Govern AI, from inventory to trusted action.
The active governance engine for every AI asset, risk and control in regulated financial services. Cogna8 gets AI into production faster, and ready for regulators.
Built on the obligations you already report against
- Regulation
- APRA Prudential Standards CPS 230 Operational Risk Management and CPS 234 Information Security, implemented control by control. ASIC and MAS expectations tracked alongside.
- Legislation
- The Financial Accountability Regime, and Privacy Act reforms that from December 2026 require privacy policies to explain decisions made or substantially supported by automated systems.
- Obligations
- Each obligation carries its source, its effective date, an accountable executive, and the controls and evidence that satisfy it.
Standards and guidance referenced in the platform design: MAS AIRG, IMDA Agentic AI, ISO 42001, EU AI Act, NIST AI RMF.
Cogna8 One, AI governance from visibility to authority
Start with what AI you run and who owns it. Carry the same record through controls and evidence to the moment an agent acts.
Know what you run
One inventory of models, agents, copilots and MCP servers, each with an owner, a risk tier and the controls it needs.
Govern with evidence
Obligations become owned controls in a versioned registry. Each one rises from declared to effective only as evidence supports it.
Start with visibility. Add authority where consequence begins.
See every screen in Cogna8 OneWhat your AI governance should answer
Which AI systems and agents are operating across the organisation?
They arrive through every team and vendor. Most organisations cannot list them all.
Who owns each one, what risk does it carry, and which controls apply?
Ownership, risk and obligations belong on one record, not in separate registers.
Which controls are evidenced and effective?
A control on paper is a claim. Dated evidence is what an auditor accepts.
Where are the gaps, exceptions and unresolved risks?
Missing controls, stale evidence and open exceptions, found before a regulator asks.
When an agent acts, can you prove why it was allowed?
The facts, policy and approval behind each decision, kept as a receipt.
AI proposes. Cogna8 decides whether it may act.
Access controls decide what an agent can reach. Cogna8 decides whether this action is authorised now, against current facts, your controls and any approval required.
- ✓Allowed to make paymentsThe claims assistant may pay claims
- ✓The facts agreeClaim and payment systems both show A$3,900
- ✓Within the limitPayments under A$10,000 need no approval
The facts agree and the amount is within the assistant's limit. The payment goes ahead.
Every decision leaves a receipt: what was proposed, what was known, which policy applied and why.
One record, three teams
Which high-risk AI do we run, and is it controlled?
A current view of AI risk, tied to the obligations you report on.
What do I need before this agent goes live?
Register once, ship with controls defined, connect to the gate when authority is needed.
Can we show this control worked last quarter?
Dated evidence and receipts, with a clear line between declared and proven.
Research and thinking
All publications
AI Governance: Preparing for 2027
The dated AI obligations of the next fifteen months, and the controls worth building now.
Global AI Agent Governance: The 2026 Regulatory Landscape
Twelve instruments across five jurisdictions, and who authorised the action.
AI Agent Governance Australia
APRA, ASIC and Australian guidance that shapes how agents may act.
Start with visibility
Scoped to your own AI estate, with runtime authority added only where an agent needs it.