Product · CloudNerve
NerveEvidence AI Governance
Know which AI you run on AWS, with readiness evidence for the EU AI Act.
The AI Governance pack of NerveEvidence. It finds the models, agents, knowledge bases, guardrails and endpoints across your accounts, rates what your AI agents are allowed to do, and maps the results to AI frameworks in a signed bundle.
Who it's for
Companies building on Amazon Bedrock or SageMaker that must show customers, boards or regulators which AI they run and how it is controlled.
When teams call us
An enterprise customer's AI questionnaire, EU AI Act obligations coming into force, an ISO/IEC 42001 project, or AI agents spreading across accounts faster than anyone can list them.
What it does
Inside NerveEvidence AI Governance
AI inventory
Amazon Bedrock models, agents, knowledge bases and guardrails, and Amazon SageMaker endpoints, in every account and region.
AI bill of materials
A CycloneDX 1.6 AI-BOM export of what you run.
Agent permissions
A risk table of the IAM permissions each AI agent role holds.
Logging and guardrail checks
Invocation logging, guardrail use and related settings, checked on every run.
Five frameworks
EU AI Act, ISO/IEC 42001, OWASP Top 10 for LLM Applications 2025, NIST AI RMF 1.0 and AWS AI Security Best Practices.
Metadata only
It never reads prompts, responses or model content.
What you receive
On every run
- AI inventory (CSV)
- CycloneDX AI bill of materials (JSON)
- Agent permission risk table (CSV)
- An offline report with a status per control for each AI framework
- A signed manifest and a standalone verifier
How it works
Step by step
- 01
Deploy
The same NerveEvidence stack with the AI Governance pack selected; it can run beside the Compliance pack.
- 02
Discover
A scheduled, read-only job lists AI resources and settings across accounts and regions.
- 03
Map and sign
Results are mapped to framework controls and written as a signed bundle under S3 Object Lock.
- 04
Review
Controls that need human judgement stay Manual, with templates, until you add evidence.
Built on AWS
The AWS services it uses
- Amazon Bedrock
- Amazon SageMaker
- AWS Identity and Access Management
- AWS Security Hub
- AWS CodeBuild
- Amazon S3 Object Lock
- AWS KMS
- AWS CloudFormation
Your data
Reads metadata only, with read-only permissions, inside your account. Nothing is sent to CloudNerve.
Scope, stated plainly
What it does not do
- Classify your AI systems under the EU AI Act; that stays with you and your counsel
- Perform a conformity assessment or certify anything
- Test models for bias or accuracy
- Read prompts or outputs (by design)
Questions
Common questions
- Is the EU AI Act view a statement of compliance?
- No. It is a readiness view mapped to the Act's articles. Legal classification of each system stays with you.
- Can it run with the Compliance pack?
- Yes. Both packs run from one stack and one schedule.
- Does it see our prompts?
- No. Its permissions exclude content reads, and a test in the product checks that they stay excluded.
See NerveEvidence AI Governance on your own AWS data.
Book a free Intro Call with a CloudNerve architect, or ask us anything about how it would fit your accounts.