AI Systems

An AI System in RAIC represents a deployed or proposed technology solution that leverages artificial intelligence. This includes commercial SaaS tools (e.g., ChatGPT Enterprise, Microsoft Copilot), internally built ML models, embedded AI components within larger platforms, and vendor-provided AI services.

Each system record captures over 50 structured fields across several domains:

• Identity & Classification — System name, ID (auto-generated), version, type (SaaS, On-Premises, Hybrid, etc.), deployment model
• Ownership & Contacts — Business owner, technical owner, data steward, executive sponsor, and vendor contact details
• Business Context — Business purpose, process, decision type, user population, estimated user count
• Data & Privacy — Data sources, sensitivity classification, PII involvement, training data description, vendor data practices
• Model & Technology — Model provider, version, output types
• Security Posture — Authentication method, authorization model, encryption (at rest/in transit), DLP policies, vendor security certifications
• Risk & Compliance — Risk tier, EU AI Act classification, NIST AI RMF classification, regulatory frameworks, bias and impact assessments
• Lifecycle Management — Lifecycle stage (Proposed → Active → Retired), review dates, approval expiration, incident tracking

RAIC supports multiple pathways for bringing AI systems into the governance register:

AI Systems follow a structured approval workflow with the following statuses:

• Pending Triage — Newly registered or submitted, awaiting initial review
• Under Review — Assigned to a reviewer for detailed evaluation
• Approved — Cleared for deployment with optional expiration date
• Conditionally Approved — Approved with specific requirements that must be met (tracked and attestable)
• Rejected — Denied with documented rejection reason
• Expired — Approval period has lapsed; requires re-review (automated by daily system checks)
• Intake Submitted — Submitted via AIREP, pending triage by IntakeAdmin

Each status transition generates an audit log entry, change log record, and triggers branded email notifications to relevant stakeholders.

AI Systems progress through defined lifecycle stages:

• Proposed — Initial registration, not yet deployed
• Development — Under active development or testing
• Active — Deployed and operational in production
• Under Review — Undergoing periodic governance review
• Suspended — Temporarily paused pending investigation
• Retired — Decommissioned and no longer in use

Configurable review cadences (by risk tier) ensure systems are periodically re-evaluated. The platform automatically generates review-due notifications based on organization alert settings.

• Summary Matrix — Risk Tier × Lifecycle Stage cross-tabulation
  All Tiers
• AI System Summary Report — Branded one-page PDF with 50+ fields and cross-module mappings
  Professional+
• Pending Reviews — Systems with review or approval expiration due within 30 days
  All Tiers
• Vendor Exposure Report — Vendor concentration risk analysis
  Professional+
• Ownership Gaps Report — Systems with missing ownership assignments
  Professional+
• Aging & Staleness Report — Flags systems with outdated reviews
  Professional+
• Time-to-Compliance Report — Registration-to-approval duration analytics
  Professional+
• Data Sensitivity Report — PII/PHI distribution map across AI systems
  Professional+
• Incident Density Report — Risk-tier incident correlation analysis
  Professional+
• Full CSV Export — Complete data export of all system fields
  All Tiers

Catalog Mapping creates a permanent link from your AI System record to a canonical entry in the RAIC AI Catalog (the same catalog the browser extension uses). It is independent of the optional Step-1 "Apply Template" picker — applying a template prefills field values, while mapping creates the structural link.

Why map a system?

• Future allow/block matching — Once enforcement ships, the browser extension will resolve a sighting to a catalog entry, then check whether your org has any approved AI System mapped to that entry. Without a mapping, a user-typed name like "claude" cannot be reliably matched against the canonical Anthropic Claude catalog row.
• Cross-tenant metrics — Aggregated platform metrics group by catalog entry, not by free-text system_name.
• Compare with Catalog Defaults — Mapped systems get a collapsible diff panel on the Overview tab showing field-by-field differences (system_type, deployment_model, model_provider, model_version, vendor data-training stance, business purpose, decision type, data sensitivity, PII flag, output types). A per-row Use Catalog button (or bulk Apply All Differences) syncs values one field at a time. Mapping never auto-overwrites your data.

Where to map:

• Intake Step 1 (/intake) — Optional "Map to AI Catalog" card.
• AIREP Internal Tool Intake Step 1 — Same picker.
• System Detail → Overview Tab — Map, change, or unmap any time. Edit gated to WorkflowAdmin / OrgAdmin / SuperAdmin.

All mapping changes write CATALOG_MAPPED, CATALOG_UNMAPPED, CATALOG_REMAPPED, or CATALOG_FIELD_SYNCED audit events to both the org change log and the platform audit log.

Enterprise organizations can generate an Aslan AI-powered risk assessment for any registered AI system. The assessment includes:

• Risk Narrative — 2-3 paragraphs of detailed risk analysis tailored to the system's metadata, data sensitivity, and deployment model
• Risk Scoring — Likelihood × Impact scoring with automated tier recommendation (Low, Medium, High, Critical)
• Suggested Controls — 3-6 recommended controls with NIST AI RMF clause references and ISO 42001 mappings
• Framework Classifications — EU AI Act and NIST classifications when those frameworks are enabled for the organization

Users can trigger generation from the post-registration success screen or from the Assessment Tab. The workflow is human-in-the-loop: users review the AI output and choose to Accept & Apply (populates system fields), Edit, or Skip.

Accepted assessments can be exported as branded DOCX or PDF reports.

When an AI system is up for review, Enterprise users can click "Draft Review Summary with Aslan AI" from the System Detail Lifecycle tab to generate a structured, board-ready review narrative.

The summary includes:

• Period Summary — Date range covered since the last review
• Field Changes — Aggregated change_log entries with user attribution
• Risk Delta — Prior vs current risk_tier with directional indicator (increased, decreased, unchanged)
• Incidents & Control Failures — Issues that occurred since the last review
• Outstanding Conditional Requirements — Open items requiring attention
• Reviewer Recommendation — Renew approval, Conditional renewal, Re-assess, or Retire

The draft renders in an editable preview panel. After Accept, branded Export PDF and Export Word buttons appear (filenames follow RhindonCyber_ReviewSummary_AI_<systemId>_<date>.{pdf,docx}). Both AI_REVIEW_SUMMARY_GENERATED and AI_REVIEW_SUMMARY_ACCEPTED audit events are written to the organization and platform audit logs.

Enterprise users can click "Draft Incident Playbook with Aslan AI" from the System Detail Lifecycle tab to generate a tailored incident response playbook based on system type, deployment model, data sensitivity, and risk tier.

The playbook contains 8 sections: Severity Matrix (P1–P4), Detection & Triggers, Containment, Investigation & Forensics, Notification & Escalation (GDPR / EU AI Act / state breach when triggered), Recovery & Validation, Post-Incident Review, and RACI.

After Accept, branded exports use RhindonCyber_IncidentPlaybook_AI_<systemId>_<date>.{pdf,docx}. Audit events AI_INCIDENT_PLAYBOOK_GENERATED and AI_INCIDENT_PLAYBOOK_ACCEPTED are recorded.