Appearance
First Steps
Set up the foundations that make everything else in Modulos work better, from Scout's answers to risk quantification and audit readiness.
Who is this for?
Organization Admins setting up a new workspace, or anyone registering the first AI System. If your organization is already configured, skip to Quickstart.
Why this matters
Modulos uses your organization and AI System descriptions as direct context for Scout, the AI assistant. If these are empty, Scout's answers will be generic. The risk taxonomy and limits you configure here propagate throughout the platform: they determine what risks teams can select, how budgets are allocated, and whether quantification is even possible.
Spending 20–30 minutes here saves hours of rework later.
Step 1: Configure your organization
Organization → Settings
Organization description
Your organization description is injected directly into Scout's system prompt. It's the first thing Scout knows about you. If it's blank, every answer starts from zero context.
The platform prompts you with:
Write a brief description of your organization to help our AI agents understand what context you operate in. The following information would be helpful:
- What business your organization is in
- What products or services you offer
- What countries or regions you operate in
- Key figures such as how many employees you have, what your revenue is
- Anything else that would help the agents assist you
Two to three paragraphs is enough. Be specific: "Series B fintech company offering credit scoring APIs to European banks, 120 employees, headquartered in Zurich" is far more useful than "We are a technology company."
Currency
Sets the unit for all monetary risk quantification, budgets, and portfolio rollups. Choose it now, because Modulos does not retro-convert historical values if you change it later.
Default language
Controls the UI language for the organization. It does not translate your content (Control reports, Evidence, policies stay as written).
INFO
Learn more: Organization Settings
Step 2: Invite users and assign roles
Organization → Users
Before registering AI Systems, bring in the people who will work in them. Modulos uses role-based access at two levels: organization roles control who can configure shared settings, and AI System roles control who can implement, review, and audit within each AI System.
Organization roles
- Organization Admin — can manage settings, users, and register AI Systems. Keep this to a small, trusted set.
- Organization Risk Manager — can maintain the risk taxonomy, budgets, and limits. Assign this to whoever owns risk governance.
- Organization Policy Manager — can manage the Policy Center. Assign this to whoever owns organization-wide policy content.
- Organization Member — baseline access. Can view shared settings and work within assigned AI Systems.
How to invite
- Go to
Organization → Usersand click Invite - Enter the user's email address
- Assign an organization role
- The user receives an email with a signup link (valid for 7 days)
Invite early, assign AI System roles next
You can invite the full team now and assign AI System roles when you register each AI System in the next steps.
INFO
Learn more: User Management
Step 3: Enable Connectors and Sources
Organization → Source Connectors
By default, all Connectors and Sources are disabled. Until you enable them, the platform is blind to your systems: Scout cannot investigate your repositories or documents, and Runtime Inspection has nothing to test against. Review this page as part of your first pass at organization settings.
The page has two tabs:
- Connectors — OAuth connections that ground AI-assisted work in your systems: Google Drive, GitHub, Atlassian, Bitbucket.
- Sources — service accounts that Runtime Inspection tests run against, such as Prometheus, Datadog, OpenTelemetry, Modulos Client, GitHub, Azure, Langfuse, AWS, Vijil, and Snowflake.
Enable what your organization actually uses. Disabled Connectors and Sources are not available in any AI System, new or existing, so a Connector left off here is off for every team.
INFO
Learn more: Integrations
Step 4: Register your first AI System
AI Registry → New AI System
An AI System is the unit of work in Modulos: one entry per deployed AI system or use case, in its deployment context (one model, one use case, one set of users). System-specific compliance, risk quantification, and testing happen here.
Keep AI Systems narrow. One deployed system or use case per AI System keeps Evidence defensible and risk quantification comparable. If you run three systems, register three AI Systems. The same tool used for two different purposes may need two entries, because risk classification depends on what the system is used for.
Intended purpose and description
New AI System asks for a name and the owners, saves the entry as a Draft, and opens the wizard, which asks for an Intended Purpose (required) and a Description.
The intended purpose drives the legal classification of the system. Name the task it performs and the business process it sits in, the people affected by its outputs (employees, applicants, customers), and the domain. "Answers employee questions about HR policies" and "screens job applications" are both HR chatbots in very different risk categories, so describe your actual use.
The description is injected directly into Scout's system prompt (up to 5,000 characters). It's the single biggest lever for making Scout's answers specific to your system. Describe what the system is and how it works: the type of technology, what data goes in, what comes out, and who uses it. Write about your deployment, not the vendor's marketing text.
Write it like a scope statement
Include the system architecture (e.g. "RAG pipeline using GPT-4o with a Qdrant vector database"), data Sources, deployment context, and end users. This is both the context Scout uses for every answer and the scope statement auditors will reference later.
Other fields to set early
- Current State (required): Proposed, Pilot, or Already in use. Describe what exists today, not what was approved.
- Where will this AI System run? (required, on step 2): Internal, Employee-facing, Customer-facing, Embedded in product. Select every user group that applies.
- Does the EU AI Act apply to this AI System? (step 2): Yes, No, or Not sure. The classification fields appear only on Yes.
- AI lifecycle stage: tells Scout where your system is in its lifecycle (design, development, production, etc.)
- Annual economic value: a scale indicator used for risk limit distribution across AI Systems. A rough estimate is fine; you can refine later.
