See the governance loop on your own documents
Bring one real process — a compliance review, a risk assessment or a contract analysis — and we will show you the traceability, the human validation step and the audit trail it produces.
Sources and further reading
Regulatory statements on this page are based on the official sources below. Dates and obligations should always be verified against the current text and European Commission guidance.
About this page
Author: Governance team, Ubiclouder S.à r.l., Luxembourg.
Last reviewed: 12 September 2026, against the official European Commission and EUR-Lex sources listed above.
Corrections and questions: [email protected] · +352 27997851
This page is provided for information and does not constitute legal advice. Obligations under the EU AI Act, DORA and GDPR depend on your role, use case and jurisdiction. Always confirm requirements with your legal and compliance advisers and the current regulatory text.
A worked example: quarterly compliance review
Consider a Luxembourg fund administrator preparing a quarterly investor compliance review.
Without governance. An analyst pastes fund clauses into a public chatbot to summarise obligations, then copies the result into the review. There is no record of the model used, which documents were submitted, or whether a second person checked the conclusion. If the regulator asks how the assessment was reached three months later, the trail has to be reconstructed — often it cannot be.
With Governed AI. Sources are scoped to the fund's document repository. The permitted model is fixed by policy. The output carries source attribution to specific documents. The compliance officer approves, modifies or rejects the conclusion. The audit trail stores the prompt, the sources, the model version and the approver.
When the question arrives. The evidence exists as a by-product of the work: who asked, what the AI produced, which documents it relied on, and who signed it off. That is the practical difference between using AI and governing it.
To quantify the operational value of that difference, use the AI governance ROI calculator.
Frequently asked questions
What is AI governance?
AI governance is the set of policies, roles, processes and technical controls that determine how an organisation selects, deploys, monitors and evidences its use of artificial intelligence. In practice it covers accountability, risk tiering, human oversight, logging, documentation and audit. For regulated organisations, AI governance is what makes an AI-assisted decision defensible to a supervisor, an auditor or a court.
Why does enterprise AI governance matter?
AI is already used in processes regulators examine — compliance reviews, risk assessment, contract analysis and quality documentation. Without traceability and human oversight, organisations cannot explain how an output was produced or who approved it. The EU AI Act, DORA and GDPR all assume that evidence exists; governance produces it by design rather than reconstructing it after an incident.
What does the EU AI Act require?
For high-risk AI systems, the Act requires a risk management system, technical documentation, record-keeping and logging, transparency and instructions for use, human oversight, and appropriate accuracy, robustness and cybersecurity. Deployers must use systems correctly, assign oversight to competent people, monitor operation, keep logs and inform affected persons where required. The exact obligations depend on your role and the system's classification — see the EU AI Act compliance guide.
How much does AI governance software cost?
The platform is licensed per organisation rather than per seat, and cost depends on the deployment model (managed EU cloud, private cloud or on-premise) and on the scope of the programme. We publish no rate card: after a scoping call we confirm scope and cost in a written proposal, and most organisations start with a bounded proof of concept. Contact us to discuss your case.
Can the platform be deployed on-premise?
Yes. The platform can be deployed on-premise with Docker, in a private cloud, or as managed SaaS hosted in Luxembourg. On-premise and air-gapped deployments keep prompts, documents, decision logs and audit trails inside your own infrastructure, which matters when data residency or information classification rules prevent the use of public cloud AI services.
How licensing and engagement work
The platform is licensed per organisation rather than per seat. Cost depends on the deployment model you choose and on the scope of the programme, and is confirmed in a written proposal after a scoping call — we publish no rate card.
- Managed European cloud — operated for you in Luxembourg or the EU, with governance templates, dashboards and support included.
- Private cloud — installed in your own cloud tenancy or region, keeping data residency under your control.
- On-premise — deployed inside your own infrastructure, with air-gapped operation possible, for the strictest classification or residency rules.
- Proof of concept — a bounded engagement on your own processes with success criteria agreed up front. Most organisations start here.
To discuss scope and a proposal, contact us. If you need an independent assessment of your starting position, we can run an AI governance audit as a separate engagement.
How it works
The platform implements a six-step governance loop around every AI interaction.
- Scope. You define the perimeter: which documents and systems the AI may reach, and which users may reach them.
- Request. A user starts a task. The permitted model and the permitted sources are fixed by policy rather than chosen ad hoc.
- Generate. The AI produces an output and records the sources it used.
- Validate. A named human approves, modifies or rejects the output before it is applied.
- Capture. The interaction, its sources, the model version and the approver are written to the audit trail.
- Retain and reuse. Validated knowledge stays inside the organisation and informs later decisions.
The loop is what makes the difference between an AI assistant and governed AI: the record is created as a by-product of the work, not as a separate administrative task. To see the wider product context, read the InnooForge product overview.
