AI Governance & Compliance

What is AI governance?

AI governance is the set of policies, roles, controls and evidence an organization uses to decide which AI systems it runs, how they may be used and whether their controls keep working. Day to day, AI governance and compliance means tracking which AI systems the organization runs, who owns each one and which policies and regulations apply. DigitalXForce covers AI governance in the AI TRiSCM and AI Risk Governance module.

What is AI TRiSCM?

AI TRiSCM and AI Risk Governance is the DigitalXForce module for AI asset discovery, assessment and mapping to NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS. TRiSCM™, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. AI TRiSCM runs on the same data layer as the other 14 DigitalXForce modules.

How does DigitalXForce discover the AI systems an organization runs?

The DigitalXForce AI TRiSCM module discovers models, copilots, agents and RAG stores across cloud, code repositories, CI/CD pipelines, containers, model endpoints, internal LLMs, third-party SaaS with embedded AI, prompt libraries and data pipelines. Shadow AI appears in the DigitalXForce inventory the same way as sanctioned AI.

Which standards does DigitalXForce map AI systems to?

DigitalXForce maps AI systems to NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS, and to the organization’s own AI policy expressed as controls with tests. One evidence set serves the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Certification stays with the accredited auditor or certification body, and DigitalXForce hands that auditor the mapped controls and the evidence. The DigitalXForce frameworks page shows the most requested frameworks.

How does DigitalXForce assess an AI system?

DigitalXForce assesses each AI system for adversarial risk, such as prompt injection and model extraction, and for data leakage. The assessment also covers model integrity, meaning bias, drift and hallucination, along with code and supply chain risk. The assessments run on a schedule and again when the AI system changes.

How does DigitalXForce keep AI controls working between audits?

In DigitalXForce, a failed control around an AI system stays open as a finding until a retest passes. That testing is part of Continuous Control Assurance. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls, and it works as a capability within CCA.

What happens when an AI guardrail fails?

DigitalXForce expresses approved use, prohibited use, data handling and human oversight as controls with tests. When a guardrail fails, DigitalXForce raises a risk in X-ROC, attaches the evidence and assigns an owner. X-ROC, the XForce Risk Operations Center, is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported. AI risks go into the same enterprise risk register as every other risk, where each one gets inherent and residual scores and a treatment.