AgentNuro · AI Risk & Compliance

AI risk and compliance: know every AI in use, and prove how it was governed

AI risk and compliance means keeping a current inventory of every AI tool and agent in use, knowing who owns each one and which policy applies, and holding records an auditor can check. AgentNuro builds that record from real usage data, not self-reported surveys.

Build your AI inventory See what it helps evidence

app.cloudnuro.ai/compliance Sample data

Answer an auditor’s question

Sample data, for illustration only.

What does AI compliance require first?

An inventory. Before anyone can classify risk, apply a policy or produce a record, they need to know which AI tools and agents are in use. Most frameworks say so directly.

A register built from intake forms only covers what people declare. AgentNuro finds AI tools and agents from provider, billing and identity signals, and from the agent platforms your teams build on, including the ones nobody declared.

How unsanctioned AI discovery works About the AI tool inventory

What the frameworks ask for

NIST AI RMF 1.0

GOVERN 1.6

“Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.”

OMB M-25-21

Federal agencies

Inventory AI use cases at least annually, submit the inventory to OMB, and publish a public version.

ISO/IEC 42001

AI management system

Documented AI system resources, intended use and responsibilities. Each one depends on knowing which systems exist.

EU AI Act

Risk-based obligations

Obligations follow each system’s risk class, so every AI system in use has to be identified before it can be classified.

Paraphrased, except the quoted NIST text. Read each framework for its full requirements.

How do you build an AI inventory an auditor will accept?

A spreadsheet that was right in March is not evidence in October. An inventory holds up when it has four qualities. Pick one to see where it shows up in the record.

app.cloudnuro.ai/inventory

AI inventory · all teamsIllustrative example

Tool or agentFound viaStatusOwnerFirst seenLast seen

Sample data, for illustration only.

How do you make AI usage auditable?

By recording every request with three things attached: who made it, the policy version that applied, and what happened. One record, written when the request happens, not three logs reconciled the week before the audit.

01

Identify
A person is identified through your identity provider. Service accounts and agents send an identity tag with each request.
user: e.vargas@acme.com
02

Check policy
The request is checked against the policy version in force at that moment.
policy: Finance data v6
03

Act
Allowed, routed to an approved model, or blocked, exactly as the policy says.
outcome: allowed
04

Record
Who, which model, which policy version, the outcome, tokens and cost are stored together.
record: kept, exportable

Policies are versioned, never deleted

Change a policy and the old version stays. Each record points to the version that applied, so a past decision is judged by the rule in force at the time, not by today’s rule.

Export any record set

Filter by team, person, agent, model, policy or date range, then export the records behind the view for your auditor or your GRC tool.

Request-level records, policy checks and enforcement come from traffic through the AgentNuro gateway. Without the gateway, the inventory, usage and cost still come from provider, platform and identity APIs.

About AgentNuro Control

svc-reporting · daily requests, SeptemberIllustrative example

Flagged

Sep 1Sep 15Sep 30

FlaggedSep 21 · about 4× normal request volume for this service account. Sent to its owner for review.

How do you detect risky or anomalous AI usage?

AgentNuro learns what normal looks like for each team, person, agent and model, then flags what breaks the pattern while it is happening.

1Baseline. Normal request volume, spend and model mix per team, person, agent and service account.
2Deviation. A spike in usage or spend, or a team suddenly using a model it never has, is flagged when it happens, not at the next audit.
3Response. Send it to a reviewer, or let AgentNuro Control act automatically when your policy says so: alert, cap spend, reroute to an approved model, or stop traffic with the kill switch.

Which requirements does AgentNuro help evidence?

AgentNuro does not certify compliance. It supplies the records that compliance programs and auditors ask for. Here is where each record fits.

Requirement

What AgentNuro records

Where frameworks ask for it

AI inventory

Every AI tool and agent found, with where it was found, status, owner, and first and last seen.

NIST AI RMF GOVERN 1.6OMB M-25-21ISO/IEC 42001EU AI Act

Accountability

A named owner for each tool and agent, and a verified identity on every request, including service accounts.

NIST AI RMF GOVERN 2ISO/IEC 42001OMB M-25-21

Usage monitoring

Requests, tokens and cost by person, team, agent and model, recorded continuously.

NIST AI RMF MANAGEISO/IEC 42001 performance evaluationEU AI Act deployer monitoring

Policy enforcement history

Each request’s policy check, the policy version that applied, and the outcome. Policy versions are never deleted.

NIST AI RMF GOVERN 1ISO/IEC 42001 operational controls

Anomalies and incidents

Flagged deviations with time, identity and what was done about them.

NIST AI RMF GOVERN 4.3EU AI Act deployer monitoring

References show where a requirement appears. Your auditor decides what evidence satisfies it.

Without a record

“We think this happened.”

Logs pulled from each provider, screenshots, and a spreadsheet of whatever teams remember.

With AgentNuro

“Here is the record.”

One inventory and one set of request records, across the providers and platforms you connect, ready to export.

For government

Keeping an AI use case inventory?

OMB M-25-21 directs federal agencies to inventory their AI use cases at least annually and publish a public version. The same inventory supports state and local AI policies and reporting.

AgentNuro for government

Copilot and agents firstFor most of the governments we work with, AI arrives through Microsoft Copilot and agents built in Copilot Studio. AgentNuro lists those agents with owner, usage, tokens and cost.
Tested in Microsoft GCCCopilot reporting has been tested in Microsoft’s Government Community Cloud.
Buy through your contract vehicleAvailable through SHI, Insight and Carahsoft.

Frequently asked questions

It supplies the AI evidence those reviews ask for: which AI is in use, who used it, under which policy version, and when, in an export you can hand to your auditor. It does not certify your compliance. Your auditor decides what counts.

Yes. AgentNuro finds AI tools and agents from provider, billing and identity signals, and from agent listings on Azure AI Foundry, AWS Bedrock, Gemini Enterprise and Power Platform. Anything found that was never approved is marked unsanctioned until someone reviews it.

Your inventory, usage and cost, from provider, platform and identity APIs, with no change to your applications. Request-level records, policy checks and real-time enforcement come from traffic routed through the AgentNuro gateway, which takes a one-line endpoint change.

People are identified through your identity provider. Service accounts and agents send an identity tag with each request, and it is recorded the same way a person’s identity is.

They are kept. Policies are versioned and never deleted, so every record can be checked against the rule that applied when the request was made.

No. Prompt content is analyzed in real time, for example to choose a model, and is not stored. Records hold who made the request, which model, which policy version, the outcome, tokens and cost.

You can export any period at any time and keep your own copy for as long as your retention policy requires. See the Trust Center at trust.cloudnuro.ai for how AgentNuro handles your data.

You decide. A flag can go to a reviewer, or a policy in AgentNuro Control can act automatically when a condition is met: alert, cap spend, reroute to an approved model, or stop traffic with the kill switch.

No. It supplies the AI records your GRC tool or auditor asks for, and exports them in a format you can attach. Your compliance program stays where it is.

Have the record ready before anyone asks for it.

Start with a live inventory of every AI tool and agent in use. Read-only, no change to your applications.

Build your AI inventory