Search for AI governance and the results quickly fill with software: platforms that promise to record every AI system, assess its risk, map it to the EU AI Act and ISO 42001, and keep the evidence ready for an auditor. Some of them do that well. For a business of 50 to 500 people, the question is whether it needs one yet, and the answer depends on what you are governing.
What these platforms do
The category covers a range, and most products do some mix of the following:
- Discover AI use, by watching network traffic, browser activity or connected apps, and build an inventory of it.
- Hold a register of AI systems with owners, risk ratings and approvals.
- Run risk and impact assessments as workflows that someone signs off.
- Map your controls to frameworks and regulations and show where the gaps are.
- Monitor the drift, bias and performance of models you build.
- Keep the evidence an auditor or a regulator will ask for.
They are built mostly for larger businesses, and especially for those that build and run their own models, operate in several regulated markets or have dozens of AI systems with different owners.
What a business of 50 to 500 people already has
Most of what a platform does, a smaller business can do with tools it already pays for and a few hours a month.
| A platform | With what you already have | |
|---|---|---|
| Discovery | Watches network traffic, browser activity or connected apps | The admin consoles you already run: Microsoft 365 and Google Workspace show which outside apps people have connected, and the Microsoft 365 admin center lists Copilot agents |
| Register | Holds AI systems with owners, risk ratings and approvals | A spreadsheet with one row per tool: what it is for, the account type, the owner, the vendor's terms and who approved it |
| Assessments | Runs risk and impact workflows that someone signs off | A short written template kept with the register and used for each new tool or use |
| Framework mapping | Maps your controls to frameworks and regulations and shows the gaps | A page in the policy on how your controls line up with ISO 27001, ISO 42001 or the NIST framework, as the governance framework article sets out |
| Evidence | Keeps what an auditor or a regulator will ask for | The policy, the register, the approvals and the records your tools keep, filed where you can find them |
On the network side, security tools you may already own can show which AI services are being used from your network. For a business that uses AI tools rather than building them, that set-up is usually the right size, because the people running it can keep it current without it becoming a job of its own.
Signs you have outgrown the spreadsheet
- The register has more systems than one person can keep current, or owners who change faster than anyone updates it.
- You build AI into your own products or services, and need to monitor models you run.
- You operate in several jurisdictions and need to show compliance with different rules at once.
- A client, a regulator or an auditor asks for evidence of assessments and approvals as workflows with dates and sign-offs.
- Agents are multiplying across platforms. Microsoft's Agent 365, covered in Copilot Studio and Copilot agents, is one answer to that within Microsoft's world.
If two or more of those are true, a platform may well earn its cost.
If you do buy one
Write the rules first, because a platform holds and enforces decisions and cannot make them for you. Check how it discovers AI use, and whether that means a browser extension or an agent on every device, which raises its own questions. Make sure the register can be exported, so your records do not become hostage to a subscription. Before it goes live, give it an owner with time to keep it updated.
Where this fits
The register, the policy and the approval process come out of Govern, in whatever tool suits your size. Keeping them current month to month is the governing part of Trackside, and if the business outgrows a spreadsheet, choosing a platform is a decision we can help you make on the evidence.