The five records
the law already asks for.

Ask what AI governance requires and you will get a long list of frameworks. The EU AI Act. Colorado’s new law. NIST’s risk management framework. ISO 42001. HIPAA. SOC 2. The Fed’s revised model risk guidance. Delaware’s oversight cases. It can look like twelve different jobs.

Read the actual text and something simpler appears. None of these name a product or a tool. Each of them names a record an organization must be able to produce. Put the records side by side and the list is short. There are five, and every obligation on that list asks for some combination of them.

This post walks through the five, where each one comes from, and why the tools most organizations already own do not produce them.

The five records

1. A current assessment of AI risk, with findings tied to obligations and a named owner for each.

The EU AI Act asks providers of high-risk systems for a risk management system (Article 9) and deployers for their own obligations (Article 26). NIST’s AI Risk Management Framework is organized around mapping, measuring and managing that risk. ISO/IEC 42001 requires an AI risk assessment. HIPAA has required a documented risk analysis for years (45 CFR 164.308(a)(1)). The Fed’s SR 26-2 expects model risk to be assessed individually and in aggregate. And Delaware’s Caremark line of cases, sharpened in Marchand v. Barnhill, holds that a board must have a reporting system for any mission-critical risk. Different words, same record: what are the risks, who owns each one, and when was this last reviewed.

2. A written policy for how AI is used, grounded in what the organization actually uses.

Article 4 of the EU AI Act requires measures that support AI literacy, and Article 26 sets deployer duties that a policy is the natural place to carry. NIST AI RMF GOVERN 1.1 asks for policies. ISO/IEC 42001 requires an AI policy. HIPAA requires documented policies and procedures (45 CFR 164.316). SOC 2 CC5.3 looks for policies that are communicated and followed. Colorado’s SB 26-189 takes effect January 1, 2027 and asks for meaningful human review of covered decisions, which a policy is where an organization says who reviews what. A policy copied from a template does not meet the spirit of any of these. A policy written from the organization’s actual inventory does.

3. Evidence that the board, or a named committee, received the risk report and acted on it.

This is the Caremark record. In Marchand, Blue Bell’s board had no committee, no protocol and no regular reporting for food safety, its most critical risk, and the Delaware Supreme Court let the claim proceed on that basis alone. The lesson is not that the board must be expert. It is that the board must have a system, and the record must show it worked. NIST GOVERN 2 and the ISO 42001 clauses on leadership and management review say the same thing in management language. A board memo is the smallest document that proves the system exists.

4. Records that can be retained and produced for a third party, with proof of when they were made.

Every framework has a retention or record-keeping clause. The EU AI Act has Article 12 and a six-month minimum for deployer logs in Article 26(6). Colorado requires three years. HIPAA requires six (45 CFR 164.316(b)(2)). SOC 2 is built on evidence. And every Caremark case is decided on what the record shows. A document that exists only on a laptop does not satisfy this. A document with a verification URL does, because an insurer, an auditor or a court can confirm when it was produced and from what inputs without reading its contents.

5. Role-based preparation of the people involved, with evidence it happened.

Article 4 of the EU AI Act requires measures that support AI literacy, suited to each person’s role and context. Colorado’s human review has to be meaningful, which means the reviewer has to know what to look for. NIST GOVERN 2.2, the ISO 42001 clauses on competence and awareness, HIPAA training requirements (45 CFR 164.308(a)(5)) and SOC 2 control criteria all ask for competence appropriate to the role and evidence that it was addressed. A general AI awareness course does not show a director what questions to ask or a reviewer what a meaningful review involves. Role-specific training with a verifiable record of completion does.

What existing tools do, and where they stop

Most organizations already own good tools, and every one of them does something the five records need.

• Firewalls and AI security platforms enforce controls and record traffic. They show what happened on the network.
• Agent guardrails inspect and constrain what an AI agent does at runtime. They show what the agent did.
• GRC platforms track controls and evidence across a compliance program. They are excellent where a program already exists and needs managing.
• Policy templates give a starting document.
• General AI training builds awareness.

Each of these is valuable, and each stops one layer short. A log shows what an agent did; it does not show what the agent was permitted to do, or who agreed. A template is a policy about a hypothetical organization. A GRC platform manages evidence; it does not produce the five records from an organization’s actual AI use. Awareness training does not prepare a director for oversight or a reviewer for review.

Security tools show what happened. The regulations ask for what was permitted, who agreed, and who was prepared. That is a different record, and it has to come from somewhere.

Why we built it this way

To our knowledge, no other product produces all five records as one dated, verifiable set from a single session, written from the organization’s actual AI use rather than a template, and priced for the mid-market. That is what SanctumShield does. An organization answers a guided intake in about half an hour, including discovery of the AI tools nobody has written down, and receives an Executive Risk Report, an Acceptable Use Policy and a Board Memo. The report and the policy carry a Verification URL. SanctumShield Academy covers the fifth record with training by role and a Record of Completion that can be verified. Twelve frameworks inform the methodology, seven rendered clause by clause today and five more on the active roadmap, and the method and its sources are published in full at /under-the-hood.

None of this replaces the security stack. It sits above it. If your organization has none of the five records yet, the free Board AI Register template and the free AI literacy self-check are a reasonable place to start today.