The first public release
Use cases, risk register, vendor records, and role-based access, with report generation and email invitations.
Risk registerVendorsRBAC
VerifyWise
From a compliance tool to an AI governance platform
40+releases
Phase 01FoundationJun – Sep 2025
ISO 27001 and the repository layer
ISO 27001 arrives alongside the EU AI Act, and the backend moves to a repository pattern for controls and project scope.
ISO 27001Repository layer
Vendor risk and Redux migration
Vendor risk is restructured and expanded, state moves to Redux for a single source of truth, and the dashboard gains search.
Vendor riskRedux
Task management and model risk
A full task page for compliance tracking, model risk management with Swagger API docs, and fairness metric visualizations.
TasksModel riskFairness
Phase 02ExpansionOct 2025 – Jan 2026
UI overhaul and enterprise auth
Around 40 merged PRs: icon migration to Lucide, a reusable empty state, a command palette, and SSO via Microsoft Entra ID.
Command paletteSSO
Automations and integrations hub
A full automations module with drawer-based workflows, an integrations hub with Slack, and AI incident management for the EU AI Act.
AutomationsSlackIncidents
MLflow, Ollama, IBM risk database
MLflow experiment tracking, Ollama for local inference in bias and fairness, the IBM AI Risk database, and org-level projects.
MLflowOllamaIBM risk DB
Model versioning and frameworks
Model versioning tracks changes over time. NIST AI RMF lands with risk linking, CE marking arrives, and Wise Search covers the app.
NIST AI RMFCE markingWise Search
LLM evals module and docs sidebar
A dedicated LLM evaluation module with dashboards and dataset management, plus the in-app user guide and activity history.
LLM EvalsUser guide
Entity graph and AI detection
An interactive graph of models, risks, vendors, and controls; a code-scanning detection module; and an AI governance advisor.
Entity graphAI DetectionAI advisor
Phase 03PlatformFeb – Jul 2026
Plugin marketplace and notifications
A plugin marketplace for extensibility, a virtual file manager, real-time notifications over SSE, and a dataset inventory for Article 10.
MarketplaceNotificationsDatasets
Shadow AI and bias audits
Shadow AI detection surfaces unauthorized tool usage, agent discovery builds an inventory, and law-aware bias audits arrive.
Shadow AIBias auditsJira
AI Gateway and Policy Radar
The AI Gateway centralizes LLM traffic with guardrails, spend tracking, and virtual keys. Policy Radar monitors vendor policy changes.
AI GatewayGuardrailsCI/CD
Control-level ownership
Owner, reviewer, approver, and due date move up to the EU AI Act control level. Training records accept evidence uploads.
Control workflowTraining evidence
Trust Index, AI Apps, Agent Control
Three modules at once. The Trust Index grades third-party AI apps, AI Apps governs the tools teams use, and Agent Control gates what agents do.
AI Trust IndexAI AppsAgent Control
Model risk management
Tiering, staged validation, findings, threshold monitoring, revalidation, and attestation, built for SR 26-2, SS1/23, and OSFI E-23.
MRMOptional frameworksDesign tokens
Shipped ↑ · Planned ↓
NextWithin 3 monthsIn progress or scoped
Terms and privacy policy monitoring
Watch vendor terms of service and privacy policies for changes, with clause-level analysis that scores severity and maps each change to the frameworks it affects.
Vendor T&CPrivacy policiesClause diffs
Agentic AI management
Beyond gating single tool calls: govern agents as a fleet. Path-based write rules, decision provenance on every call, a priority rule engine, and adapters for agents without a native hook.
Path gatingRule engineProvenance
Continuous control monitoring
Controls that test themselves on a schedule and raise a finding when they drift, so posture is a live signal rather than a point-in-time attestation.
Scheduled testsDrift alerts
LaterWithin 6 monthsDirection, not commitment
Regulation-aware automation
The platform adjusts itself as obligations move. New and amended rules map onto your existing controls, and the gaps they open become tracked work instead of a manual re-mapping exercise.
Auto-mappingObligation trackingGap detection
Risk-driven prioritisation
Governance work ordered by exposure rather than by checklist position, so the highest-risk models and obligations surface first and effort follows the actual risk.
Exposure scoringAdaptive queues
Scroll, drag, or use arrow keys