Deployment and data residency
Governance is only credible if the platform itself respects your data rules. The platform is deployed where your information is permitted to live.
| Deployment model | Best suited to | Data residency |
|---|
| On-premise (Docker) |
Organisations with strict residency or classification rules; air-gapped environments |
Inside your own infrastructure |
| Private cloud |
Teams that need elasticity while retaining control of the tenant |
Your European cloud tenant |
| Managed SaaS |
Fastest start, with managed installation and onboarding |
Hosted in Luxembourg |
The architecture is LLM-agnostic: you connect the models you are permitted to use, including self-hosted open-weight models. On-premise and air-gapped deployments keep prompts, documents, decision logs and audit trails inside your perimeter. Full detail is on the sovereignty and deployment page.
Implementation roadmap
A practical sequence for introducing AI governance without stalling delivery. Steps 1 to 3 can run in parallel with a pilot.
- Establish your baseline. Work through the AI compliance checklist to identify where AI is already used and what evidence is missing.
- Define the perimeter and classify systems. Decide which use cases are in scope and how each is classified under your AI Act, DORA and GDPR obligations.
- Deploy. On-premise, private cloud or managed SaaS, depending on your residency constraints.
- Configure templates and approval roles. Set the governance templates for your domains and define who may approve what.
- Pilot one high-value process. Choose a process that regulators already examine, such as a compliance review or a risk assessment.
- Review the evidence and extend. Take the audit trail of the pilot to internal audit and compliance, then extend to further processes.
If you need help with step 1 or 2, we can run an AI governance audit as a separate fixed-scope engagement.
Mapping AI governance obligations to platform evidence
Regulatory expectations, industry best practice and product capability are not the same thing. The table below separates them, so you can see exactly what the platform does — and what remains a decision for your organisation.
Regulatory requirement
Best practice / framework
Our recommendation
Product capability
| Obligation or control | Type | What good evidence looks like | InnooForge |
|---|
| Risk management system — AI Act Art. 9 |
Regulatory |
A documented, per-system risk file that is reviewed and updated |
Governance templates and structured classification records |
| Record-keeping and logging — AI Act Art. 12 |
Regulatory |
Automatically generated logs of system operation, retained and retrievable |
Interaction and decision logs captured at source |
| Transparency and instructions for use — AI Act Art. 13 |
Regulatory |
Users understand capability, limits and outputs |
Source attribution and provenance shown with each output |
| Human oversight — AI Act Art. 14 |
Regulatory |
Competent persons can monitor, interpret and intervene |
Named-approver workflow with approve, reject or modify |
| ICT risk management — DORA Art. 6 & 8 |
Regulatory |
Documented ICT risk framework and evidence for critical functions |
Deployment documentation and exportable audit records |
| Data minimisation — GDPR Art. 5 |
Regulatory |
Only necessary data is processed, with a defined lawful basis |
Scoped source access; documents are not used to train third-party models |
| Records of processing — GDPR Art. 30 |
Regulatory |
An accurate record of processing activities |
Exportable interaction metadata for the record of processing |
| Automated decision-making — GDPR Art. 22 |
Regulatory |
Meaningful human intervention and the ability to explain an outcome |
Human validation gate plus a reproducible decision trail |
| Segregation of duties |
Best practice |
The person proposing an output is not the sole approver |
Role-based approval routing |
| Prompt and instruction governance |
Recommendation |
Prompts are versioned, reviewed and attributable |
Instruction system with version history |
| Retention and retrieval |
Capability |
A defined retention period with fast retrieval on request |
Configurable retention and searchable audit trail |
The platform provides the mechanism and the record. Determining the correct legal basis, classification and retention period remains your organisation's responsibility — our AI compliance checklist helps you work through those decisions.
What an AI governance platform must do
The table below sets out the capabilities an enterprise AI governance platform should provide, and how the platform delivers each one.
| Capability | Why it matters | How the platform delivers it |
|---|
| Full interaction traceability |
You must be able to explain how an output was produced, not merely that it was produced. |
Every interaction records the prompt, the sources used, the model and the output, linked to the requesting user and the decision it supported. |
| Human validation |
Accountability cannot rest on an unnamed system. AI Act human-oversight expectations and internal control frameworks both require a competent, identifiable reviewer. |
Consequential outputs require explicit approval, rejection or modification by a named human before they are applied. |
| Audit trail and logging |
Records must be complete, retained and retrievable, and must survive staff turnover. |
Decision logs with timestamps, reviewers and document integrity checks, exportable for internal or external audit. |
| Source attribution |
An unsourced answer cannot be relied upon in a regulated process. |
Outputs are linked back to the documents they draw on, so a reviewer can verify the basis of a conclusion. |
| Risk tiering and documentation |
Obligations differ by risk level; you need a documented classification per system. |
Structured governance templates guide classification, documentation and review, so the file exists before it is requested. |
| Agent and tool control |
Agents that call tools can act on enterprise systems, where errors have real consequences. |
The governance layer constrains which tools and data an AI workflow may reach, and records each action taken. |
| Sovereign deployment |
Data residency and information classification rules often prohibit public cloud AI. |
On-premise (Docker), private cloud or Luxembourg-hosted SaaS, with an LLM-agnostic architecture. See sovereign AI deployment options. |
