de.iterate is an Australian GRC platform with AI governance and ISO 42001 support built in. AI arrived in most businesses through browser tabs and feature updates. de.iterate helps you monitor and manage your AI risk using a management system that keeps up with your AI use cases.
Built on top of International AI frameworks, your de.iterate system can help with AI impact assessments, AI risk management, AI supply chain management and even dynamically monitor and report your AI risk metrics through the de.iterate fabric using automated key risk indicators.
de.iterate is certified to ISO 42001 through a JAS-ANZ accredited certification body, and was named GRC Provider of the Year at the 2026 Australian Cyber Awards.
We help you get your ducks in a row.
The AI nobody mentioned
Leadership knows about the official AI project, the one with a business case. Marketing is using three AI writing tools. Finance is trialling an AI add-on for reconciliations. A developer has been pasting code into a chatbot since March.
Larger organisations have an AI steering committee, an AI policy and a register with twelve approved use cases in it. The committee reviews the projects with a business case. Meanwhile, the CRM vendor switched on an AI assistant in the last release, the HR platform is screening applications with a model nobody evaluated, Copilot was enabled for 4,000 staff by a licensing decision rather than a governance one, and every SaaS tool procurement approved in 2023 has added features procurement never saw. The register is accurate for the AI the organisation chose. It says nothing about the AI the organisation was given.
“Who is responsible for AI?” is now a standard audit question. “Good question” is not a passing answer.
AI governance works when you know which AI systems you have, including the ones your vendors switched on, someone is accountable for each, and the controls around them grow out of the security and privacy work you’ve already done rather than starting a third program from scratch. de.iterate is built that way. AI systems sit in de.iterate's register that links to your suppliers and risks, impact assessments and approvals are recorded against each one, and the AI management system shares its controls and testing with ISO 27001 and privacy, so “who is responsible for AI?” has an answer with a name on it.
Build your AI management system with ISO foundations and map it to international standards and obligations. AI control design and testing are shared with your existing ISO 27001 and privacy programs, so your AI risk management naturally develops out of the foundations you already have.
Record your AI systems in de.iterate's configurable register, with the fields your AI management system needs. AI tools that touch your data cross-link with your de.iterate supplier registers, where you can note where the data goes and link each tool to your AI risks and controls.
Every automated suggestion in de.iterate arrives as a draft, with its reasoning and confidence stored alongside it. A human approves it before anything changes, which is the same kind of oversight management asks of you.
Each entry in the AI register carries an accountable owner, a business purpose and a review date, with roles mapped to the responsibilities ISO 42001 expects. When an auditor asks who is responsible for AI, the answer is a list of named people rather than a committee.
Start from an AI acceptable use policy written by de.iterate's GRC experts. Distribute it through de.iterate's policy module, track who has read it, and reset attestation when the rules change, so the developer pasting code into a chatbot has seen the policy that says not to.
Assess the impact of each AI system on people and on your organisation, and keep a record of the risks, decisions, controls and approvals that follow, as well as the evidence that each step took place.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Plain-English policies, clear approvals and proof your staff have read them.
Scheduled controls testing, with the evidence ready before your auditor asks.
Find your personal information, see where it goes and keep your privacy policy current.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
