How RiskAlign uses AI — and how it doesn't
RiskAlign uses AI to help risk professionals, never to replace their judgement. Every AI-assisted output is shown to a named human, who accepts, edits, or rejects it before anything is committed to a governance record. Every AI call is logged. We do not train external models on your data.
Where AI is used
- Compass (assistive co-pilot)
Suggests categorisation, drafts narratives, proposes scenario inputs, ranks residual-risk hotspots.
Human in the loop: Every suggestion is a draft. A named user accepts, edits, or rejects. Both the suggestion and the decision are written to the audit trail.
- Routine classification
Pre-populates fields where the data is unambiguous (e.g. mapping a KRI to an existing risk theme).
Human in the loop: Human approver remains accountable for the saved state.
- Board-pack assist
Drafts the board commentary from current register, appetite and KRI state.
Human in the loop: CRO ratifies before the draft can be published. No automatic publication.
Where AI is never used
- Signing the board pack or any external assurance statement.
- Changing risk appetite thresholds.
- Sanctions or regulator-facing determinations.
- Adverse decisions about a real customer or employee.
Governance controls
- Model and version logged on every call (agent_runs: model, prompt_id, prompt_hash, input_hash, output_hash, token counts, latency, gateway run id, surface).
- Every suggestion is written to compass_suggestions as a draft and requires a named human to ratify, override (with reason), or dismiss before any governance record changes.
- Anti-prompt-injection: user-supplied text is sanitised (control chars stripped, length-capped) and wrapped in explicit untrusted delimiters before any model call.
- No training on your data — AI calls route through the Lovable AI Gateway under no-training contractual terms.
- EU egress for AI gateway calls.
- Failures are logged (status: error / rate_limited / credits_exhausted). The product surface degrades to deterministic, rule-based output if the gateway is unavailable — it does not fail open.
- Roadmap: per-tenant cost caps and per-tenant Compass opt-out are planned (see /trust/roadmap).
Maps to common frameworks
- EU AI Act: "limited risk" — assistive content generation with human oversight. No automated decision-making affecting natural persons under Article 22 GDPR.
- ICO AI guidance: DPIA covers AI use; explainability surfaced via the audit trail of suggestion + decision.
- NIST AI RMF: Govern (documented uses + HITL), Map (per-call logging), Measure (cost cap, fallback monitoring), Manage (sanitisation, deterministic fallback).
See also: Trust Centre, Compass methodology, Security Roadmap, Vulnerability Disclosure Policy, Known Limitations.