VERITRAILBook Governance Baseline

Tools

Ask VERITRAIL (limited demo)

Reviewed 21 October 2026

An assessment dashboard with a maturity gauge, sliders, a bar chart and a checklist.

Go to the tool

This is a limited public demo. It shows how the VERITRAIL Agent answers governance questions: with citations to VERITRAIL control IDs, clear evidence labels and an explicit statement when it has no supporting source.

Things to try

  • "What controls should we have before deploying an agent that can send emails?"
  • "How does VERITRAIL map human oversight to the EU AI Act?"
  • "What evidence demonstrates an AI inventory?"
  • "What is the difference between User-asserted and Verified?"
  • "Triage a customer-service chatbot that uses personal data and a vendor model."

What the demo will and will not do

Will Will not
Cite VERITRAIL control IDs for recommendations Access your systems, documents or data
Label suggested tiers as Inferred Make legal or compliance determinations
Say "No supporting evidence or framework source is available." when it has no source Take actions, send messages or change anything
Show indicative framework mappings with the mapping disclaimer Replace review by your own risk, legal and security teams

Limits of the demo

The demo is rate-limited and works only with public VERITRAIL content. Answers can be incomplete or wrong — review them before relying on anything, and treat every answer as a starting point for discussion with your own risk, legal and security teams. The full Agent works with your organization's inventory, assessments and evidence, inside your governance controls.

VERITRAIL controls cited

Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.

Loading the tool…

Frequently asked questions

What can the demo do?
It answers questions about the VERITRAIL Framework, the 64 controls, the maturity model and indicative framework mappings, and can run a simple use-case triage. It has no access to any organization's data and does not perform actions.
Is what I type stored?
Messages are processed to generate a response. Common sensitive-data patterns are redacted before any external model call or log write. Do not enter personal, confidential or secret information. See the privacy notice for details.

Last reviewed: