What it holds
- Each AI system, with its owner, purpose and classification.
- The obligations that apply to it, across every framework in your scope.
- The controls, and the evidence that each one operates.
- Who approved each item, and when it was last reviewed.
- The documents produced, and the sources behind each claim in them.
- Buyer questionnaires answered from a governed library, with the underlying evidence linked.
How we use it during engagements
The platform is where the engagement runs. We build the AI inventory in it, capture obligations against every system, and record each control with the evidence that proves it operates. Every approval and review is dated and attributed. Nothing sits in a document that ages the moment it is signed.
Where you already run Vanta, Drata or Secureframe, we work within it and configure it properly. Where you do not, the engagement runs on the Hael platform and it is included at no additional charge.
How you use it afterwards
When the engagement ends the platform remains yours as an operational system of record. It is where you record new AI systems as they are introduced, re-test controls on schedule, answer the next buyer questionnaire from a governed library rather than from memory, and keep the position current as frameworks and regulations move.
The record is designed to be examined. When a buyer, auditor or regulator asks a question, the answer is on file with its evidence, its owner and the date it was last reviewed.
Why it matters after the audit
Compliance work usually produces a set of documents that begin ageing the day they are signed. When a buyer asks a question nine months later, someone reconstructs the answer from memory and files.
A maintained record answers the question directly, and shows when the answer was last checked.
What is included
- AI inventory with owners, purpose, classification and lifecycle status.
- Obligations library mapped across ISO/IEC 42001, SOC 2, ISO 27001, EU AI Act, NIST AI RMF and GDPR.
- Controls register with evidence, review cadence and approver of record.
- Buyer assurance answer library, versioned and sourced.
- Regulatory change tracking against your scope.
- Access for your team; export of everything you hold.