ISO-STANDARD.app

AI does the drafting. You keep the accountability.

Compliance work is slow because it is full of blank pages and unclear asks. AI removes the blank page — it does not remove the person responsible for what the management system says.

The problem with 'AI compliance'

A management system that a machine wrote and nobody read is worse than no system at all: it looks complete, and it fails the first time somebody asks a follow-up question. The useful role for AI here is narrow and honest — turn what you already do into wording an auditor recognises, explain findings in language a non-specialist can act on, and shorten the distance between a failed control and a fixed one.

Where AI helps, specifically

Guided policy drafting

Plain-English questions about how your organisation works, why the auditor asks, and a draft you edit and approve.

Plain-English control explanations

Every failed control is explained without jargon, so the owner understands the risk rather than the clause number.

Prioritised remediation plans

A tailored fix plan with suggested owner, ordered steps, suggested evidence and an implementation checklist.

Third-party questionnaire review

Submitted supplier responses are reviewed for weak, vague or missing answers, with suggested follow-up questions.

Assurance answer support

Draft answers to buyer security questionnaires from evidence you already hold, for review before sending.

Human approval, always

No AI output is published, sent or recorded as evidence without a person approving it.

Governing the AI you adopt elsewhere

The same workspace governs your own AI adoption: an inventory of AI systems, impact assessments, supplier assessment of AI vendors, and the policy and control set behind ISO/IEC 42001. Governance of AI and governance with AI are the same discipline, held in the same register.

Answers buyers, procurement and auditors want

Does AI make decisions about our management system?+

No. Every AI output is a draft or a suggestion presented to a named person, who edits, approves or rejects it. Nothing enters the management system without human approval.

Is our data used to train models?+

No. Content sent for AI assistance is used to produce your result and is not used to train third-party models.

Where is AI actually used in the product?+

Guided policy drafting, plain-English explanations of failed controls, prioritised remediation plans with suggested evidence, and review commentary on submitted third-party questionnaires.

How does this help with ISO/IEC 42001?+

The same governance the standard expects of your AI systems is applied to the AI inside the platform: a defined purpose, a human decision point, a record of what was produced and by whom it was approved.

What are the usage limits?+

AI assistance is included in subscriptions from the Growth plan upwards, with fair-use allowances published on the pricing page.

See how your existing risks, controls and evidence could become one integrated management system

Watch a policy drafted, a failed control explained and a remediation plan produced against your own material.

Get started See pricingTalk to us

Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.

← Browse guidesPricing →
AI-enabled — privacy-respecting

AI does the drafting. You keep the control — and the data.

How we handle data →

  • AI that assists — not replaces

    Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.

  • Opt-in, workspace-scoped

    AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.

  • Your data stays yours

    Prompts routed via the AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.

  • Isolated by design

    Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.

We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.

MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists

Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.

I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.

Read the founder story ·See plans built for SMEs and consultants