“What AI is running, what risk does it carry, and has it been checked?”
Every EU AI Act risk tier and obligation, every NIST AI RMF function and every ISO/IEC 42001 clause and control, applied to one register of the AI systems and agents in your company — with their owners, what they reach, what they cost and what they return. Your team classifies each system; Dotwork keeps the record, the evidence and the dates. When an application date moves, the affected obligations are re-dated rather than reassessed from scratch. And the controls that govern AI are the ones security, resilience and financial reporting already use. Dotwork is not legal advice and does not certify conformity.
Runs in
Covers
EU AI Act · NIST AI RMF · ISO 42001
The pressure
Every AI framework starts from an inventory: what AI exists, what it is for, who owns it and what risk it carries. Most companies build that list in a spreadsheet the first time someone asks. Agents get wired into systems nobody mapped. Risk assessments sit in a governance tool with no link to the access, the spend or the controls. And the application dates keep moving.
What it looks like today
Full coverage
All three frameworks point at one register of AI systems and agents, so one control and one piece of evidence can answer each of them.
Built for the EU AI Act as amended in 2026 · NIST AI RMF 1.0 · ISO/IEC 42001:2023
Your classification, recorded per system.
What providers and deployers must show.
Four functions, plus the Generative AI Profile.
An AI management system you can certify.
Where the obligations meet the agents.
Proof the AI is worth governing.
What changes
An inventory compiled for the regulator
One register of AI and agents, kept current by intake
A risk tier as a label
A risk tier tied to what the system reaches, who owns it and the controls that cover it
A separate assessment per framework
One set of controls and evidence, mapped to the AI Act, NIST AI RMF and ISO 42001
Governance on paper
Runs, access, limits and value watched — with people deciding
Three frameworks, one register
Your team maps each requirement once. Dotwork reads the EU AI Act, ISO/IEC 42001, the NIST AI RMF and your own standard against the controls that satisfy them — preventive, detective, corrective and directive — with full, partial and missing coverage in plain view. Beside it, every AI system and agent is placed by impact and autonomy, and shadow AI with no owner shows up as a gap of its own.
Where other tools stop
AI governance platforms keep the register and the regulation library. They rarely know what an agent can reach, what it costs or which security and resilience controls already cover it.
Flexed to how you run
The frameworks agree on one thing: governance should match the risk. Their structure stays as written; the effort follows how your company uses AI.
Provider, deployer or both
Record your role for each system and attach the obligations your team decides apply to it.
Your tiers, mapped to theirs
Keep an internal risk scale and map it to the AI Act’s categories, the NIST AI RMF and ISO 42001.
Proportionate review
Low-risk tools move fast. High-risk systems carry more evidence before they advance.
Register first, controls as they come due
Begin with the register and an access review, then add controls and evidence as each obligation comes due.
When the dates move
AI regulation is changing by the quarter — new application dates, codes of practice, guidance and standards. Each change is traced to the systems and controls it affects and put to legal and compliance for approval. Past assessments stay on the dates and guidance that applied when they were made.
Prohibited practices apply from 2 February 2025
Intake asks about prohibited uses before anything goes live
Obligations for general-purpose AI models apply from 2 August 2025
Models and their providers flagged on the register
The 2026 Digital Omnibus moves stand-alone high-risk obligations from August 2026 to 2 December 2027
Obligations re-dated on every affected system, with the source recorded
High-risk AI in regulated products moves to 2 August 2028
AI embedded in products re-dated on its own track
NIST adds a Generative AI Profile to the AI RMF
Its risks attached to the generative systems on the register
ISO/IEC 42001:2023 — the first certifiable AI management system standard
Clauses and Annex A controls mapped to the same controls as everything else
Every framework, one model
AI touches security, resilience, financial reporting and delivery at once. Each of those frameworks sees the same record for each AI system, so its controls are written once.
NIST CSF · ISO 27001 · SOC 2 · COBIT · SEC cyber rules
AI access, data and change controls are the same ISO 27001 and NIST CSF controls, not a parallel set.
