Examples
11 organisations, none of them real, run through RiskWoven end to end. Every document below was produced by the live product from the scenario described — not written by hand for a brochure. 21 documents.
Each scenario states what the organisation does, what its AI touches and what governance it already has. Some of these organisations are in poor shape, and the documents say so. An example set where everyone passes tells you nothing about the product.
Generated 2026-09-09 · engine agents-2026.09.3 · each document passed the same independent review stage a customer's output does.
42-person health SaaS running an AI triage assistant over referral letters. Personal health information, clinician in the loop but no written oversight procedure.
310-person credit union using an AI model to pre-adjudicate small consumer loans. Automated decisions about people, limited human review.
22-person design studio using AI for copy and image drafts. No personal data of consequence, no automated decisions.
280-person freight firm with in-cab AI cameras scoring driver behaviour. Biometric-adjacent monitoring of employees, union workforce.
90-person law firm using AI for document review and drafting. Privileged client information, no AI governance at all.
340-person municipality using AI to triage service requests and screen grant applications. Public-sector decisions about residents.
55-person recruitment agency screening CVs with AI ranking. Employment decisions about people, the highest-scrutiny AI use there is.
420-person manufacturer using AI for visual quality inspection and predictive maintenance. No decisions about people, but operational safety exposure.
70-person education provider using AI tutoring and automated marking for learners aged 14 to 18. Information about children.
260-person retailer using AI for product recommendations and dynamic pricing. Consumer personalisation, moderate exposure.
195-person energy services firm using AI agents that take actions on grid data without a human in the loop. The agent-governance scenario.
Documents are one output. These are the others, produced the same way from the same scenarios.
The full assessment for one of the fictional scenarios, named on its cover: assessed score with its reasoning, domain findings, risk register, mitigation plan, monitoring and the limitations of the method. Produced by the risk narrative agent and cleared by an independent review stage.
A review of a hosted forecasting vendor from its own terms. Eleven findings, six to escalate: training on customer data by default, subprocessors changeable without notice, undisclosed hosting region, uncapped log retention, no model version history. It also states which documents the vendor never provided and which findings therefore cannot be made.
Five customer security questions answered from the organisation's own documents, each answer carrying its status and, where the workspace could not support an answer, the gap that has to be closed first.
A quarterly privileged access review assessed against the control it claims to support: what it evidences, what it does not, what a reviewer would ask next, and the controls it maps to.
Assets checked against CISA's Known Exploited Vulnerabilities catalog, with what each finding matched on. Vulnerabilities outside that catalog are not covered, and the page says so rather than implying a clean scan.
The report delivered beside the planning workbook: engagement details, the readiness position, priority actions, the readiness assessment with its gaps, the information the organisation must supply, the implementation plan and clause coverage. Produced for a fictional organisation and copied page for page behind a specimen cover.
A fictional legacy policy run through the converter: every obligation it places on a person, with the responsible party and when it applies, written out as numbered procedure steps. Obligations the text implies rather than states are marked for the policy owner to confirm.