AI Governance
How well your organization governs AI: accountability, risk, impact, transparency, fairness, EU AI Act, US state and sector rules, and ISO 42001 certification readiness.
AI-powered audit & compliance readiness
AI-powered audit readiness. Know where you stand before the auditor does.
AI Audit Helper turns ISO 27001, ISO 42001, NIST, SOC 2, HIPAA, GDPR, EU AI Act and 140+ more standards into a guided self assessment. An AI decision model (TypeSafe's Jev) scores your answers, an AI recommendations engine tells you exactly how to close each gap, and AI helper agents answer questions as you work.
A self assessment and readiness preparation tool. It is not a substitute for a formal audit.
AI decision modeling
AI recommendations engine
AI chat & helper agents
12assessment types
150standards & frameworks
140categories
4,720controls & clauses
12 assessment types, 150 standards
An AI compliance assessment for every part of the business
From AI governance, AI security and medical devices to laboratories, data, AML, cloud and software maturity, pick the assessments that match your audits. Watch a quick tour or full tour of any of them.
AI Security & Compliance
AI governance, model and LLM security, data protection and responsible AI against ISO 42001, NIST AI RMF, the EU AI Act, SOC 2 and the OWASP LLM Top 10.
Medical Device Quality System
Quality management for medical devices: design controls, risk management and CAPA against FDA QMSR, ISO 13485, ISO 14971 and EU MDR.
Medical Device Software & SaMD
Medical device software and SaMD lifecycle, usability and cybersecurity against IEC 62304, IEC 62366-1, FDA 524B and IMDRF.
Testing & Calibration Laboratories
Testing and calibration laboratory readiness for ISO/IEC 17025:2017 accreditation, with ILAC traceability and decision rules, uncertainty, GLP and cGMP overlays.
Medical & Clinical Laboratories
Medical and clinical laboratory readiness for ISO 15189:2022, CLIA and CAP-style inspections, from pre-examination to critical result reporting.
Strategic Data Assessment
Data governance, quality, architecture and lifecycle maturity against DAMA-DMBOK2, DCAM, CDMC, BCBS 239 and ISO 8000.
AML/CFT Compliance
Bank Secrecy Act and anti money laundering program readiness: CIP, CDD, sanctions screening, monitoring and reporting against FinCEN, OFAC and FATF.
Cloud Migration Readiness
Cloud migration readiness and landing-zone maturity against AWS, Azure, Google Cloud and Oracle Well-Architected frameworks.
Overall IT Security
Enterprise IT security posture across governance, identity, network, endpoint, data and incident response, aligned to NIST CSF, CIS Controls and ISO 27001.
SDLC Maturity
Secure software development lifecycle maturity from requirements to release and supply chain, against NIST SSDF, OWASP SAMM/ASVS and SLSA.
Business Process Risk
Business process risk and internal controls using COSO, ISO 31000 and COBIT, including segregation of duties and continuity.
How it works
From first answer to audit-ready, guided by AI
A process built to mirror how a real audit is scoped and tested.
Choose your standards
Pick the assessment type, the standards that apply, the categories that matter and how much each one weighs, then name your assessment.
Answer in your own words
Describe what you actually do. Jev, TypeSafe's decision model, rates it on a five-level scale that you can confirm or override. Delegate any question to the person who knows the answer.
Jev decision model from TypeSafeGet a weighted score
Maturity is scored per control, rolled up by category and weighted into one overall readiness score driven by AI-assessed answers.
AI-assessed scoringClose the gaps
Our AI recommendations engine writes prioritized, control-specific actions to move you from at risk to audit ready.
AI recommendations engine
Built on AI, from first answer to final report
AI decision modeling, an AI recommendations engine, and AI helper agents
Compliance work is slow because every answer needs a judgment call. We put decision modeling and large language models to work on those judgments so your team spends its time fixing gaps, not debating scores.