- Geographic Scope: where the system is used (EU, UK, US, APAC, LATAM, MEA, Global). Part of the context Scout uses.
- Roles: you are the first Owner. Add a second Owner in the create dialog, and Editors for the working team and Viewers for read-only oversight in
AI System → Settings → User Access.
EU AI Act and frameworks
Answer Yes to the EU AI Act question on step 2 if the Act applies and record the classification (Product Category, Role, Use Case). The EU AI Act framework is then pre-selected on step 3. Scout is available from the page header throughout registration and reads what you have entered so far. Add the other frameworks that apply; OWASP Top 10 for LLM Applications and NIST AI RMF are common starting points. You can start with one and expand later in AI System → Settings → Frameworks. When nearing an audit, freeze framework updates there to preserve stability.
INFO
Learn more: Register an AI System
Step 5: Attach organization-scope frameworks to the organization AI System
AI Registry → organization AI System → Settings → Frameworks
Modulos separates two layers of governance: the AI Systems you register for individual deployed systems, and one organization AI System for everything that applies across them.
What the organization AI System is
The organization AI System covers organization-wide governance programs and shared Controls: company-wide AI policies, management system documentation (ISO 42001, ISO 27001), and cross-cutting governance processes that apply to all your AI systems. It appears in the AI Registry with Type Organization. Every organization needs only one.
Organization-scope frameworks (OFF-x) attach to it. The AI Registry does not create new organization AI Systems; if your organization does not have one yet, contact Modulos support before rolling out organization-scope frameworks.
What to do
- Open the organization AI System from the AI Registry (Type Organization).
- In
AI System → Settings → General Settings, write its description. You can leave it blank when the organization description underOrganization → Settingsalready covers it; describe a specific scope (a certification, a sub-unit of your organization) if it has one. - In
AI System → Settings → User Access, assign roles: at least one Owner; add Editors for the people doing the work. - In
AI System → Settings → Frameworks, click Add Framework and select organization-level standards such as ISO 42001, ISO 27001, or NIST AI RMF.
How the two layers work together
| Organization AI System | AI System | |
|---|---|---|
| Scope | Organization-wide policies, management systems | One deployed AI system or use case |
| Typical frameworks | ISO 42001, ISO 27001, NIST AI RMF | EU AI Act, OWASP, NIST AI RMF |
| Controls | Shared policies, training, governance processes | System-specific technical and operational Controls |
| Risk | Cross-cutting governance risks | System-specific technical, operational, legal risks |
| How many? | One | One per deployed system or use case |
Controls in the organization AI System (e.g. "AI Ethics Policy exists and is reviewed annually") can be referenced by the AI Systems that rely on them, reducing duplicate work.
INFO
Learn more: AI Systems
Step 6: Review and customize your risk taxonomy
Organization → Risk Management → Category Taxonomy / Risk Taxonomy / Threat Vector Taxonomy
Modulos ships a default taxonomy with five categories:
| Category | Covers |
|---|---|
| Technical Risks | Model quality, robustness, security |
| Operational Risks | Human factors, monitoring, operations |
| Legal & Compliance Risks | Privacy, liability, regulatory exposure |
| Ethical & Reputational Risks | Fairness, harmful outputs, trust |
| Governance Risks | Program structure, documentation, oversight |
This is a starting point, not a final answer. A taxonomy that matches your actual systems makes risk quantification meaningful and comparable across AI Systems.
What to do
- Review the default categories and risks: are they relevant to your domain?
- Add domain-specific risks (e.g. for LLM applications: prompt injection in customer-facing contexts, hallucination in regulated advice, training data contamination)
- Curate threat vector associations — when a team adds a risk to an AI System, they can only select threat vectors linked to that taxonomy risk. If a threat vector isn't associated, it won't be selectable.
Start with what you know
You don't need a perfect taxonomy on day one. Add the risks you already discuss in your team, then evolve as incidents and audits teach you more.
INFO
Learn more: Organization Taxonomy
Step 7: Set risk limits so quantification can run
Organization → Risk Management → Risk Limits and the AI System risk limits
Risk quantification is blocked until budgets are configured consistently. These limits form a cascading structure:
- Total organization risk appetite — the monetary ceiling for acceptable risk
- Category allocations — percentage splits across risk categories (must sum to 100%)
- AI System risk limits — distributed from the total appetite (must also sum to the total)
What to do
- Set the total organization risk appetite in your chosen currency
- Allocate percentages across categories (e.g. Technical 30%, Operational 25%, Legal 20%, Ethical 15%, Governance 10%)
- Choose a distribution method for AI System limits: equal distribution or economic-value-based
- Review the resulting AI System risk limits; override manually if needed
Start with rough estimates
The point is to unblock the quantification workflow, not to get perfect numbers on day one. You can refine as you quantify real threats and learn what your actual exposure looks like.
INFO
Learn more: Risk Operating Model
What you've achieved
After these seven steps:
- Your team is onboarded with the right roles and permissions
- Connectors and Sources your organization uses are enabled, so Scout and Runtime Inspection can reach your systems
- Scout has the context it needs to give specific, relevant answers about your organization and AI Systems
- Both layers are set up: system-specific compliance in your registered AI Systems, shared governance in the organization AI System
- Risk quantification is unblocked and your team can start quantifying threats in monetary terms
- Your risk taxonomy reflects your actual domain, not just a generic template