RAIC Platform Support & Documentation

Step-by-step walkthrough of the 10 in-platform setup tasks every new Organization Administrator should complete on day one. Includes a downloadable branded DOCX guide.

For business owners and technical leads submitting a new AI use case via the public intake portal. Walks through the five on-screen sections and includes a downloadable branded DOCX guide.

Walkthrough of the RAIC AI risk assessment wizard: scoping, control mapping, evidence capture, and reviewer sign-off.

Walkthroughs for managed service providers — the MSP Partner Portal demo and the end-to-end partner onboarding video.

Walkthroughs for onboarding a client organization — the general RAIC tour plus Starter and Professional tier onboarding.

Task tutorials — how to complete a specific RAIC form or workflow, field by field, including use case intake and approvals.

ISO 42001 A.4.5 AI System Requirements Register: per-system functional, intended-use, and regulatory requirements with MoSCoW prioritization, sign-off, and versioning.

Learn how to register, submit, and manage AI use cases through the governance workflow.

Understand how to register AI systems, manage lifecycle stages, and track approvals.

Explore the controls framework including the 8-step wizard and 7-stage approval workflow.

The organization-wide risk register with dual inherent and residual scoring, an interactive 5x5 likelihood-by-impact heatmap, treatment plans, owners, review cadence, and linkage back to AI Systems, Use Cases, and Controls.

How RAIC finds AI in use across your estate: browser-extension telemetry, Microsoft Graph scans, the curated AI catalog of web, model, and API entries, unknown-signal triage with confidence-based auto-promotion, and promotion into the AI Systems register.

The AI Maturity dashboard and its scoring engine: Governance Maturity Index (GMI), Cyber Governance Maturity Index (CGMI), and Total Governance Posture (TGP), what feeds each sub-metric, the daily snapshot job, and how to read the trend charts.

Configure and monitor the RAIC cyber hygiene program: baseline checks, review cadence, the remediation workflow, and how hygiene results roll into reporting.

ISO 42001 A.6.2.6 operation monitoring: runtime metrics ingestion, thresholds and alerting, incident escalation paths, and the audit trail for monitored AI systems.

Run phishing simulation campaigns from RAIC: pick templates, target audiences, track click and report rates, and drive awareness training follow-up for users who fall for a lure.

ISO 42001 Annex A.7 Dataset Registry: sensitivity tiers, PII flags, provenance, quality criteria, and AI System linkage.

ISO 42001 Clause 7.2 / Annex A.4.6 Training & Competence: course catalog, per-user assignments, completion evidence, and validity expiry tracking.

ISO 42001 Annex A.7.6 Data Lineage: directed edges, interactive graph view, and cycle detection across datasets, AI systems, and use cases.

The AI Data Governance control plane inspects content flowing into AI tools, classifies sensitive data with patterns and Named Entity Recognition, and applies allow, mask, or block policy inline or after the fact.

Governance agents that watch continuously and bring you decisions, not alerts: Shadow AI triage, evidence freshness, supplier document intelligence, and compliance drift — each with configurable autonomy and a human-reviewed proposal inbox.

ISO 42001 Annex A.10.4 Customer Transparency Register: customer, regulator, and public disclosures with supersede and withdraw actions plus expiry watch.

ISO 42001 A.3.3 anonymous concerns channel: hCaptcha-protected public form, per-IP rate limiting, rotatable submission token, OrgAdmin triage queue, and full audit trail.

ISO 42001 A.5.5 AI System Impact Assessments: societal, environmental, economic, and human-rights impact register with a staged workflow and branded DOCX exports.

ISO 42001 Clause 7.5 Documented Information INDEX register: 11 doc types, 5-state lifecycle, 15 linked-module backfill targets, branded CSV + DOCX exports.

ISO 42001 Clause 7.1 AIMS Resources & Infrastructure register: people, infra, tooling, data, budget, and external services with adequacy review, scheduling, and AI-Systems / Suppliers backfill.

