Frequently Asked Questions

AIQ is a cloud-based Governance-as-a-Service platform built for regulated organisations. It provides a single, continuous workflow for identifying AI systems, classifying their risk under regulations like the EU AI Act, managing supplier assurance, tracking obligations across 12 regulatory frameworks, and maintaining an always-ready audit trail — without spreadsheets or manual effort spikes before regulatory reviews.

AIQ is built primarily for compliance, risk, and technology governance teams in regulated financial institutions — banks, insurers, asset managers, payment providers, and fintech firms. It is equally applicable to any organisation that uses or deploys AI systems and is subject to EU AI Act, DORA, NIS2, FCA, or related obligations. Both internal teams managing an AI estate and specialist governance consultants use AIQ.

The platform was designed with the financial sector in mind — it natively supports DORA, PRA/FCA, and regulatory examination requirements common in that sector. However, the underlying governance model applies to any organisation with AI systems in scope of the EU AI Act. Healthcare, public sector, and technology firms also use the platform. The framework library, including NIST AI RMF, ISO 42001, and NCSC CAF, is relevant across industries.

Any AI system — from traditional machine learning models and rule-based decision engines to large language models (LLMs) and GPAI models. AIQ captures technical profiles (model type, training data, deployment modality), business context (use case, sector, affected populations), and regulatory classification (EU AI Act risk tier). It also governs third-party and supplier-provided AI systems through the supplier portal.

Traditional GRC tools are generic control frameworks that treat AI as just another IT system. AIQ is purpose-built for AI governance: it understands EU AI Act Annex III categories, GPAI model requirements, the specific obligations that attach to each risk tier, and the evidence that regulators and auditors expect. The obligation mapping, classification wizard, and supplier portal are all designed around the AI governance lifecycle specifically.

AIQ is fully cloud-hosted SaaS — there is nothing to install, patch, or maintain. You access it through any modern browser. Your data is held in an isolated tenant environment. The supplier portal can be accessed by your third-party AI vendors without requiring them to create accounts or install software on their side for evidence submission workflows.

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It came into force in August 2024 and applies progressively through to 2026. It applies to any organisation that places AI systems on the EU market or uses AI systems within the EU — including non-EU firms whose AI affects EU residents. Obligations vary by risk tier: Prohibited AI is banned outright; High-Risk AI (Annex III) faces extensive requirements around transparency, data governance, human oversight, and conformity assessments; GPAI models have transparency and systemic risk obligations; Limited and Minimal Risk AI has lighter-touch requirements.

AIQ currently supports 12 frameworks: EU AI Act, ISO 27001 (information security), GDPR (data protection), DORA (Digital Operational Resilience Act), PRA/FCA (UK financial regulatory requirements), CSA STAR (cloud security), NIST AI RMF (AI risk management), NIST RMF (general risk management), ISO 42001 (AI management systems), NIST CSF 2.0 (cybersecurity), NIS2 (network and information systems security), and NCSC CAF (cyber assessment framework). Each framework is maintained and updated as regulatory guidance evolves.

AIQ covers the full EU AI Act compliance lifecycle: (1) Inventory — register every AI system in scope with the data needed for regulatory assessment; (2) Classification — a guided wizard screens each system against Annex III categories and determines the applicable risk tier with documented rationale; (3) Obligation generation — the platform automatically assigns the correct obligation set for the determined risk tier; (4) Evidence mapping — upload conformity evidence and map it to specific obligations and controls; (5) Audit readiness — maintain a tamper-evident audit trail and export structured reports at any point. For deployers of third-party AI systems, the supplier portal enables you to collect compliance evidence directly from vendors.

Annex III of the EU AI Act lists the specific use cases that are automatically classified as High-Risk. These include AI used in critical infrastructure, educational institutions, employment and HR decisions, access to essential services, law enforcement, migration and border control, administration of justice, and — most relevant to financial services — creditworthiness assessment, insurance risk, and recruitment. If your AI system falls into an Annex III category, it triggers a full set of mandatory obligations around technical documentation, data governance, human oversight, transparency, and conformity assessment before deployment. AIQ's classification wizard screens each system against all Annex III categories and records the outcome with rationale.

General-Purpose AI (GPAI) models are AI systems trained on broad data intended for a wide range of tasks — large language models like GPT-4, Gemini, or Claude are typical examples. The EU AI Act imposes specific transparency and copyright obligations on GPAI model providers, and additional "systemic risk" requirements on those with very high capability thresholds (≥10²³ FLOPs training compute). AIQ supports the GPAI classification tier in its risk wizard, generates the appropriate GPAI obligation set, and allows you to track evidence for GPAI-specific requirements including model transparency documentation and adversarial testing.

