Every tool below runs in your RiskWoven workspace, so using one needs an account: sign in with your email and a one-time code. The free AI risk scan and the examples need no account at all.
Assess
Understand what you have and how risky it is
AI Governance
Structured intake on your AI systems, data, oversight and vendors. Produces a scored assessment where every number shows its factors, its weights, and why it is not higher or lower.
For: Anyone who has been asked how they govern AI and needs a defensible answer.
Certification Readiness
Choose a target: ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701 or ISO 22301. Get a gap analysis specific to your organisation, the evidence a reviewer will expect for each gap, and the order to do the work in.
For: Teams preparing for a first certification or a renewal.
Inventory
Register systems and assets, import an SBOM, and receive vulnerability findings prioritised by real exposure rather than CVSS alone. A critical score on an isolated test rig is not the same as one on a public API.
For: Whoever owns the asset list and the patch queue.
Build
Produce the documents a reviewer expects
Policy & Standards Studio
Twenty-eight document types: policies, standards, procedures and one custom process. Each is written for your organisation from your intake, not a template with your name substituted, and every output passes an independent review before release.
For: Anyone who needs a policy set that reads as theirs.
Policy Converter
Upload a policy you already have. It extracts every obligation the document places on a person, with the actor, the trigger and the source sentence beside each one, so you can see what your existing policy actually commits you to before you rewrite it.
For: Teams with legacy policies nobody has read in years.
Framework Library
A maintained library of frameworks, standards and regulations, described in our own words and cited to identifiers. Change tracking tells you when a source moved and whether the change was substantive or cosmetic.
For: Anyone tired of finding out about a framework update from a customer.
Operate
Keep it current and answer the people asking
Evidence Register
Log evidence and map it to controls. The register tells you which controls have nothing behind them, which evidence has gone stale, and rejects a mapping that does not hold, such as an access review offered as proof of encryption.
For: Whoever gets asked to prove it.
Security Questionnaires
Paste a customer questionnaire. Answers are drafted only from evidence you actually hold. A question with no supporting evidence is left unanswered and flagged, never filled with a hopeful yes.
For: Sales and security teams with a questionnaire due.
AI Agent Governance
Upload the agent inventory template and every row is grouped into classes by configuration, so two hundred seats of one Copilot setup are assessed once rather than two hundred times. Each class is scored on autonomy, tool access, data sensitivity and blast radius, with a named contributor for every point deducted. A blank cell is treated as a gap to close, never as a clean answer.
For: Anyone who has to say what their AI agents may do and who can stop them.
Vendor Intake
Review an AI vendor's SOC report, privacy policy and terms before signing. Flags whether your data trains the vendor's models and whether that is opt-in or opt-out, retention periods, subprocessor chains, where models are hosted, and any right the vendor keeps to change those terms, each with the clause location.
For: Anyone signing an AI vendor contract.
My Workspace
Every document you have generated, every assessment, every review, in one place, with an assistant that answers questions from your own records and nothing else.
For: Everyone with an account.
When you need a person
Professional Review
Send any generated document to a practitioner for a signed review when a customer, board or auditor needs a human name on it. Priced per document, and only when you ask for it.
What it costs
The registers, the planning workbook and the framework library are free with an account. The AI work is paid, one-time: the AI Risk Assessment, the Policy Pack, the Readiness Bundle and the AI Agent Governance Pack. Each tool's own page says exactly what is included and where.