Are you a data governance platform?

No, we are an AI governance platform. Data governance manages data quality, privacy, and lifecycle. AI governance addresses what makes AI systems different: model risk, algorithmic fairness, transparency, human oversight, and AI-specific regulation like the EU AI Act and ISO/IEC 42001. The two meet where your AI processes personal data, and Modulos maps those overlaps rather than replacing your data governance stack.

Do I need to send you my data?

No. The platform connects to your existing tools and repositories to gather evidence and metrics, and your models and training data stay where they are. For organizations with strict requirements, Modulos runs as SaaS, private cloud, or VPC deployment.

How does the platform track the EU AI Act timeline?

The EU AI Act has been in force since August 2024 and applies in stages: prohibitions since February 2025, GPAI obligations since August 2025, general application and Article 50 transparency duties since August 2026, and high-risk system obligations from December 2027 following the 2026 Omnibus. Modulos ships requirement templates built on the published text, at organization level and per AI application, and framework mappings are updated as CEN/CENELEC harmonized standards and Commission guidance land.

Which frameworks does the platform support?

AI-specific frameworks include the EU AI Act, ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM and for Agentic Applications, UAE AI Ethics, MAS FEAT, and Singapore’s Model AI Governance Framework for Agentic AI. Alongside them sit GDPR, NIS2, DORA, ISO/IEC 27001, and ISO/IEC 27701. The governance graph maps controls across all of them, so one control implemented once counts everywhere it applies.

AI governance that runs on a schedule

Modulos registers your AI systems, puts a price on their risks, tests their controls against production and keeps the evidence dated. Agents do the repetitive work every week, and your team makes the decisions.

Request a demo Read the buyer's guide

Monday 21 Sep, 09:00 · one scheduled run across discovery, governance, risk, compliance and agents

Discovery Mon 21 Sep, 09:00Customer reply agent 4Pending reviewMeeting notes agent 7Pending reviewMeeting notes agent 5Pending reviewUnderwriting copilotPending reviewCustomer reply agent 4ApprovedMeeting notes agent 7ApprovedMeeting notes agent 5Pending reviewUnderwriting copilotApproved39 found by discovery last week · 1,053 of 1,200 AI systems approved Governance Mon 21 Sep, 09:00Seven lifecycle stages · 412 of 460 staff acknowledged the AI use policy Risk Mon 21 Sep, 09:00€143.8M a year across 36,000 estimates Compliance Week of 21 Sep5 frameworks assessed, 1 control reopened by agent test AT-7 Agents Week of 21 Sep3 failed checks and 3 decisions by people this week

Your last audit is already out of date

Most governance programmes still work from snapshots: a register filled in once, a risk workshop once a year, evidence gathered in the weeks before the audit.

By the time the report is signed, new agents are live and a model has changed. Modulos keeps one record of your AI systems, their risks and their controls, and a scheduled run brings it up to date every week, with a date on every change.

Internal audit

AI governance audit report

Signed 30 June 2026

Item	Status at signing
AI Registry	Complete
Acceptable use of generative AI, v2	Current
MCF-336 Robust Input Validation	Executed
RT-189 Input manipulation	€63,000 a year, under the limit
Human review of claim denials	Effective

Since 30 June 2026

15 JulPolicy · Acceptable use of generative AIVersion 3 published. The report reviewed version 2.
10 AugRisk · RT-189 Input manipulationA second customer channel went live. The value rose to €90,000 a year, above the €75,000 limit.
24 AugControl · MCF-336 Robust Input ValidationThe input validation test failed on the new channel. Status moved from executed to not executed.
24 AugRisk · RT-189 Input manipulationRe-priced at the weekly run to €104,000 a year, €14,000 more.
4 SepAI Registry · Forecast helper agent 2Found by discovery in Claims. Built by a claims team lead and never registered.
21 SepAgent test · AT-7Failed. Three customers learned of a denial before a claims handler had reviewed it.

Sample data from the pillar pages. Each entry sits in the change log of the record it changed.

A change in production reaches every part of the record

Governance, risk, compliance and the agents work on the same record, so one event moves all of them. When a test fails, the control it proves reopens, the risk it mitigates is re-priced at the next run, and each step stays on the record it changed. Nobody has to carry the news from one team to the next.