Decision modeling: Jev from TypeSafe
Describe in your own words what you do for a control. Jev, TypeSafe's structured decision model, reads the answer and returns a typed maturity rating, not free-form text, that you can review and change.
- Returns a rating, not prose: consistent every time
- You confirm or override every suggestion
- Feeds the weighted readiness score
AI recommendations engine
For each weak or missing control, an LLM-powered recommendations engine writes specific next steps that reflect your own answers, prioritized by impact.
- Prioritized, control-specific next steps
- Written for your situation, not boilerplate
- Updated the moment your answers change
AI chatbots & helper agents
Stuck on a term or a clause? Ask your Assistant. It uses vectorless RAG: an LLM navigates a tree of help topics, section by section, and reads only the ones it needs. No embeddings, no vector database. It answers from those topics and links to the source.
- Context-aware help while you work
- LLM navigates the help tree, then answers from what it read
- Voice in and out in the browser
- No waiting on a support ticket
AI suggestions support, and never replace, your team's judgment. Every AI score can be reviewed and overridden, and AI Audit Helper is a readiness tool, not an audit.
A report that tells you exactly where to focus
Every assessment ends with a clear breakdown, plus AI-written recommendations for each gap.
Compliant
- Controls evidenced and mature
- What to keep monitoring
Moderately compliant
- A few items from audit ready
- Quick wins ranked first
Not compliant
- Highest-priority gaps
- AI-written remediation steps
Tailored to you
Only answer what applies to your audit
Every assessment is configurable. Choose just the standards and frameworks you will be audited against, keep the categories that matter, and weight them to reflect your risk. The questions, scoring and report follow your selections.
- Choose the assessment typeOne of 12, such as AI Security & Compliance or Cloud Migration Readiness.
- Select your standards & frameworksISO 42001, NIST AI RMF, SOC 2, HIPAA, EU AI Act and more. Unselect what does not apply.
- Pick categories and set weightsEmphasize the areas your auditors care about most.
Frameworks auditors actually use
150 standards and frameworks, one workflow
Answer once and satisfy every framework the control maps to. No re-work per audit.
21 CFR Part 11 (Electronic Records and Signatures)
ACA Section 1557 (Patient Care Decision Support Tools)
Australia Voluntary AI Safety Standard
AWS Well-Architected Framework
Azure Well-Architected Framework
Bank Secrecy Act (BSA)
Basel AML/CFT Guidelines
BCBS 239
BSIMM (Building Security In Maturity Model)
California AI Laws (SB 53, AB 2013, AI Transparency Act)
CAP Laboratory Accreditation Program
CCPA/CPRA
CDMC
CIS Benchmarks
CIS Controls v8
CLIA (42 CFR Part 493)
CLSI Quality and Method Evaluation Guidelines
CMMC (Cybersecurity Maturity Model Certification)
CMMI Data Management Maturity Model (DMM)
CMMI for Development
COBIT 2019
Colorado ADMT Act (SB 26-189)
COSO ERM Framework
COSO Internal Control - Integrated Framework
Council of Europe Framework Convention on AI
CSA CCM
DAMA-DMBOK2
DCAM
DORA (EU Digital Operational Resilience Act)
ECOA, Regulation B and FCRA (Credit Decisions and AI)
EU AI Act
EU Anti-Money Laundering Directive (AMLD)
EU DORA (Digital Operational Resilience Act)
EU Ethics Guidelines for Trustworthy AI
EU GPAI Code of Practice
EU MDR 2017/745 (Medical Device Regulation)
FAIR Data Principles
FATF Recommendations
