Cognita GRC
Cognita provides an intelligence layer for AI compliance, connecting directly to an organization's AI infrastructure to automatically map models, controls, and risks against regulatory frameworks like the EU AI Act, ISO 42001, and NIST AI RMF. The platform generates audit-ready artifacts—including AI Impact Assessments and risk registers—with first drafts delivered within 72 hours of connection, with every piece of evidence cryptographically signed and chained to an append-only ledger. It also offers AI Agent Assurance for banks and insurers, providing a C1–C14 control matrix for Internal Audit, Risk, and Compliance functions.
- Regulatory & Compliance Technology
- Artificial Intelligence
- Enterprise Software
- Cybersecurity
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Enterprises deploying AI systems face growing regulatory pressure from frameworks such as the EU AI Act, ISO 42001, and NIST AI RMF, yet most lack the tools to produce verifiable evidence of compliance. Static guardrails and manual documentation fail to satisfy auditors, regulators, and enterprise buyers who increasingly require proof of AI governance before closing deals.
Solution
Cognita provides an intelligence layer for AI compliance that connects directly to an organization's AI infrastructure—including OpenAI, Anthropic, MLflow, HuggingFace, and Weights & Biases—to automatically map models, controls, and risks against multiple regulatory frameworks. The platform generates audit-ready artifacts such as AI Impact Assessments, risk registers, and security strategies, with first drafts delivered within 72 hours of connection. Every piece of evidence is cryptographically signed and chained to an append-only ledger, providing tamper-evident proof for external auditors. A named Lead Auditor reviews and counter-signs key documents, and the platform includes continuous monitoring with daily posture heartbeats and quarterly re-attestation to keep compliance current. For banks and insurers, Cognita offers AI Agent Assurance—a C1–C14 control matrix that lets Internal Audit, Permanent Control, Risk, and Compliance work from the same signed evidence, with test samples that re-perform and sign-offs that verify.
Target Audience
Primary customers are enterprises deploying AI systems that must satisfy enterprise security reviews, regulatory obligations, or buyer due-diligence requirements, including AI product teams, compliance officers, and security leaders at organizations subject to the EU AI Act or selling to regulated industries. The AI Agent Assurance product specifically targets banks and insurers whose Internal Audit, Risk, and Compliance functions must assure AI agents to supervisory standards.
Features
- Synchronous API connectors for OpenAI, Anthropic, MLflow, HuggingFace, Weights & Biases, Arize, and GitHub Actions with envelope-encrypted credentials and HMAC-verified webhooks
- Automated risk engine that tokenizes intended-use descriptions and matches them against EU AI Act Annex III clauses to generate answerable assessment questions
- Append-only hash-chained evidence ledger with KMS-asymmetric signatures and S3 Object Lock anchor commits for tamper-evident audit trails
- AIUC-1 readiness scoring across six domains (Data & Privacy, Security, Safety, Reliability, Accountability, Society) with 48 controls and crosswalk exports to ISO 42001, EU AI Act, NIST AI RMF, and OWASP LLM frameworks
- AI Agent Assurance control matrix (C1–C14) with seeded sample testing, per-item exception recording, signed risk acceptance, and workpapers linked to tests for Internal Audit engagements
- Continuous posture monitoring with drift alerts, telemetry flags, and quarterly Lead-Auditor re-attestation
- Self-hostable Next.js 15 monolith with Postgres 16 row-level security, Inngest durable workflows, and per-region data residency pools