AI governance on your infrastructure
Ready-built inventory and rule-mapping workflows, configured for your firm, run by your team.
Solutions · AI inventory
Know what AI you run. Prove it to the board.
Boards and senior management are accountable for every AI system the firm uses. The AI inventory is the register that proves it: each system with its purpose, risk rating, level of oversight and a named owner who signs for it, mapped to the clauses it satisfies.
An AI register in six steps, signed by its owners.
How it works · example workflow
From first sources to the board report. Ray seeds the register from what the firm already holds, fills the fields a regulator expects, and each owner signs their own records. Every record is mapped to the clauses it satisfies, and the export is the evidence.
What changes for risk and compliance
- Found, not declared: The register starts from submissions, vendor contracts and the use cases found in your tools, not from a spreadsheet teams filled in once.
- Every system owned: Each record has a named owner who signs it, and signs again when it changes.
- Mapped to the rules: Each record shows the clauses it satisfies and the ones it does not yet.
- Ready for the board: One report for the board and one evidence pack for the regulator, built from the same records.
Harbour Mutual · AI register · 6 steps
Ray · the owners, Legal and the CRO · every action logged
01 Seed the register
Method: Varies, AI reads your sources. Who: Ray.
Ray reads staff submissions, vendor contracts and the use cases found in your tools, and opens one draft record for each AI system, noting where it came from.
02 Fill the fields
Method: Varies, AI drafts each field. Who: Ray.
Ray drafts the mandatory fields (name, purpose, risk rating) and the extended ones (oversight level, explainability, kill switch and resilience) from the sources, and shows which are still missing.
03 Owner attests
Method: Human judgement. Who: M. Khan, model risk owner.
Each record goes to its owner, who confirms or corrects it and signs in Teams. When a record changes, its owner signs again. Records with no owner are listed, so nothing is left unowned.
04 Map to the clauses
Method: Varies, AI maps each record. Who: Ray.
Ray maps each record to the clauses of the regulator’s AI guidance that it satisfies, and lists the clauses it does not yet satisfy as issues for the owner. Legal confirms any reading that is not clear.
05 Export the attestation
Method: Exact, generated from the records. Who: D. Price, Legal, signs off.
The attestation is exported from the records, the same fields in the same order every time, and signed off by Legal. The evidence pack for the regulator is the same export with every record it points to, the sign-offs and the versions.
06 Board report
Method: Varies, AI drafts the summary. Who: The CRO approves.
A report for the board and senior management: which AI is live, which is high-risk, who owns each, what changed since the last report and what is still open. Every figure points back to its record.
Exact: the same inputs give the same result every run. Varies: AI judgement, shown with its sources. Example only; Harbour Mutual, its systems and the people are fictional.
Other questions Rayify answers
Every workflow runs on the same system. Pick another question to see it. Solutions
Two ways to work with Rayify
A first inventory in half a day
Find where your teams use AI, classify it with your second line, leave with a working inventory.
Cloud, hybrid or local
Cloud
Everything runs in Rayify’s cloud
Hybrid
Sign-in in our cloud, a sealed engine and your data in yours
Local
The whole system on your premises
In every option: a sealed, versioned system that we deploy and operate, and an audit trail that belongs to you.
Labs that leave a working inventory
- Non-technical: census, classify, sign off in your tools
- Technical: identity, M365, registry and GRC connectors
- Half a day, fixed fee, on your infrastructure
Built for the people accountable for AI
Boards and SMFs. Risk, compliance, model risk, data protection, security.
Frequently asked questions
What data sources do you have access to?
We work from four kinds of source. The rules and guidance in each market you operate in, with the date each one applies from. Your own register of AI systems, and the policies and standards behind it. Your vendor contracts and the vendors’ release notes. And usage exports from the AI tools your staff use, such as Claude and Copilot, read on your own machines. Every finding is attributed to its source, so you can check where any line comes from. For ongoing work we can connect the tools your team already uses, such as Microsoft 365, your identity provider and procurement, so the register stays current inside your existing workflow rather than alongside it.
What does an engagement actually look like?
It starts with the question your board or your regulator is asking, such as what AI the firm runs, or which rules apply from when. For a first engagement we run a short scoping session to agree the markets and teams in scope. We then start from an example template that gets you most of the way, adapt it to your firm and have Rayify’s AI risk experts sign it off, and your owners attest their own records. You leave with a register, a clause compliance map and an evidence pack you can take to your regulator. For your control functions, risk, compliance and audit, Labs teach your people to evaluate AI and challenge what it produces, so they can run the work themselves afterwards.
How long does a run take?
A run itself takes minutes: a horizon scan about 12, an AI inventory about 30. The time goes into verification, with every line traced to its source, and into your people: each owner signs their own records and your experts sign off the mapping. A first working register fits in a half-day Lab.
Who sees our inputs?
Engagements run under an NDA by default. You choose where the system runs, in our cloud, hybrid or on your own premises, and usage exports are read on your own machines, so they need not leave them. We never use what you give us to train AI models. Your documents are encrypted and private to your organisation, never pooled or shared, and access is limited to the team on your engagement, for that work only. The audit trail belongs to you.
How is this different from Claude, Gemini or ChatGPT?
Copilots are useful for everyday work. Governing AI across a regulated firm needs a record of every use, mapped to the rules and signed by its owner. Rayify builds and runs that.