FDA cGMP Laboratory Controls (21 CFR 211 Subpart I)
FDA GLP (21 CFR Part 58)
FDA Guidance on AI-Enabled Device Software and PCCPs
FDA QMSR (21 CFR Part 820)
FDA Section 524B (Premarket Cybersecurity Requirements)
FedRAMP
FFIEC BSA/AML Examination Manual
FinCEN AML Program Rule
FinCEN Beneficial Ownership Rule
FinCEN CDD Rule
FinCEN SAR/CTR Rules
FinCEN Travel Rule
FINRA Rule 3310
FTC Act Section 5 (AI Claims and Deceptive Practices)
G7 Hiroshima Code of Conduct (Advanced AI)
GDPR
Google Cloud Architecture Framework
HIPAA
IEC 60601-1 (Medical Electrical Equipment Safety)
IEC 62304 (Medical Device Software Life Cycle)
IEC 62366-1 (Usability Engineering for Medical Devices)
IEC 82304-1 (Health Software Product Safety)
IEEE 7000 (Ethics in System Design)
IEEE 7001 (Transparency of Autonomous Systems)
IEEE 7002 (Data Privacy Process)
IEEE 7003 (Algorithmic Bias Considerations)
IEEE 7010 (Well-Being Impact Assessment)
ILAC G8 (Decision Rules and Statements of Conformity)
ILAC P10 (Metrological Traceability Policy)
ILAC P9 (Proficiency Testing Participation Policy)
Illinois AI Laws (AI Safety Measures Act, Human Rights Act AI Amendments)
IMDRF SaMD Framework
ISO 10012 (Measurement Management Systems)
ISO 13485:2016
ISO 14971 (Medical Device Risk Management)
ISO 15189:2022
ISO 15190:2020 (Medical Laboratory Safety)
ISO 15489
ISO 22301
ISO 22367:2020 (Risk Management in Medical Laboratories)
ISO 23894
ISO 27001
ISO 27002
ISO 27017
ISO 27018
ISO 27701
ISO 31000
ISO 31010
ISO 37301
ISO 42001
ISO 8000
ISO 9001
ISO/IEC 11179
ISO/IEC 12207
ISO/IEC 17025:2017
ISO/IEC 17788/17789
ISO/IEC 22989 (AI Concepts and Terminology)
ISO/IEC 23053 (ML-Based AI Systems Framework)
ISO/IEC 25012
ISO/IEC 27090
ISO/IEC 38505-1
ISO/IEC 38507 (Governance Implications of AI)
ISO/IEC 42005
ISO/IEC 42006 (Requirements for AIMS Certification Bodies)
ISO/IEC 5259 (Data Quality for Analytics and ML)
ISO/IEC 5338 (AI System Life Cycle Processes)
ISO/IEC Guide 98-3 (GUM)
ISO/IEC TR 24028 (Trustworthiness in AI)
MITRE ATLAS
NAIC Model Bulletin on AI in Insurance
NIST AI 100-2 (Adversarial Machine Learning)
NIST AI 600-1 (Generative AI Profile)
NIST AI RMF
NIST CSF 2.0
NIST Privacy Framework 1.0
NIST SP 1500 (Big Data Interoperability Framework)
NIST SP 800-171
NIST SP 800-218 (SSDF)
NIST SP 800-53
NYC Local Law 144 (Automated Employment Decision Tools)
NYDFS Part 504 (Transaction Monitoring and Filtering Program Requirements)
OECD AI Principles
OECD Principles of GLP
OFAC Sanctions Regulations
OMB AI Memoranda (M-25-21, M-25-22)
ONC HTI-1 (Decision Support Interventions)
Oracle Cloud Infrastructure Well-Architected Framework
OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)
OWASP Agentic AI Threats and Mitigations
OWASP ASVS
OWASP LLM Top 10
OWASP Machine Learning Security Top 10
OWASP SAMM
PCI DSS v4.0
PRA SS1/23 (Model Risk Management Principles)
Sarbanes-Oxley Act (SOX)
Singapore Model AI Governance Framework
SLSA
SOC 2
South Korea AI Basic Act
SOX
SR 26-2 (Model Risk Management Guidance)
SWEBOK (Guide to the Software Engineering Body of Knowledge)
Texas TRAIGA (HB 149)
TMMi (Test Maturity Model integration)
UK AI Management Essentials (AIME)
UK Money Laundering Regulations 2017 (MLR)
UNESCO Recommendation on the Ethics of AI
US Anti-Discrimination Laws Applied to AI (Title VII, ADA, ADEA)
USA PATRIOT Act
Utah AI Disclosure and Content Provenance Laws
Wolfsberg AML Principles
Why teams choose AI Audit Helper
Faster readiness, fewer surprises
Find gaps before they do
Surface weak or undocumented controls while there is still time to fix them.