AI Registry / Claims triage assistant / Controls

MCF-336 Robust Input Validation

Not executed

DetailsEvidenceTestsActivity

24.08.2026 06:00Metric testTest Input validation failed. Status updated from executed to not executed in control MCF-336.
15.06.2026 11:20Control ownerStatus updated from not executed to executed.
12.06.2026 16:05Security engineerEvidence attached: input-validation-test-report.pdf

AI Registry / Claims triage assistant / Risks

RT-189 Input manipulation

Current analysisRisk value over timeQuantification history

Date	Method	Status	Value
31.08.2026	Risk Agent Fermi	Quantified	€104K
24.08.2026	Risk Agent Fermi	Quantified	+€14K€104K
17.08.2026	Risk Agent Fermi	Quantified	€90K
10.08.2026	Risk Agent Fermi	Quantified	€90K

Executive summary, 24.08.2026The input validation test failed on the new channel. Mitigation factor lowered from 0.55 to 0.48.

Product screens with sample data. MCF-336 is a control from the framework library.

How a failed test reopens a control How the Risk Agent prices a risk

Start from the goal you have

Most teams arrive with one deadline or one worry. The platform is the same underneath, but the first weeks look different depending on where you start.

01
Prepare for an ISO/IEC 42001 or EU AI Act audit
Map your controls once across the frameworks you answer to, attach the evidence where it belongs, and let the agents score readiness on a schedule.
Xayn reached ISO/IEC 42001 audit readiness in four weeks. Read the case study
Compliance ISO/IEC 42001
02
Run a high-risk AI system under the EU AI Act
Scope the requirements to your role and risk class, keep the technical documentation current, and test in production that the controls still hold.
EU AI Act Compliance
03
Get control of shadow AI
Bring every agent and model into one register with an owner and a review, and put a price on the ones that carry the most exposure.
Shadow AI Discovery Risk
04
Show that the agents in your own product behave
Write checks in plain language, run them against your systems on a schedule, and keep every verdict with the evidence behind it.
Agents

Sources for evidence and runtime tests

Scout and the agents read documents and code where they already live. Runtime tests read the metrics your systems already produce, and the Python SDK pushes the rest from your pipelines, so a test result lands on the control it proves.

GitHubEvidence and runtime tests
BitbucketEvidence
Google DriveEvidence
ConfluenceEvidence
JiraEvidence
Copilot StudioAgent inventory
PrometheusRuntime tests
DatadogRuntime tests
SnowflakeRuntime tests
LangfuseLLM traces
VijilAI security tests
Claude ConsoleAI usage
OpenAI PlatformAI usage and org settings
AWSCloud resources
AzureCloud resources
MLflowThrough the Python SDK
JupyterThrough the Python SDK
Python SDKMetrics from your pipelines
REST APIEverything, programmatically

# pip install modulos-client
from modulos_client.testing import log_metric

# Push a fairness metric from your CI job
log_metric(
    metric_id="demographic_parity",
    value=0.92,
    project_id="claims-triage-assistant",
)

A metric pushed from a notebook or a CI job lands on the runtime test that reads it, and the test decides whether the control it proves still holds.

Integration and deployment options

Security and deployment

The platform holds the record your auditors rely on, so it is held to the same standard. Choose where it runs to match your security and data protection needs.

SOC 2 Type II: Security controls audited by an independent firm.
ISO/IEC 42001: The AI management system behind the platform is certified by CertX.
Encryption: AES-256 at rest and TLS 1.3 in transit.
Data residency: Hosting in the EU, the US, the UAE, Singapore and further regions.
Single sign-on and roles: SSO and role-based access at organization and AI system level, with separation of duties.

SaaS

Runs in the Modulos cloud. The fastest start, with no infrastructure to manage, and available through cloud marketplaces.

Private cloud or VPC

Runs in your own dedicated cloud environment, for stricter data protection needs or complex infrastructure. Available on request.

Deployment options in detail

Customers and partners

FAQ about the platform

Because someone will ask for the record: a regulator, an auditor, a customer running due diligence, or your own board. Modulos is that system of record. Every AI system is registered with an owner and a lifecycle stage, every control is mapped to the frameworks that require it, every piece of evidence stays attached to the claim it supports, and every risk carries a monetary value. When the question comes, you export the answer instead of assembling it.

Bring one AI system to the demo

Tell us about one AI system you run. We show how the platform would register it, price its main risks and test its controls, and what a weekly run would look like across all your AI systems.