For banks, insurers and other regulated institutions
Adopt AI faster. Stay in control.
Every AI agent, model and tool in one place, approved faster and governed for as long as it runs.
- Runs in the organisation's own infrastructure
- Maps to the EU AI Act, DORA, GDPR and ISO/IEC 42001
- AI-powered governance: people decide, AI assists
The problem
AI is spreading faster than it can be governed by hand
Any team can build an agent, connect a model or switch on an AI feature in an afternoon. Approving it, watching it change and proving later who decided still happen in spreadsheets, tickets and inboxes, and none of them agree.
Today
One agent, five places, no answer.
- AI inventory v7 (final).xlsxOwner has left
- Risk assessment form.docxHalf completed
- Ticket 4821: go-live of the dispute assistant?Legal, or security?
- Its new connection to the payment hubNobody decided
- E-mail, 41 replies: who approved it in March?No answer
With signoria.ai
One path, from first sight to evidence.
- 1Found and ownedFound on Copilot Studio by the connector; its owner, the Head of Cards, confirmed from the directory
- 2Risk assessed with AI's helpAnswers suggested with their reasons; the owner checks and completes them
- 3Approved by peopleThe governance officer and the data protection officer, each for their part, never the requester
- 4Watched in productionA change on its platform or a new connection starts a review
- 5Shown as it stoodWhat was true, who approved it and which policy applied, on any past date
Three parties feel it first.
The supervisor
The EU AI Act asks which AI systems are high-risk, who oversees them and how, from 2 December 2027 for uses such as credit scoring. DORA asks who provides each ICT service, and at what risk.
Internal audit
Audit picks any AI asset and asks who approved it, under which policy, what has changed since and how it stood a year ago. A spreadsheet and an inbox cannot answer that.
The teams building AI
Approvals wait weeks for a reviewer nobody named, changes go live unseen, and teams rebuild what another team had approved. Governance by hand slows adoption and is no safer.
Last checked: 27 October 2026. Not legal advice. EU AI Act dates for banks
The answer
Works with the systems already in place
signoria.ai puts every AI asset, its owner, its approvals and its changes in one governed record, and starts from what the organisation already has. It reads the AI platforms, the directory and the records already kept, and holds each asset once: no second inventory to keep in sync.
Where agents are built
Who the people are
Records already kept
One record of each asset, put together from what the organisation already has.
- Card Dispute Assistantfound on Copilot Studio
- Its owner, the Head of Cardsfrom Entra ID
- Payment hub MCP serverfrom the CMDB
Where people ask
Other systems
How each asset is held once
- Found once, held once. An agent found again is matched by its platform's own identifier, never by its name.
- Duplicates refused. Every way of registering refuses an identifier or a name already held, and the form warns while the name is typed.
- People's word is kept. What a connector reads never overwrites what an owner declared.
How AI tools and other systems connect
Claude, ChatGPT, GitHub Copilot, Cursor and any tool that supports MCP: people ask and register from the tools they already use, under their own identity and rights. Other systems read and write over the REST API. Further platforms are connected in the order customers request them.
Ask the AI estate anything, and trace every answer
Once every agent, model, tool and policy is in one place, it can be asked. Ask & Build answers in plain language from the organisation's own register and documents, links every asset it names and says what it read.
Every agent has an accountable owner. The one waiting longest is the Card Dispute Assistant, with the data protection officer for six days.
Keep the whole estate current without chasing anyone
A read-only connector finds agents on Copilot Studio and Agent Builder, asks their owners to confirm, and puts every change it sees in front of a person to decide.
More on governance and oversight
- Everything in one place. Agents, AI-enabled systems, platforms, models, tools, skills, plugins, knowledge sources and use cases, each with an accountable owner, its connections and its documentation.
- Approve once, reuse safely. A model, tool or knowledge source is approved once; each new use asks only its owner.
- Proportionate approval. The assessment's answers decide who reviews: a light path for a minor change, the data protection officer for personal data, security, risk and compliance when it is significant.
Read only: nothing on the platform is changed.
Show a supervisor or an auditor what was true, on any date
Move the date back and the record moves with it: the status, the connections, who approved and which policy was in force.
How the evidence is kept
- Decisions that never change. Every approval and assessment keeps its answers, the form's version, the facts it relied on and the policies in force.
- A tamper-evident record. Every change is entered in a hash-chained ledger in the same transaction, sealed outside the database and verifiable at any time.
- Built-in assessments. EU AI Act risk, criticality and change materiality, personal data screening, security testing and one for each kind of component, ready to use and configurable.
- Approval recorded for AGT-0007#4f1c…9a07
- Status set to In production#b83e…12d4
- Sealed outside the databaseverified today
- Status
- Being assessed
- Model
- GPT-4.1 (Azure OpenAI)
- Uses
- Core banking MCP server
- Approved by
- Not yet
Registered by its owner on 28 January; the assessments were under way.
Move the slider to see the record on an earlier day.
Designed for the scrutiny of supervisors, auditors and the organisation's own security team
Everyone lands on what is theirs
Each person opens the platform on what waits for them, in the words of their own work.
Chief AI Officer
The whole AI estate at a glance, and the confidence to scale adoption.
Head of AI implementation
A clear, fast path into production, and approved parts to build on.
AI governance officer
Assessments prepared, reviews routed, nothing chased by e-mail.
Card Dispute Assistant, with the owner's answers
DPO, CISO, risk and compliance
Involved when the facts require it, with everything needed on one page.
Internal audit
Evidence for any past date, unchanged since it was recorded.
Teams that build AI
Registration from their own tools, and reuse of what is already approved.
From first installation to the first approvals
Install
One signed release, installed in the organisation's infrastructure with Docker Compose.
Connect
Microsoft Entra ID for the organisation's people, the read-only connector for its Copilot agents.
Load
The existing inventory from Excel or CSV, checked row by row before anything is registered.
Govern
The first assessments and approvals on the shipped workflows, adapted along the way.
The free 90-day pilot is run together with the organisation's team: configured to its policies and measured on its own estate.
Questions
Why a separate register, if the organisation runs Microsoft?
Microsoft's tools govern what runs on Microsoft. signoria.ai keeps an independent record outside the platforms it governs: it reads them without changing them, holds models, tools and data sources from anywhere, and shows what was true and who approved it on any past date, so audit never depends on one vendor's console.
Does signoria.ai sit between AI agents and their users?
No. It governs which agents may run and keeps the evidence; it does not intercept their traffic. Tools that watch agents at run time stay in place.
Does the AI approve or classify anything?
No. The AI suggests and explains why; a person decides. Where a fact is missing, the platform says so instead of guessing a risk tier.
Where does the organisation's data go?
It stays in the organisation's infrastructure. The AI features are off as shipped; once they are switched on, the content they need goes to the AI provider the administrator sets up, and to nothing else.
Which platforms does it read?
Microsoft Copilot Studio and Agent Builder, Amazon Bedrock, and the organisation's own systems over the REST API or a spreadsheet. ChatGPT, Claude and other assistants connect over MCP.
Is this one more tool to administer?
No. Connected platforms are read automatically and the existing spreadsheet comes in as an import. Owners confirm what was found and people make the decisions. It replaces the spreadsheet and the e-mail chain.
Does it replace an existing GRC tool?
No. It is the system of record for AI assets and their approvals. Other tools read it over the API.
Which regulations does it support?
Its assessments and records are mapped to the EU AI Act, DORA, GDPR and ISO/IEC 42001.
Start with a pilot on the organisation's own AI estate
All agents, owners and approvals in one place within weeks, with the signoria.ai team working alongside the organisation's own.