Appearance
Core Concepts
This page defines the building blocks you’ll see throughout Modulos and how they connect.
Quickstart5 min
Create your first AI System and complete one Control
From Zero to Audit-Ready30–60 min
End-to-end walkthrough from scoping to exports
Guided Paths
Role- and lifecycle-based workflows
Concept map
Organization
Peopleusers, roles, permissions
Settingslanguage, currency, organization profile
Shared librariesframeworks, risk taxonomy
AI Systemsregistered AI systems and the organization AI System
GovernanceFrameworks → Requirements → Controls → Evidence
RiskRisks → Threats → Quantification (monetary)
Runtime InspectionSources → Metrics → Tests → Results
AutomationScout + agents + integrations
Mental model
Frameworks define what’s required. Controls define how you satisfy it. Evidence proves it. The Requirement Owner's review makes it auditable.
Organization
An organization is your workspace boundary in Modulos. It defines who can access the platform and sets global defaults.
Typically, your organization contains:
- Users and permissions (access at the organization level and within each AI System)
- Organization settings (language and currency defaults)
- Shared libraries (framework library and organization risk taxonomy)
Learn more: Organizations
Users, roles, and permissions
Modulos is designed for cross-functional work. Access is typically defined at two levels:
- Organization: configuration and administration
- AI System: day-to-day work on Controls, Evidence, risks, and testing
Best practice
Use AI System roles to limit who can change Control statuses and who owns Requirement reviews. This preserves separation of duties for audit trails.
Learn more: User Management
AI Systems
An AI System is the unit of work in Modulos. It is registered in the AI Registry and typically corresponds to one deployed AI system or use case.
The AI Registry lists two types:
| Type | When it applies | Typical output |
|---|---|---|
| AI Application (every AI System you register) | Governing a specific AI system in its deployment context | Control implementation + Evidence, risk register, testing results |
| Organization (the organization AI System, for organization-wide Requirements) | Governing organization-wide Requirements (policies, vendor posture, global Controls) | Organization-level Evidence and reports |
Organization-scope frameworks (OFF-x) attach to your organization AI System, listed with Type Organization in the AI Registry. The AI Registry does not create new organization AI Systems; if your organization does not have one yet, contact Modulos support before rolling out organization-scope frameworks.
Learn more: AI Systems
Frameworks
A framework represents a regulation, standard, or internal policy structure (for example EU AI Act, ISO 42001, NIST AI RMF). Frameworks are how you scope “what applies” to an AI System.
In Modulos, frameworks can be mapped so that one Control can contribute to multiple frameworks. This reduces duplication and keeps implementation consistent across compliance programs.
Learn more: Frameworks in Modulos
Requirements
Requirements are the "what" of a framework — the high-level obligations that come directly from the Source document.
Framework-specific
Requirements represent articles, clauses, or chapters from the original regulation or standard. They preserve the structure and language of the Source document for traceability.
Example: The EU AI Act Framework has a Requirement representing Article 10 of the Act, "Data and Data Governance".
Requirements typically:
- map directly to articles, clauses, or chapters in the original framework document
- group related obligations into a single trackable unit
- map to one or more Controls that operationalize implementation
- provide traceability for audit evidence
Learn more: Requirements
Controls
Controls are the "how" — the concrete measures you implement to satisfy Requirements.
Designed for reuse
Unlike Requirements, Controls are not tied to a single framework. A well-designed Control can satisfy Requirements from multiple frameworks simultaneously, reducing duplicated work across compliance programs.
Example: Control "MCF-24 Data Design Choices" maps to relevant Requirements in multiple Frameworks, including the Article 10 Requirement of the EU AI Act.
A Control commonly includes:
- Guidance (what “good” looks like and how to implement it)
- Ownership (who is responsible)
- A report/narrative (your explanation of implementation)
- Linked Evidence (the supporting artifacts)
- Status (changed directly, with a logged comment for the audit trail)
- Links to risks and tests (to connect implementation to outcomes)
Learn more: Controls
Evidence
Evidence is the proof. It can be a policy, screenshot, export, log sample, contract, test result, or any artifact that supports a Control’s implementation.
Evidence should answer:
- What is this artifact?
- Which Control(s) does it support?
- What claim does it substantiate (and for which timeframe)?
Learn more: Evidence
Status, readiness, and review
In Modulos, status is concept-specific, and the path to a final status differs between Controls and Requirements.
Controls are completed directly. Controls track execution: Not executed → Executed (or Out of scope). Whoever holds the right to change status sets it on the Control detail page and confirms the change with a comment. The comment is logged in the Control's Comments and Logs, so the trail shows who changed the status, when, and why.
Not executedimplement and attach Evidence
Executedconfirmed with a logged comment
Out of scopewhen not applicable
Reviews happen at the Requirement level. Requirements track fulfillment: Not fulfilled → Fulfilled (or Out of scope). As linked Controls reach a final status, the Requirement becomes ready for review. The Requirement Owner then reviews the completed Controls and marks the Requirement as Fulfilled.
Not fulfilledlinked Controls still open
Ready for reviewlinked Controls in a final state
FulfilledOwner reviews and confirms
Out of scopewhen not applicable
Use “Out of scope” sparingly
Treat “out of scope” as a decision that may be challenged. Record the rationale in the Control/report so the audit trail is complete.
Learn more: Reviews & Statuses
Risk
Modulos supports risk management at the organization level and per AI System.
- Organization taxonomy: the shared catalog of categories, risks, and threats your organization uses for consistency.
- AI System risks: the risks that apply to an AI System, broken down into threats for quantification.
Learn more: Risk
Risk quantification
Risk quantification turns qualitative risk statements into monetary impact so you can prioritize mitigation and investment.
Why monetary?
5×5 risk matrices are not quantification and are often misleading.
Money is the point because it:
- serves as a universal unit across risk types
- forces abstract harms (reputation, trust, mission delay) into stakeholder-relevant terms
- connects directly to organizational risk appetite, which is ultimately expressed through resource allocation
Learn more: Risk Quantification
Runtime Inspection
Runtime Inspection lets you continuously verify key properties of your AI system (or its operational environment) using metrics and rules.
The runtime inspection model is:
- Sources connect to systems that provide metrics and context (for example Prometheus and Datadog for pull metrics, Modulos Client for pushed metrics, and GitHub and Azure for AI System context).
- Metrics are the measurements available from a Source.
- Tests define conditions over metrics (thresholds, comparisons, schedules).
- Results are the historical outcomes you can reference in Controls and audits.
Learn more: Runtime Inspection
Connectors vs Sources
Sources are service accounts attached to an AI System, used to power Runtime Inspection (metrics → tests → results) for that AI System. Connectors are user-level accounts connected to a user (typically via OAuth) and used to bring external context into Scout.
AI agents and automation
Modulos includes AI agents to accelerate documentation and investigation workflows.
- Scout: conversational assistant grounded in your AI System context (Controls, Evidence, Requirements).
- Evidence Agent: helps summarize and associate Evidence, with human-in-the-loop review.
- Control Assessment Agent: supports structured Control assessments, with human-in-the-loop review.
- Risk Agent: autonomously quantifies a risk threat in monetary terms, recording the full reasoning trace; runs can be repeated or replaced with another quantification method.
Learn more: AI
Reporting and audit readiness
Audit readiness is an outcome of consistent traceability:
- Requirements → Controls → Evidence → reviews → exports
Learn more: Reports & Exports