Explore Security & IT GovernanceFinOps for AI · token and model spend
Every AI system’s token and model spend, metered per task, team and outcome.
Explore TokenomicsSOX · COSO
AI used in financial processes sits under the same key controls, as COSO’s 2026 generative AI guidance describes.
Explore Financial ControlsEU DORA · NIS2 · UK op-res
Agents that support an important service sit on its dependency map.
Explore Operational ResilienceScaled Agile’s operating model for AI
Agents working in the trains carry their risk tier and limits into delivery.
Explore AI-Native SAFeStandards and review for every architecture component
New AI solutions pass the same architecture review as every other component.
Explore Solution GovernanceAI-native AI governance
The repetitive work — intake, inventory, access review, keeping up with dates — is drafted from the model. Classification, approval and every legal conclusion stay with named people.
Collects purpose, sourcing, vendor, personal data and decisions about people, and suggests a risk tier from the answers.
Tracks how each agent’s runs end, its failure rate and the runs below its confidence threshold.
Compares each agent’s spend with its monthly budget and flags runs above its recorded transaction or daily limits.
Maps the systems each agent connects to, its peer agents, its exceptions and their estimated exposure.
Surfaces excessive and stale AI access and candidates for containment.
Weighs each value claim by its confidence and whether it traces to an outcome, initiative and method.
Proposes which systems a changed date, code of practice or new guidance affects, and how their obligations move.
Answers questions about the AI estate, its controls and its evidence, citing the records behind every answer.
Where it runs in Dotwork
Dotwork does not ask you to adopt a new method. The framework becomes a view over the same model these solutions already read and write.
Govern & Deliver
“What AI is running, what can it access — and is it worth what it costs?”
ExploreGovern & Deliver
“Can we prove our controls were actually working on what we shipped?”
ExploreFund & Optimize
“What does our AI actually cost — and what did it return?”
ExploreHow it compares
AI governance platforms keep the register, the regulation library and the assessments. GRC suites add AI to the control library. AI Regulation on Dotwork applies the frameworks to the AI you actually run and connects it to the access, spend, value and controls around it. It records your classification; it is not legal advice.
| Capability | AI governance platforms | GRC suites | AI Regulation on Dotwork |
|---|---|---|---|
| AI inventory with owners and risk tiers | Partly | ||
| Intake with an approval before use | Partly | ||
| EU AI Act, NIST AI RMF and ISO 42001 against one register | Partly | ||
| One control mapped across the AI frameworks and ISO 27001 | Partly | ||
| What each agent reaches, with its exposure | Partly | ||
| Excessive and stale AI access surfaced | Partly | Partly | |
| Budgets and limits checked against actual runs | Partly | ||
| Obligations re-dated when an application date moves | Partly | Partly | |
| AI spend and value in the same book as everything else |
Who it is for
“Which AI do we run, and which needs more scrutiny?
“Which systems could be high-risk under the AI Act, and are they governed?
“Are we a provider or a deployer for each system, and which dates apply?
“What can each agent access, and should it?
“Which AI handles personal data or makes decisions about people?
“Is our AI under control, and is it paying off?
Before you buy
How to get a number instead of a pitch.
1
Good answer · An intake with purpose, vendor, personal data and decisions about people — and an approval.
Bad answer · Someone adds a row when the auditor asks.
2
Good answer · None. It records your classification and the evidence behind it.
Bad answer · The engine tells you whether you comply.
3
Good answer · Obligations re-dated on the affected systems, with the change and its source recorded.
Bad answer · A new assessment template.
More in Risk, Compliance & AI
Risk, Compliance & AI
The rules your controls have to prove they meet — including the new ones for AI.
The model underneath
Steer, Fund & Optimize and Govern & Deliver all read and write the same Enterprise Operating Model. The first module you license builds the model. Every module after it adds context instead of another silo — and Dotwork AI reads all of it, stopping where the decision is yours.
See the Enterprise Operating Model© 2025-2026 Dotwork, Inc. All rights reserved.