3LS Platform / Compliance and Assurance

Turn AI governance policy into controls and reviewable evidence.

Use inventory, signed policies, approvals, activity records and remediation history to support your ISO/IEC 42001 governance programme. Connect review questions to product records and combine them with your organisational assessments and responsibilities.

See the product walkthrough Map your governance questions

Start with the question the reviewer needs to answer

Identify which resources were observed, which policy applied, what happened on a supported path and who responded. Keep the observation date, inspected scope and available records beside the answer.

Resources and ownership

Review observed AI products, provider accounts, MCP installations and tool revisions, with provenance and observation freshness.

Policy and decisions

Connect signed policy versions and applied status with attributable activity, classification, routing and control decisions where recorded.

Response and remediation

Follow the assigned case owner, recorded actions, exception scope and expiry, and evidence supporting resolution.

Product features that support governance reviews

References identify supporting mechanisms, not satisfaction of an entire control. Your organisation assesses the applicable control and its effectiveness; this feature map is not a certification or control score.

Internal cases support operational response; confidential or anonymous concern intake and external affected-party reporting need their own channels. Request and approval permissions do not require requester and approver to be different people.

Scroll the table horizontally to compare evidence and references. Keyboard users can focus the table region and use the arrow keys.

Product features that support governance reviews: questions, support, example evidence and ISO/IEC 42001 Annex A references.
Review question Product support Example evidence Annex A references
Which AI and MCP resources have we observed? Inventory, provenance, tool revisions and observation freshness Observed resource records and authorised inventory exports A.4.2, A.4.4
Which operational policy applies? Signed policy lifecycle, configured restrictions and scoped exceptions Policy version, applied status and exception scope/expiry A.2.2, A.2.3, A.9.2, A.9.3
Who responds when an issue is identified? Role-based administration and internal case ownership Assigned owner, recorded actions and case history A.3.2, A.3.3, A.6.2.6
What happened on the governed path? Attributable operational journals and activity Recorded decision/outcome and its supported channel A.6.2.8, A.9.4
What information can support a review? Safe reports, technical documentation and scoped inventory sharing Available records, guides and inventory export A.6.2.7, A.8.2, A.8.5
How is governed access and usage constrained? Configured classification policies, approved model/tool routes and usage controls Available classification decisions, routing selections, applied control state and attributable usage A.2.3, A.4.5, A.6.2.6, A.9.2

Review records in the console and through authorised APIs

Use tenant-authorised inventory exports to share observed resource records. Decision and case records are available through the console and authorised APIs; an inventory download is not a comprehensive assurance export of those records.

An assurance review may also need population and completeness information, impact assessments, supplier records and audience-specific documentation. Central evidence uses bounded metadata, hashes and redacted fields. Control records explain policy decisions rather than a model’s learned reasoning.

Gateway decisions and usage

Review selected classification fields, available routing selections, tool-proposal decisions and usage quality/freshness on the configured gateway path.

Explore AI Gateway evidence →

Browser and managed MCP outcomes

Keep selected browser text and upload metadata scope separate from managed MCP original-argument and returned-result decisions.

Explore Browser and MCP evidence →

Keep organisational ownership beside the product record

Your organisation owns AI policy, impact assessments, competence, supplier diligence and applicable requirements. Product records inform that work; accountable people decide its scope, assess consequences and establish whether controls are effective for the intended use.

Combine the records with your independent review, human oversight and supplier documentation. Recorded activity and applied policy state describe their supported paths, while direct provider/backend access and other channels need their own controls and evidence.

Use Annex C objectives to shape the review questions

ISO/IEC 42001 Annex C is informative context, not additional mandatory controls. Accountability, privacy, security, maintainability and explanations of control decisions can guide what evidence to seek.

Use ownership and case history for accountability questions, selected-field inspection and bounded records for privacy/security questions, and versioned policy/tool records for maintainability. Combine these inputs with your impact, fairness and environmental assessments and independent model-performance evaluation.

Map your governance questions to product evidence.

Bring a review question and a real workflow. Identify the record, supported channel, policy owner and organisational assessment needed to answer it.

Discuss your evidence requirements → See the product walkthrough → Read Technical Docs →

From the blog

Compliance Briefings Worth Reading

Research on policy, control and observability, supplier risk and organisational AI governance.