AI-prioritized, not overwhelming
The recommendations engine ranks actions by impact so you fix what matters first.
Multiple frameworks, one workflow
Map a single answer to every standard it satisfies.
Built for teams
Org admins manage users, organize teams and delegate individual controls to the right people.
Consistent AI scoring
Jev rates every narrative answer on the same five-level scale, from Not Implemented to Fully Implemented & Audited, with human override.
Help when you need it
Ask your Assistant, an AI helper agent, explains terms and features without leaving the page.
Start with a free trial
Try AI Audit Helper with your own team. Tell us about your organization and we will activate your trial.
1Org Admin
5users total
3teams
30days
Already have an account? Login
Frequently asked questions
What is AI Audit Helper?
AI Audit Helper is an AI-powered audit readiness and compliance self assessment platform. It turns standards such as ISO 27001, ISO 42001, NIST AI RMF, SOC 2, HIPAA, GDPR and the EU AI Act into guided questions, scores your answers with an AI decision model, and gives prioritized recommendations to close gaps before a real audit.
How does the AI decision model (Jev) work?
You describe in your own words what your organization does for each control. Jev is TypeSafe’s decision modeling offering: a structured decision model (TypeSafe calls it a System One model) that returns a typed choice rather than free-form text. It reads your answer and returns a maturity rating from Not Implemented to Fully Implemented & Audited. You can change any rating, and the ratings roll up into a weighted readiness score.
How are the AI recommendations generated?
The AI recommendations engine uses large language models to write specific, prioritized next steps for each weak or missing control, based on your own answers. Recommendations are prioritized by gap and update automatically when your answers change.
Which standards and frameworks are covered?
There are 12 assessment types covering 150 standards and frameworks, 140 categories and 4,720 controls. Examples include ISO 27001, ISO 42001, NIST CSF 2.0, NIST AI RMF, SOC 2, HIPAA, GDPR, EU AI Act, ISO/IEC 17025, ISO 15189, CLIA, PCI DSS, FedRAMP, CMMC, COBIT, COSO, DAMA-DMBOK2, FinCEN and FATF AML rules, ISO 13485, IEC 62304, OWASP LLM Top 10, OECD and UNESCO AI principles and US state AI laws.
Can I assess only the standards that apply to me?
Yes. Every assessment is configurable. All standards start selected, and you unselect those that do not apply, keep the categories that matter and set category weights. The questions, scoring and report follow your selections.
What is included in the free trial?
A trial license includes one Org Admin, a total of 5 users and 3 teams, for 30 days. Request a trial with the form on this page; we review each request and activate your trial by email.
Is AI Audit Helper a replacement for a real audit?
No. It is a self assessment and audit readiness preparation tool. It does not perform, certify or substitute for a formal third party audit or certification, and AI-generated scores and recommendations are advisory.
Is my data private?
Each organization’s data is isolated from every other organization. Access inside your organization is controlled by roles (admin, member, viewer) and by team and delegation settings.
Is there an AI chatbot or helper agent?
Yes. Ask your Assistant is an AI helper agent built on vectorless retrieval-augmented generation (RAG). Instead of searching a vector database, a large language model navigates the product’s help topics as a tree of sections and topics, picks the few it needs, and writes a short answer using only those, with a link to the source. There are no embeddings and no vector database. It can also speak and listen in the browser.