaction, limits and approvals.
- Assurance tests that all of the above works and packages the evidence.
- Agent sits across the modules, drafting assessments, gap registers and reports for human review.
Where most organizations start
| If your most urgent problem is… | Start with | Then add |
|---|---|---|
| "We don't know what AI we have" | Register + Assess | Control |
| "A regulator, customer or auditor is asking questions" | Assess + Assurance | Register |
| "We are deploying agents with tool access" | Shield + Register (agent and tool registry) | Control |
| "Approvals are inconsistent and slow" | Control | Assurance |
| "Our team is stretched and needs leverage" | Agent | Assess |
How VERITRAIL is delivered
VERITRAIL combines software with an initial structured engagement. The Governance Baseline is the usual entry point: in 4–6 weeks it inventories up to 25 AI systems, validates your maturity assessment with evidence, deep-dives five priority systems, reviews two agents, and leaves you with a gap register, remediation roadmap, runtime policy drafts, executive report and 90-day plan.
We are currently running a design-partner programme with a small number of organizations to shape the product. We do not yet publish customer results; see case studies for why.
What VERITRAIL does not do
- It does not certify your organization or systems against any standard or law.
- It does not make legal determinations, such as whether a system is "high-risk" under the EU AI Act — it gives you the structured evidence your legal team needs to decide.
- It does not take high-impact actions on its own. Changing risk tiers, approving exceptions, changing production runtime policy, exporting sensitive evidence and sending external communications always require human approval.