The AI questions on your vendor assessment, answered with real framework citations.
Upload a security questionnaire — hospital vendor assessment, bank vendor review, enterprise SOC 2 questionnaire, anything with AI questions. Aguardic extracts the AI governance questions, cites the specific controls (HIPAA, HTI-1, EU AI Act, NIST AI RMF, ISO 42001), and returns an editable Word draft. Generic infrastructure questions are skipped with a clear note so you know where to route them.
Every answered question is grounded in a marketplace policy pack Aguardic enforces — these aren't templated guesses, they're descriptions of controls that become live once your workspace is set up.
Upload your questionnaire
PDF, Word, Excel, or paste text. We process in memory and never keep the raw file.
We classify every question
AI-governance questions get framework-cited answers. Infra / HR / physical questions are listed verbatim for you to route elsewhere.
Download an editable Word draft
Per-question confidence, framework citations, evidence descriptions. Paste into your vendor template and ship.
What we answer — and what we skip
Pack coverage maps 1:1 to tool coverage. We cover the AI-specific slice of your vendor assessment, cite the frameworks you declared, and send the rest of the questionnaire to the tool that actually owns it.
AI governance controls
Controls Aguardic enforces continuously — every answer references an active policy pack rule.
AI governance program & risk management
Policy-as-code with versioning (DRAFT → ACTIVE → DEPRECATED); continuous enforcement across 12 integration types.
AI / model inventory
Registry of every AI system — purpose, intended use, cautioned-out uses, training data provenance, linked policies.
AI data handling (PHI / PII DLP)
Real-time detection in prompts and outputs; block / warn / monitor modes before data reaches the model.
Shadow AI detection
Integration-layer monitoring surfaces unsanctioned AI tool usage (browser, LLM API, Slack, storage, email).
AI vendor governance
BAAs (healthcare), DPAs (EU), subprocessor chain tracking, and § 164.504(e) element gap detection across 14+ AI tools.
AI access controls & audit logging
Who / what can process data per classification; full audit trail with decision reasoning, exportable CSV / JSON / SIEM.
AI change management
Immutable policy version history + binding-change records support point-in-time reconstruction of controls in effect.
AI incident detection signals
We detect (PHI breach indicators, prompt injection, bulk exposure) and export the violation timeline — you run the IR process.
AI transparency & human oversight
User-facing AI disclosure enforcement, appeal mechanism surfacing, human-in-the-loop decision gates.
Framework-specific attestations
AI-specific sections of each framework. Full non-AI control coverage (general access reviews, etc.) is out of scope.
HIPAA + HTI-1
AI-specific § 164.502 / .312(b) / .530 / .400-414 controls + HTI-1 § 170.315(b)(11) PDSI certification (source attributes, performance, lifecycle).
EU AI Act
Art. 9 risk management, Art. 10 data governance, Art. 12 logging, Art. 14 human oversight, Art. 17 QMS, Annex III classification.
Colorado AI Act (SB 24-205)
Sec. 6-1-1703 consequential-decision controls, consumer notice, appeal mechanisms, risk management program.
NIST AI RMF
Govern / Map / Measure / Manage function alignment — supports CAIA Sec. 6-1-1706 rebuttable-presumption defense.
ISO / IEC 42001 (AIMS)
AI management system clauses — partial coverage. Full AIMS certification requires external audit beyond Aguardic.
AIUC-1
AI Unified Controls pack — continuous enforcement of the AIUC control catalog.
Out of scope — handle with existing tools
These describe infrastructure, processes, or non-AI controls Aguardic doesn't enforce. We won't fabricate generic answers for them.
Encryption at rest / KMS / key rotation
Route to: Cloud provider (AWS / GCP / Azure)
Identity, MFA, SSO
Route to: Okta / Entra ID / Auth0 / IdP
Endpoint security / EDR / MDM
Route to: CrowdStrike / SentinelOne / Jamf
Network, firewall, backups, DR / BCP
Route to: Cloud infra / SRE team
Penetration testing, SAST / DAST / SCA
Route to: External firm / Snyk / GitHub Advanced Security
Physical security, HR background checks
Route to: Facilities / HRIS
Traditional SOC 2 CC-series (non-AI)
Route to: Vanta / Conveyor / Drata / Secureframe
Incident response process execution
Route to: Your IR runbook (we generate the signal)