Your AI models need compliance proof, not more checklists
SecureGRC verifies your AI models against ISO 42001, generates a complete inventory, and signs every artifact with quantum-safe cryptography.
google-bert/bert-base-uncased
Controls (25/30)
Active threats
Compliance tools manage paperwork. They don't verify your models.
Vanta, Drata, and OneTrust handle IT compliance well. But ISO 42001 has 36 AI-specific controls that require model-level data no existing platform collects.
Every model treated the same
A text-generation model faces prompt injection. An image classifier doesn't. If your compliance tool can't tell the difference, your risk assessment is wrong.
No model inventory
ISO 42001 requires a documented inventory of every AI system. Most companies can't list what models they run, let alone their training data, dependencies, and lineage.
Evidence won't last
Every compliance artifact signed with RSA or ECDSA today becomes unverifiable when quantum computers arrive. Your audit trail has an expiry date.
Three pillars. One trust layer.
SecureGRC doesn't manage paperwork. It verifies your actual AI models and creates a cryptographic chain of trust.
Transparency — ML-BOM
Automated 67-field inventory of every AI model. Identity, architecture, training data lineage, framework dependencies, and known vulnerabilities. The ingredients label for AI.
Verification — TCCE Engine
13 threat vectors mapped to exact ISO 42001 Annex A controls with task-aware filtering. Different model types get different assessments. Every weight has documented rationale.
Continuity — Quantum-safe
Every artifact signed with FIPS 204 (CRYSTALS-Dilithium) and anchored in a FIPS 202 (SHA-3) Merkle tree. Evidence remains independently verifiable for decades.
From model to signed compliance proof.
No access to model weights or production environment. Metadata only. Approved in one security review.
Connect your AI models
Point at HuggingFace, SageMaker, or provide model details directly. We extract metadata only — your weights, training data, and IP never enter our system.
Automated threat and compliance assessment
The TCCE engine identifies AI-specific risks with task-aware filtering, maps to 36 ISO 42001 Annex A controls, and produces a four-dimension risk score.
Quantum-safe cryptographic signing
Every artifact — ML-BOM, compliance report, evidence record — is signed with CRYSTALS-Dilithium and anchored in a Merkle provenance tree.
Enforce, report, remediate
CI/CD enforcement gate blocks non-compliant models. Auditor-ready PDFs generated automatically. Prioritised remediation plans with ISO 42001 templates.
Built for AI models. Not bolted onto IT compliance.
| Capability | SecureGRC | Vanta | Drata | Credo AI |
|---|---|---|---|---|
| ISO 42001 Annex A model-level assessment | 36 controls | Programme only | — | Governance only |
| Post-quantum cryptographic signatures | FIPS 204 | — | — | — |
| Automated AI model inventory (ML-BOM) | 67-field | — | — | Manual |
| No access to model weights or IP | Metadata-only | Agent-based | Agent-based | Varies |
| Task-aware threat intelligence | MITRE ATLAS | — | — | Generic |
| CI/CD deployment enforcement | 7 policies | — | — | — |
In the press.
SecureGRC is solving the White House $7.1B threat for AI startups
Building quantum-resistant compliance infrastructure for the next generation of AI companies.
Selected for Cohort 6 — Barclays × Plexal
Fast-tracking digital startup growth in the UK cybersecurity ecosystem.
Learn the standards before you buy the tooling.
Reference guides on ISO/IEC 42001, ML-BOMs and post-quantum evidence — written to be useful whether or not you ever use SecureGRC.
ISO/IEC 42001 explained
The first certifiable AI management system standard: structure, Annex A controls, certification route, EU AI Act fit.
What is an ML-BOM?
What a machine learning bill of materials contains, CycloneDX vs SPDX, and how to generate one.
Quantum-safe compliance
Harvest-now-decrypt-later risk, FIPS 204 ML-DSA signatures, and Merkle-anchored audit evidence.
ISO 42001 ↔ MITRE ATLAS
Mapping MITRE ATLAS adversarial tactics onto ISO 42001 control themes, with a worked example.
SecureGRC vs the alternatives
Honest side-by-side comparisons against Credo AI, Holistic AI and OneTrust.
AI compliance glossary
Plain-English definitions of ML-BOM, TCCE, MITRE ATLAS, CRYSTALS-Dilithium and more.
Writing on evidence integrity
Why metadata-only compliance works without ever touching model weights.
Frequently asked questions
Seventeen direct answers on what SecureGRC sees, what it does not, and how certification works.
Open the platform
Early access opens in 2026. Request a demo to see an ML-BOM and signed evidence bundle.
Find out what's actually in your AI models.
Free compliance assessment. We'll analyse your AI models and show you the gaps. No model access required.