Skip to main content
CognitaGRC
Product
AI Agent AssurancePlatformAIUC-1 ReadinessMarketplace
Pricing
Resources
DocsNewsroom
Trust
Sign inOpen product →
Cognita

The intelligence layer for AI compliance. Built for the post-EU-AI-Act world.

ISO 42001EU AI ActNIST AI RMF
Product
PricingTrust CenterDocumentation
Frameworks
ISO/IEC 42001EU AI ActNIST AI RMF
Resources
NewsroomProduct demoDocsTrustSecurity
Company
SecurityPrivacySub-processorsContact
© 2026 Cognita, Inc. · cognitagrc.ioChecking status…

AI Agent Assurance · for banks and insurers

Assure every AI agent — with evidence your supervisor can rely on.

One control matrix, C1 to C14, for Internal Audit, Permanent Control, Risk and Compliance. Every verdict comes from signed evidence, every sample re-performs, every sign-off verifies.

Book a Control Review→See your control matrix — free
claims-triage · 1–31 October · every tool callSample data

Each one owned, and sealed into the evidence pack.

Sampled the usual way
25
Tested by Cognita
4,200
Exceptions to review
37
Evidence pack
Signed · sha256 3f9a…c21e

Assurance evidence, not certification. Certificates and audit opinions are issued only by independent third parties.

01Internal Audit · Permanent Control · Risk · Compliance

Four functions, one body of evidence

Each line of defence works in its own screens, on the same signed records — so nobody re-keys evidence and nobody marks their own work.

01

Internal Audit

  • Engagements with workpapers linked to the tests they rely on
  • Review and sign-off by different auditors; every sign-off verifies

02

Permanent Control

  • Each control tested on its own population with a seeded sample
  • Every sampled item recorded; exceptions counted, not typed

03

Risk

  • Key risk indicators with thresholds and quarter-on-quarter trends
  • Residual risk accepted by the authority its severity requires, as a signed decision

04

Compliance

  • Obligations crosswalked to C1–C14 across EU and US frameworks
  • Who owns each obligation, and the evidence behind it

02C1–C14

The 14 controls

The Core Audit Program for AI Agents. Each control has a live indicator, a population to test and the evidence a reviewer opens.

  1. C1The inventory is complete: every running agent is known and has an owner.
  2. C2Nothing reaches production without a current authorization.
  3. C3Segregation of duties and quorum.
  4. C4The boundary enforces the decision.
  5. C5Expiry and revocation take effect.
  6. C6A material change triggers re-authorization.
  7. C7Runtime behaviour conforms to what was approved.
  8. C8Evidence is authentic and unaltered.
  9. C9Agents' access is least-privilege.
  10. C10An irreversible or external action requires human approval.
  11. C11Spend and action limits; the kill switch is tested.
  12. C12Third-party agents and models are assessed and their changes notified.
  13. C13Agent incidents are detected, contained and analysed with a sourced timeline.
  14. C14People affected are told about automated decisions.

03

What a supervisor can check

  • A signed workpaper still hashes to what was signed, with the organization's key and the ledger entry to prove it.

  • A sample re-performs: the same population and seed draw the same items — or the change in the population is reported.

  • No one reviewed their own test, signed their own workpaper or accepted their own risk. Admin rights are not authority.

  • The committee pack shows each control's verdict quarter by quarter, from snapshots written to the audit ledger.

04Free on every plan · Assurance Pro

Free to see. Pro to act.

Free on every plan

  • The live C1–C14 control matrix and setup checklist
  • Agent inventory and its reconciliation
  • Oversight evidence for C10, C11, C12 and C14
  • My work

Assurance Pro

  • Case register with owners, signed risk acceptance, Jira and ServiceNow push
  • Control tests with populations, samples and a per-item grid
  • Key risk indicators, obligations and the quarterly committee pack
  • Internal Audit engagements, signed workpapers and the signed export

Assurance Pro is an annual contract priced per legal entity, never per agent. Most teams start with a 30-day Control Review of one agent, at a fixed fee.

Mapped to the rules you answer to

  • EU AI Act
  • DORA
  • ACPR
  • NIST AI RMF
  • SR 11-7
  • Colorado AI Act
  • NY DFS

Assurance evidence, not certification. Certificates and audit opinions are issued only by independent third parties.

Start with the matrix. Finish with an export your regulator can rely on.

Connect a discovery source and see C1–C14 for your own agents today. When you are ready, a 30-day Control Review tests one agent end to end and hands you the signed evidence pack.

Book a Control Review→See your control matrix — free
AI Agent Assurance — one control matrix for audit, control, risk and compliance · Cognita GRC