Governance
From knowing what you have to governing it with evidence and traceability.
5 users included
Includes everything in M1 · Visibility
What it solves
Having the inventory is not enough. To answer an audit — from a large client or from an authority — you need a clear decision structure, assigned owners and a trail of every decision. M2 turns visibility into operational governance.
What it includes
Governance structure and AI Committee
AI Committee with defined roles, quorum and responsibilities, documented in minutes exportable as PDF.
RACI matrix
Who is responsible, who approves, who is consulted and who is informed of each AI decision. With PDF.
Risk register
Risks identified on a 5×5 heatmap, with their mitigation plan and follow-up.
Auditable decision log
Every relevant decision is recorded with its context, author and date. Real traceability.
Change management
Control of substantial modifications to your AI systems, within the scope of Art. 25(1): it only operates on high-risk systems.
Operations and monitoring
Incident management by tiers (N1/N2/N3) and continuous monitoring of your AI estate.
Workers' legal representatives
Control for Article 64(4)(d) of the Workers' Statute, the collective layer of workplace algorithmic transparency, with its evidence (Spain's national layer).
Own product
If your organisation is the provider of an AI system: its versions, the changes between them with the substantial-modification assessment recorded as an act of the provider, and the provider's obligations with their evidence. Deployer information sheet and change log as PDFs with a SHA-256 integrity hash.
What your board wants to know, without you having to prepare it.
A report with the recorded state of your AI governance, as a map of obligations: those that apply under the classification of your systems, each with its date of application; the detail of each system —high-risk route, role, screening and impact assessment—; and what is pending recording or review, each line linked to the screen where it is resolved. It includes the AI literacy measures recorded and, from the second PDF onwards, the change since the previous one. It is generated on the spot and downloaded as a hash-stamped PDF.
- No percentages or overall scores: it reflects the recorded state, not a rating.
- A 30, 90 or 365-day period for decisions and evidence.
- No personal names: it can travel by email.
Everything is logged. And it can be checked.
Every action in Alethexis — who created a system, who classified it, who closed a section, who downloaded a document — is logged in an audit trail with its author, date and integrity hash. The hashes are chained and verified every day: it is designed so that, if anyone alters or deletes a record, it is detected. The Owner, the DPO and the Auditor consult it with filters and export it as a hash-stamped CSV or PDF, without having to ask anyone.
- Author, role, date and hash on every action.
- Daily integrity check, shown on screen.
- Export for your external auditor, with the verification included.
Your auditor reviews it on their own.
You give an external auditor a temporary access — 7, 30 or 90 days — with a link and a code they receive by email. There is no need to create an account for them or add them to your team. They see the inventory, the classifications, the status of the sections, the approval history, the evidence index and the audit log, in a minimised view, with no direct user identifiers. Every access and every download are logged, you can disable downloads, and you revoke it whenever you want.
- Read-only, with a mandatory expiry.
- Access and downloads logged in your history.
- Immediate revocation.
Decisions, with a name and a date.
The AI use policy, substantial changes and high-risk mitigations are not simply taken on trust: they are recorded. Each approval keeps who recorded it, in what role, when, and over which version of the document, with an integrity hash. When a critical section is closed, whoever closes it confirms that, based on the information available and within their area of responsibility, the information is up to date and reasonably complete, and that statement is also recorded. The history is shown on screen and travels with the PDF. Each decision keeps an exact copy of what its approval covers, with its integrity hash: if the section is reopened, the earlier approval stays intact and the new one is kept apart.
Before using a new AI tool, you ask.
Any member can request the use of an AI tool: what it is, what it is for, who will use it and whether it processes personal data. The AI Officer reviews it — and the DPO too if there is personal data — and the Owner or the AI Officer records the decision. Once the approval is recorded, the tool enters the inventory on its own and follows the normal classification circuit. Nobody has to chase anybody: each person gets at most one email a day with what is pending, and each item is reminded once a week while it stays pending.
Alethexis talks to your systems.
A read API to query your inventory, classification, control status, evidence and audit log from your own tools or your advisor's. Webhooks to get notified when a section is closed, an approval is recorded or a high risk appears. And single sign-on with Microsoft Entra ID or Google Workspace. All included from M2; public documentation at /docs/api.
- Read-only API with keys per organisation and a quota.
- Webhooks with retries and a delivery log.
- SSO per organisation, which the Owner can make mandatory.
A look at the screen
Illustrative representation of the module interface · sample data.
Risk heat map
What you take away
- AI Committee minutes as PDF
- RACI matrix as PDF
- Auditable risk register and decision log
Users and support
5 users included · additional users: €12/user/month.
Priority support: first response within one business day.
Requests are handled through the ticketing system built into the platform, with tracking and traceability for each one.
Ready to get started with M2?
14-day free trial, no card required. Configured for your sector.
See all modules