AI governance & compliance

Your staff already use AI. Now govern it.

Lavawall® AI governance puts six AI frameworks (NIST AI RMF 1.0, ISO/IEC 42001:2023, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications, and Canadian AI governance) into the same control set as its other frameworks, and fills them with dated evidence: AI apps with mail and file access in Microsoft 365 and Google Workspace, shadow AI found by SaaS Discovery, Copilot and Gemini activity records, AI tools on computers, AI browser extensions, and AI services exposed online. It is part of the Compliance/GRC package.

Last updated 5 November 2026

Lavawall secures how your organization uses AI tools. It does not test or protect AI models or applications you build, and it does not filter prompts or block AI traffic.

See everything Lavawall shows about AI use on the AI security page, including agentic AI discovery.

Start with the GRC Wizard See GRC & compliance

NIST AI RMF · ISO/IEC 42001 · ISO/IEC 27090 · EU AI Act readiness · OWASP Top 10 for LLMs · Canadian AI governance · Over 160 frameworks in all

Six AI frameworks, one control set

Find the shadow AI first

Built from the security and IT data you already have, Lavawall detects the AI tools in use across your environment, including the ones nobody logged. You can't govern what you can't see, so this is where governance actually starts.

The right framework, recommended for you

Based on what it finds and how you operate, Lavawall suggests the AI framework that fits; you decide which to adopt.

Satisfy one control, cover many

The AI frameworks share a single control set with your security and privacy frameworks. A control you turn on typically counts across NIST, ISO, EU, OWASP, and Canadian expectations at once, and toward SOC 2, ISO 27001, or PIPEDA where they ask for the same thing, so you cover them all without separate projects.

Policies and disclosures, generated

Lavawall generates the AI policies your team needs and the disclosures your clients and regulators expect, matched to the framework you're adopting and kept current, not copied from a stale template.

Plain language anyone can use

Every step is explained in language a non-specialist can follow, so a small team can stand up credible AI governance without hiring an expert or decoding a standard line by line.

A live view of where you stand

See which AI controls are in place, which are open, and how to close them, per framework, so AI governance becomes an ongoing score instead of a one-time scramble.

The six AI frameworks you can adopt

NIST AI RMF

The US AI Risk Management Framework for identifying, measuring, and managing AI risk across its lifecycle.

ISO/IEC 42001

The international standard for an AI management system, the ISO 27001 equivalent for AI.

ISO/IEC 27090

International guidance on the security threats specific to AI, from prompt injection to data poisoning, for organizations that use AI as well as those that build it.

EU AI Act readiness

Prepare for the risk-tiered obligations of the EU AI Act before they apply to your use of AI.

OWASP Top 10 for LLM Applications

The security baseline for anyone building or deploying large-language-model features.

Canadian AI governance

Align with Canada's direction on responsible and accountable AI use.

AI evidence, gathered automatically

Much of the evidence for AI security already sits in the systems Lavawall® connects to, so it is tested against live data instead of answered from memory.

Connected AI apps and agents: AI apps and AI agents connected to Microsoft 365 and Google Workspace, and whether they can read mail and files.
Shadow AI: AI apps found through SaaS discovery, and whether each one is approved.
Copilot and Gemini activity: whether Microsoft 365 Copilot and Gemini activity is recorded, and whether the misuse attempts Copilot itself flags are reviewed.
AI on computers: AI tools and local model servers installed on computers.
AI browser extensions: extensions that can read every website a person visits.
AI services on your network: AI services listening on computers or open on the internal network.
AI services on the internet: model servers, AI chat interfaces, and notebooks the domain scan finds exposed to the internet.

Each check keeps a dated history and counts toward every AI framework that asks for the same control. See how it maps to ISO/IEC 27090.

Every framework, one engine

Every framework Lavawall supports

Over 160 frameworks in all. Your AI governance runs in the same control set as the security, privacy, and industry frameworks your clients, insurers, and regulators already ask about. Turn on a control once and it counts toward every framework below that asks for the same thing.

Frameworks, standards, and regulations Lavawall® maps and evidences:

Security & governance

Privacy

Payment card

Energy & critical infrastructure

Government & public sector

Healthcare

AI governance

Financial services

Open the full categorized framework directory →

Works with the rest of the platform

Shadow IT discovery

See the unsanctioned apps and AI tools in use before they become an incident.

Learn more →

GRC & compliance automation

Run your AI frameworks alongside your security and privacy frameworks in one engine.

Learn more →

Trust Centre

Publish your responsible-AI commitments where prospects and clients can see them.

Learn more →

Frequently asked questions

Which AI frameworks does Lavawall support?

Six AI-specific frameworks: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications, and Canadian AI governance. They share one control set with the rest of the frameworks Lavawall supports, so a control you satisfy once counts across every framework it maps to.

What other frameworks does Lavawall support besides the AI ones?

Over 160 in all, across security and governance, privacy, payment card, energy and critical infrastructure, government, healthcare, and financial services. They include SOC 2, ISO 27001, NIST CSF, CIS Controls, CMMC 2.0, PCI DSS, HIPAA, PIPEDA, and Quebec's Law 25. The full list is on this page and in the framework directory.

How does Lavawall know which framework I need?

Lavawall looks at the AI tools found in your environment and suggests a framework that fits. You decide which framework to adopt, and you can adopt more than one.

What is shadow AI and why does it matter?

Shadow AI is any AI tool your staff adopt on their own, without review, often pasting company or client data into them. It creates data-leakage and compliance risk you cannot see. Lavawall surfaces the AI already in your environment so you can govern it instead of hoping it isn't there.

Do I need an AI expert to use this?

No. Lavawall suggests a framework that fits, generates the matching policies and disclosures, and explains each step in plain language, so a small team can stand up credible AI governance without hiring a specialist.

Does adopting one framework help with the others?

Yes. Because the frameworks share one control set, progress on one framework advances the others at the same time, which is how you cover NIST, ISO, EU, OWASP, and Canadian AI expectations, and your security and privacy frameworks, without separate projects.

What AI evidence does Lavawall gather automatically?

AI apps and AI agents connected to Microsoft 365 and Google Workspace and whether they can read mail and files, AI apps found through SaaS discovery and whether they are approved, whether Microsoft 365 Copilot and Gemini activity is recorded and whether the misuse attempts Copilot itself flags are reviewed, AI tools and local model servers on computers, AI browser extensions that can read every website, AI services listening on computers or the internal network, and AI services the domain scan finds exposed to the internet. Each check keeps a dated history.

Start with the GRC Wizard →See GRC & compliance