Yes. DORA (Digital Operational Resilience Act) is directly supported as one of AIQ's 12 frameworks. DORA requires financial entities to maintain a register of ICT third-party service providers, conduct risk assessments on critical dependencies, and ensure contractual protections are in place. For AI systems provided by third parties — which are increasingly ICT services under DORA — AIQ's supplier governance module supports the register, the risk assessment workflow, and the evidence collection requirements. DORA obligations are mapped at the control level within the platform.

NIS2 (Network and Information Systems Directive 2) and NCSC CAF (Cyber Assessment Framework) are both natively supported in AIQ. NIS2 applies to operators of essential services and important entities, including many financial institutions, and requires AI-in-scope systems to meet cybersecurity risk management and incident reporting obligations. NCSC CAF is the UK framework used by regulators to assess cyber resilience. Both frameworks are available as obligation sets within AIQ and can be applied to individual AI systems alongside EU AI Act and DORA requirements, enabling you to manage all applicable frameworks from a single evidence base.

Yes. ISO 42001 is the international standard for AI management systems, published in 2023. It provides a structured framework for organisations to establish, implement, and continually improve their AI governance posture. AIQ includes ISO 42001 as a supported framework with obligation mapping at the clause level. Organisations pursuing ISO 42001 certification can use AIQ to track controls, collect evidence, and demonstrate conformance across the management system requirements. ISO 42001 works well alongside EU AI Act compliance — many of the underlying governance activities overlap.

A demo environment can typically be configured within one business day of your trial request. The platform is pre-seeded with representative case studies so you can see realistic data from day one. For production deployment, most teams are conducting their first risk classifications within the first week. There is no infrastructure to provision and no data migration required to start — you begin by registering your AI systems in the inventory and the platform guides you from there.

Onboarding follows four steps: (1) Discovery session — we understand your AI estate, the regulatory frameworks that apply, and your current governance maturity; (2) Environment setup — your tenant is configured with the relevant frameworks activated; (3) Guided walkthrough — a working session covering inventory registration, risk classification, obligation management, and evidence upload; (4) Supplier onboarding — if you have third-party AI systems, we help you configure the supplier portal and send first evidence requests. Professional plan customers receive this onboarding included. Enterprise customers receive dedicated implementation support.

You do not need a complete AI inventory to start. Even a partial list of known AI systems is sufficient to begin. For each system you register, AIQ will prompt you for the information needed — use case, deployment model, data types processed, affected populations, and technical profile. The classification wizard asks structured questions to determine risk tier. You can add systems incrementally. Many teams begin with their highest-risk or most critical AI systems and expand coverage progressively.

Yes. AIQ supports structured data import for AI system inventories from CSV. Evidence files (PDFs, documents, reports) can be uploaded directly through the evidence locker and mapped to the relevant obligations and controls. For organisations migrating from spreadsheet-based tracking, our onboarding team can assist with data structuring. Enterprise customers can discuss API-based integrations with existing GRC or ITSM tooling as part of their implementation plan.

The Professional plan supports up to 25 users across three role types: Admin (full platform access), Business Security Owner/BSO (governance team access), and Supplier (portal-only access for evidence submission). The Enterprise plan has unlimited users. Role-based access control ensures that supplier users only see their own evidence submissions and the systems they are assigned to, protecting data across your supply chain.

AIQ offers two plans: Professional at £799/month — designed for compliance and governance teams managing AI risk across multiple suppliers, with up to 25 users, unlimited AI systems, all 12 frameworks, the supplier portal, advanced assessments, CSV/HTML reporting, and priority support. Enterprise pricing is custom — for large institutions with complex multi-jurisdiction requirements, unlimited users, dedicated account management, SSO/SAML integration, and SLA-backed uptime. See the pricing page for full feature comparison.

Yes. We offer a managed demo environment so you can evaluate AIQ with realistic data before committing. To request a trial, click "Request Demo" or "Start Free Trial" on any page. Our team will set up your demo workspace within one business day. The trial includes pre-seeded case studies covering a High-Risk AI system (AML/fraud detection), a biometric authentication system, and a GPAI-powered tool — giving you a realistic view of the platform in use.

No setup fees. The Professional plan is billed monthly with no minimum commitment — you can cancel at any time. Annual billing is available at a discount. Enterprise contracts are typically annual or multi-year with bespoke terms including data residency, SLAs, and support levels agreed at the time of signing.

Yes. All your data, configurations, and history migrate seamlessly when you upgrade. Many customers start on Professional and move to Enterprise as their governance programme scales or as they onboard additional business units and jurisdictions. Contact us to discuss upgrade timing and commercial terms.