ISO 42001 A.10.3 Suppliers & Third-Party Risk register: sub-processors (GDPR Art. 28), DPA evidence, AI System linkage, and Mark-Reviewed scheduling.

The mental model behind RAIC: organizations and tenancy, how AI Systems differ from Use Cases and Controls, inherent versus residual risk, the evidence and approval lifecycle, how framework mappings work, and a full glossary of platform terms.

Reusable ISO/IEC 42001 platform control statements shipped with RAIC and how to tailor them for your Statement of Applicability.

Reusable CIS Controls v8 platform statements shipped with RAIC and how to tailor them for cybersecurity assessments.

Discover the role-based access control model and what each role can do in RAIC.

The MSP Partner Portal: the multi-tenant client launcher, demo sandboxes for prospects, quarterly business review reporting, Shadow AI discovery engagements, and the partner-level role model.

Partner-facing guide to the $99/mo White-Label add-on: branded Partner Portal shell, transactional emails, DOCX/XLSX/CSV exports, per-client overrides, Stripe checkout, renewal behavior, and audit trail.

How partners run Shadow AI discovery engagements for prospects and clients: scoping the engagement, rolling out the browser extension, working the findings workspace, and producing the client-ready discovery report.

Install canonical RAIC document templates — discovery packages, onboarding guides, report templates — straight into your firm's Partner Docs library, then version and rebrand them for client delivery.

Isolated workspace for external ISO 42001 auditors: engagement scope, checklist, evidence review, findings capture, branded DOCX report, and the promote-to-nonconformity workflow.

The EU AI Act compliance workbench: declare your actor role (provider, deployer, importer, distributor), classify systems against the prohibited / high-risk / limited / minimal tiers, work the Annex III triggers, and track each obligation to evidence.

NIST Cybersecurity Framework 2.0 coverage in RAIC: the six functions (Govern, Identify, Protect, Detect, Respond, Recover), category and subcategory scoring, crosswalks to CIS and ISO controls, and gap reporting.

Enable RAIC Cybersecurity Mode: NIST CSF 2.0 and CIS Controls v8 workflows, the unified risk register, and cyber reporting overlays alongside AI governance.

The HIPAA module available on Professional and Enterprise tiers: administrative, physical, and technical Security Rule safeguards, Business Associate Agreement tracking, PHI data mapping against the Dataset Registry, and per-safeguard evidence.

The financial-services overlay for hedge funds and RIAs: FINRA Written Supervisory Procedures mapped to AI usage, SEC marketing-rule checks, supervisory review workflows, and the additional control set the overlay activates.

Pro/Enterprise module tracking the AICPA Trust Services Criteria across your SOC 2 Type 2 audit period. 61-row TSC catalog, per-control evidence uploads, one-click backfill from existing RAIC artifacts, branded auditor evidence pack ZIP, and CSV + DOCX exports.

Public reference for the raic-api/v1 surface: base URL, authentication, scopes, rate limits, webhooks, error envelope, and a downloadable branded DOCX.

How RAIC API tokens work: org-scoped rai_ keys minted by Org Admins versus SuperAdmin-only platform tokens, scope selection, rate-limit behavior, one-time secret display, rotation, revocation, and the audit trail every token action writes.

Connect AI assistants to RAIC over the Model Context Protocol: the OAuth 2.1 authorization flow, client registration, the read-only tool surface exposed to models, scope enforcement, and how every MCP call is audit-logged.

How the Shadow AI browser extension detects AI tool usage, what it captures, and its privacy posture.

Force-install the RAIC Shadow AI extension via Microsoft Intune or Chrome ADMX MDM: hosted CRX, ADMX policy configuration, and staged rollout steps.

Browse and configure RAIC marketplace integrations: available connectors, install steps, permission scopes, and troubleshooting.

Connect RAIC to ConnectWise PSA: credential setup, the outbound risk-event push, ticket and board mapping, retry behavior, and how delivery failures surface.

Chronological history of what shipped in RAIC: new modules, framework coverage, integrations, security hardening, and notable fixes, newest first.