Govern the AI you deploy. With the platform that runs inside your tenant.
Kyūdō unifies EU AI Act, ISO 42001, and NIST AI RMF into a single Compliance Graph — 156 AI governance controls, governed by the same system that governs the rest of your stack. Inside your Azure tenant. With no second AI vendor to audit.
The AI you're governing runs in your tenant. The AI governance platform should too.
Microsoft 365 Copilot runs inside your tenant. Azure OpenAI runs inside your tenant. Your custom models run inside your tenant. The regulatory perimeter being audited under EU AI Act, ISO 42001, and NIST AI RMF is the perimeter Microsoft already secures for you.
Then most AI governance platforms ask you to send the evidence — prompts, outputs, model cards, risk assessments, incident logs — out of that perimeter to a multi-tenant SaaS. The artifact intended to prove sovereignty becomes the thing that breaks it.
Kyūdō runs the AI governance system inside the same Azure tenant as the AI it governs. Same identity plane. Same data residency. Same auditable boundary. No second vendor in the chain of custody.
AI governance is a system property. Not a binder, not a workflow, not a chatbot.
For organizations whose AI use is in scope of EU AI Act, ISO 42001, or NIST AI RMF, four properties have to be true at the architecture layer. Without all four, AI governance becomes another binder for the auditor to disprove.
EU AI Act, ISO 42001, NIST AI RMF — mapped, deduplicated, and operationalized in one control set.
Most organizations approach the three as three programs — three risk registers, three sets of evidence, three sets of binders. Kyūdō collapses them into one Compliance Graph mapping: 156 AI governance controls, expressed against the same evidence, with per-framework views generated on demand.
Six capabilities. One Compliance Graph. Inside your tenant.
AI governance is not a checklist — it is a system of record. Six capabilities, sharing one typed graph, producing the evidence your regulators, customers, and board will accept.
AI Inventory
Auto-discover every AI system in your tenant — Microsoft Copilot family, Azure OpenAI deployments, GitHub Copilot, embeddings, vendor APIs, and self-hosted models. Classified by EU AI Act risk tier on ingestion.
Risk & Impact
Per-system risk and impact assessments wired to the ISO 42001 lifecycle and NIST AI RMF Map–Measure–Manage phases. Reassessment triggers on model, data, or scope change — not on calendar.
AI Controls
156 AI governance controls. One control set, every framework. Coverage is computed from the Compliance Graph — change the framework view, the same controls produce a different attestation.
AI Evidence
Model cards, data sheets, training documentation, prompt and output logs, evaluation runs, and incident records — collected from tenant signals, typed in the graph, and cited on every output.
Vendor AI Risk
Third-party AI as a first-class entity: SaaS-embedded models, foundation-model vendors, dataset providers. Carries its own evaluation, contractual obligations, and incident channel into your risk register.
AI Trust Center
Counterparty-facing surface for your AI portfolio. Selective disclosure of model cards, evaluation summaries, conformity declarations, and incident posture — with NDA gating and watermarked exports.
The AI governance platform that meets the standard it imposes.
If we are going to govern your AI, our platform should pass the same audit. Five mechanisms make Kyūdō's outputs defensible — not because we promise they are, but because the architecture forces them to be.
Three frameworks. Three entry points. One platform that handles all of them.
Pick the regulatory beat you are answering to today. Kyūdō meets you there — and the work you do for one framework is already work toward the others, because the underlying control set is shared.
Operationalize EU AI Act before August 2026.
You are placing on the market or putting into service AI systems that fall under Annex III, or you are a deployer of high-risk AI. Article 99 turnover penalties become enforceable on 2 August 2026.
Stand up an AI management system without a binder factory.
You are building an AIMS for ISO 42001 certification — first-time or roll-forward from ISO 27001. You need lifecycle records, supplier AI controls, and certification-supporting documentation generated from live evidence.
Run NIST AI RMF as an operating loop, not an artifact.
You are adopting the NIST AI RMF — including the Generative AI Profile (NIST AI 600-1) — as the spine of your AI program. You want measurement records and management actions that hold up to board, customer, and federal scrutiny.
EU AI Act enforcement is dated. Your AI governance should be operational before it is.
The Article 99 penalty regime — administered by national market surveillance authorities — takes effect on 2 August 2026. After that date, providers and deployers of high-risk AI systems are answerable not for intent but for operational evidence: AI inventory, technical documentation, conformity declarations, and incident logs that exist on day one of an investigation.
If your AI governance program is not operational by then, what you hand the auditor is intent. Kyūdō hands them the system.
Operationalize AI governance where the AI already runs.
A 60-minute deployment workshop with a Kyūdō architect: scope your AI portfolio, map it to EU AI Act, ISO 42001, and NIST AI RMF in your tenant, and leave with a deployment plan and reference architecture for your environment.