Everything your AI governance program needs — out of the box

The Risk Meridian risk scoring engine performs a structured evaluation of AI system risk factors and produces a deterministic risk classification: LOW, MODERATE, or HIGH. Unlike AI-generated risk assessments, Risk Meridian's scoring is fully auditable — every classification can be traced back to the specific questionnaire answers that produced it.

The questionnaire covers seven risk categories: data sensitivity, decision impact, oversight mechanisms, system maturity, operational context, healthcare-specific factors, and vendor risk. Scores are normalized to a 0–100 scale and mapped to risk bands. Hard floors ensure certain combinations of answers always produce a minimum risk level regardless of other factors.

Risk classification drives everything downstream. The control library is seeded from the risk profile. Disclosure requirements are determined by risk level. Board reporting flags are set automatically for HIGH systems. Regulatory framework readiness indicators are assessed against the risk output.

The Texas Responsible AI Governance Act requires organizations to generate and maintain AI disclosure statements for covered systems. Writing these manually for every AI system is slow, inconsistent, and prone to missing required fields. Risk Meridian's Disclosure Generator automates the entire process.

Disclosure statements are generated from merge-field templates populated with your AI system registry data and risk review outputs. The resulting statements are formatted to meet TRAIGA's disclosure requirements — system purpose, risk classification, oversight mechanisms, contact information, and review date.

Generated disclosures can be exported to PDF, copied to clipboard for embedding in public-facing documentation, or stored as governance artifacts within the platform. Every disclosure is versioned and timestamped as part of the immutable audit trail.

AI systems fail in ways that are often invisible until the impact is felt — a model producing biased outputs, a clinical decision tool providing incorrect guidance, a hiring algorithm flagging protected class proxies. The Risk Meridian incident log gives organizations a structured workflow for capturing, investigating, and resolving these events.

Incidents are classified by severity (Critical / High / Medium / Low) and tracked through a defined resolution workflow: Open → Investigating → Resolved → Closed. Each incident record captures the affected AI system, incident description, severity, assigned investigator, resolution notes, and closure date.

The incident log is fully integrated with the AI system registry — every incident is linked to the system that produced it. Incident history informs future risk reviews and is included in governance report exports. Open incidents are surfaced prominently on the governance dashboard.

AI systems are not static. Models change, use cases expand, regulations evolve, and risk profiles shift. Risk Meridian's Review Scheduling module ensures AI systems are re-assessed on a structured cadence — and that nobody misses a due date.

Each AI system has a configurable review frequency: Annual, Semi-Annual, Quarterly, or Monthly. The platform calculates the next review due date automatically when a risk review is completed, and triggers email reminders to the system owner and administrators as the due date approaches.

Systems approaching or past their review due date are surfaced prominently on the governance dashboard. Overdue reviews are flagged in the governance maturity score calculation. The review schedule is also visible in Governance Report Pack exports, demonstrating to regulators that a structured oversight cadence is in place.

Knowing which regulatory frameworks apply to each AI system — and how ready that system is for governance — is one of the most complex parts of AI governance. Risk Meridian's Framework Readiness module provides per-system readiness indicators across all supported frameworks, so organizations can see their exposure at a glance.

For each AI system, the platform evaluates readiness across TRAIGA, EU AI Act, Colorado AI Act, NIST AI RMF, and ISO 42001. Readiness is determined by comparing the system's documented governance state against each framework's requirements. The result is a traffic-light indicator: Ready, Partial, or Gap.

Framework Readiness indicators are displayed on each AI system's detail page and aggregated in a dashboard widget showing organization-wide readiness across all frameworks. This enables compliance teams to prioritize remediation where gaps exist before a regulator makes the same observation.

Hospital boards and enterprise executive committees increasingly have AI oversight responsibilities. Risk Meridian's Board AI Governance Report is a purpose-built, non-technical governance summary that gives boards what they need to fulfill those responsibilities — without requiring them to parse technical documentation.

The report presents governance program status in clear, accessible language: total AI systems by risk level, governance maturity score, open incidents, control completion progress, upcoming review obligations, and framework readiness summary. It is designed to answer the questions a board member or CEO would ask about the organization's AI governance posture.

Board reports are generated on a configurable cadence (Quarterly or Annual) and can be presented directly from the platform or exported to PDF for inclusion in board meeting packs. Healthcare organizations use them to meet the emerging board-level AI oversight expectations from CMS, The Joint Commission, and state health regulators. (no PHI will be entered or retained)

Most organizations use far more vendor-provided AI than internally-built AI. Chatbots, hiring tools, clinical decision support, fraud detection — these third-party systems carry governance obligations just as internal systems do. Risk Meridian's Vendor AI Register tracks third-party AI systems and the governance documentation their vendors have provided.

The register captures vendor name, contact, AI system description, vendor-provided governance documentation, risk classification, and oversight mechanisms. It surfaces which vendors have demonstrated governance programs in place and which have documentation gaps requiring follow-up.

Vendor AI systems in the register are fully integrated with the platform — they receive risk reviews, generate controls, appear in the Governance Report Pack, and contribute to framework readiness assessments. Vendor governance is not a silo; it is part of the organization's complete AI governance program.