Data residency is configurable on the Enterprise plan, with UK and EU hosting options available. Professional plan tenants are hosted in EU-region cloud infrastructure by default. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We do not use your data to train AI models or share it with third parties. Enterprise customers can request a Data Processing Agreement (DPA) and review our sub-processor list.

AIQ maintains a SHA-256 hash-chained audit log. Every state change — evidence uploads, obligation status changes, user actions, classification decisions — is logged with a cryptographic hash that chains to the previous entry, making retrospective tampering detectable. The audit trail records the actor, timestamp, action type, and entity affected. It can be exported as a structured report for regulatory examination. Administrators can also view the audit chain integrity status within the platform.

Yes. AIQ supports CSV export of AI system inventories, obligation registers, assessment records, evidence metadata, and audit logs at any time — no request needed, no export fees. HTML reports can be generated for individual AI systems and are formatted for print and regulatory submission. Your data is never locked in. If you close your account, we provide a full data export before deletion.

Passwords are hashed using Werkzeug's bcrypt-based PBKDF2 algorithm — they are never stored in plain text. Accounts are subject to lockout after 5 consecutive failed login attempts (30-minute lockout). Password complexity requirements enforce a minimum of 10 characters including uppercase, lowercase, a number, and a special character. Session tokens are HTTP-only, secure, and SameSite=Strict. Enterprise customers can configure SSO/SAML integration to enforce corporate identity provider authentication.

Professional plan customers benefit from standard availability with status updates via our status page. Enterprise customers receive a contractual SLA with defined uptime targets, incident response times, and escalation paths. All environments are backed by automated database snapshots and point-in-time recovery capability. Maintenance windows are communicated in advance and scheduled outside business hours.

The supplier portal gives your third-party AI vendors a controlled view of the evidence requirements you have set for their systems. Suppliers receive a login credential, see only the AI systems and obligations assigned to them, and can upload compliance documents, technical specifications, test reports, and other evidence directly. Your governance team reviews submissions, can request clarification or additional evidence, and maps accepted items to the relevant obligations. All supplier activity is captured in the audit trail.

No. Supplier portal access is included in your plan at no extra cost to you or your suppliers. Suppliers access the portal through a standard browser — no software installation, no subscription of their own. Their access is limited strictly to the information relevant to them, and your Admin team controls all permissions.

Yes. There is no limit on the number of suppliers or AI systems you can manage. The inventory and supplier register provide filterable views across your entire AI estate. Each supplier can have multiple AI systems assigned to them, each with its own obligation set, evidence requirements, and assessment schedule. The governance dashboard gives you a consolidated view of compliance posture across all suppliers simultaneously.

Each evidence item can have an expiry date. As the expiry approaches, AIQ displays "SOON" warning badges and sends automated email alerts to the responsible team. After expiry, items are flagged as "OVERDUE." The system tracks due dates across all obligations and sends consolidated alerts, so your team is never caught out by lapsed certifications, expired test reports, or outstanding evidence requests. A calendar view shows upcoming evidence milestones across your entire AI estate.

AIQ supports all modern browsers: Chrome (recommended), Firefox, Safari, Edge, and Arc. Internet Explorer is not supported. No browser extensions or plugins are required. The platform is fully responsive and works on mobile and tablet devices — all pages, including the governance dashboard, evidence locker, and supplier portal, are designed to be usable on phones.

A REST API is available on the Enterprise plan, enabling programmatic integration with internal GRC tools, ITSM platforms, model registries, and data pipelines. The API supports reading and writing AI system records, evidence metadata, obligation status, and assessment data. API documentation and sandbox access are provided to Enterprise customers during onboarding. If you have specific integration requirements, discuss them with us during your discovery session.

Evidence uploads currently support PDF, TXT, and PNG files, with a 16 MB per-file limit. PDF is the most common format for policy documents, test reports, certification records, and technical specifications. If you need to upload additional file types (e.g., DOCX, XLSX, CSV), discuss this with your account manager — file type expansion is available on Enterprise plans.

The Wanlogix regulatory intelligence team monitors regulatory publications, guidance updates, and consultation papers across all 12 supported frameworks. When regulatory guidance changes — for example, updated EU AI Act delegated acts, revised DORA implementing technical standards, or new FCA supervisory statements — the framework obligation library is updated and all tenant instances receive the changes. You will be notified of material framework updates via in-platform notification and email.

AIQ is a governance and record-keeping platform, not an AI system that makes consequential decisions. It does not perform automated decision-making about individuals, does not use trained AI models in its core workflow, and does not fall within the Annex III High-Risk categories. As a SaaS tool used by compliance teams, it is outside the scope of the EU AI Act's direct obligations. That said, Wanlogix maintains its own governance documentation and follows the same practices it advocates for customers.