Choosing a tool for AI governance
Define the process first
Determine who maintains the inventory, approves changes and reviews evidence. Choose software for this work and for the people who actually perform it. The number of systems or employees alone does not determine the right platform.
Three approaches
| Approach | When to consider it | What to verify |
|---|---|---|
| Shared spreadsheets and documents | You need visibility and can manage ownership, versions and approvals | Permissions, change history, backups, consistency and export |
| Existing work and task management tools | Your team already has a suitable environment for owners, deadlines and approvals | Links between a system, requirement, evidence and corrective task; access for specialists outside IT |
| Specialist governance or GRC platform | You need more complex relationships, multiple organisational units or formal controls | The specific edition, permissions, regulatory content, audit trail, integrations and export completeness |
Spreadsheet and document services can provide version history, permissions and administrative logs. Capabilities depend on the service, licence and configuration. A blanket claim that spreadsheets lack an audit trail would be misleading. An enterprise platform’s name likewise does not establish that its audit trail meets your requirements.
Use a common evaluation scenario
Run the same test with the same sample data for each candidate:
- Create an AI system with its owner, purpose and supplier.
- Attach a requirement and evidence, then change their status.
- Have another role approve the change and inspect the history.
- Test access by someone who should not be authorised to see the data.
- Produce an overview of open actions for management.
- Export the data and check that it remains usable outside the tool.
Record the observed result, version and edition, limitations and manual steps required. Generic star ratings without a shared test are not evidence of suitability.
Cost and contract
Request a current quotation for your users, modules, environments and support. Add implementation, migration, operations, training, maintenance and exit costs. No licence fee does not mean no total cost.
For sensitive information, assess processing roles, contractual terms, processing locations, subprocessors and transfers. For self-hosted software, assign responsibility for security updates and recovery testing.
Record the decision
Write a short decision record covering the target process, mandatory criteria, tested scenarios, three-year cost estimate, risks and rationale. A new platform may be unnecessary if the current environment meets the requirements.
- Custom application — an example design and the work custom development adds.
- Source code and licensing — assessing a specific project.
- Verifying a VerifyWise deployment.