AuditAlign maps your bank's internal controls to SR 26-2, NIST AI RMF, and the CRI FS AI RMF — surfacing the exact gaps examiners are finding, before they find them. Gap determinations are produced by a deterministic matching engine, not an LLM: every finding traces to a numeric similarity score your team can audit, reproduce, and defend in front of an examiner. Non-compliance costs institutions 2.71× the cost of a compliance program — and $19.3B in global fines were issued in 2024 alone. Prevention is the only rational calculation.
Comprehensive AI/model risk exam preparation — in minutes, not months
Four structural gaps generating examination findings right now, consistently across every institution size.
MRM-validated models are documented. Vendor-embedded AI — fraud scoring, document processing, decisioning tools — rarely is. SR 26-2 requires a comprehensive inventory regardless of source.
Governance policies reference NIST or SR 26-2 by name but contain no mapping between specific internal controls and the framework requirements those controls are supposed to satisfy.
Traditional SR 26-2 validation procedures applied to GenAI and ML systems without adaptation. The OCC has explicitly noted that standard back-testing may not be appropriate for non-deterministic systems.
Reporting acknowledges AI risk in general terms but cannot answer the examination question: what are your open AI governance gaps, who owns them, and what is the remediation timeline?
Every quarter, more institutions receive AI-related examination findings they weren't prepared for. Regulators aren't waiting for a final rulebook — they're examining now, using existing authorities and emerging guidance. Institutions that act first define the standard. Those that wait inherit the findings.
All five federal financial regulators issue a joint RFI on AI in banking — the most unambiguous signal that AI governance is a shared, cross-agency supervisory priority, not a single-agency initiative.
NIST AI Risk Management Framework 1.0 published. Becomes the de facto reference standard banking examiners cite when evaluating whether an institution has a defensible AI governance program.
First AI enforcement actions filed against investment advisers for false claims about AI use — “AI washing.” The SEC's message is explicit: AI governance documentation must be accurate, specific, and defensible.
157 AI-related regulatory updates issued to financial services in a single year — nearly double prior volumes. Supervisory expectations are escalating, not stabilizing. Every quarter adds new guidance.
CRI Financial Services AI RMF published — the first AI governance framework purpose-built for banks. Co-developed with the U.S. Treasury and 108 institutions. Explicitly extends SR 26-2. Examination implications begin now.
Three landmark regulatory events in 90 days. $19.3B in record global fines in 2024. A 417% surge in penalties in H1 2025. The mandate exists. The automated mapping tool doesn't — until now.
Provide your existing control library in any format — CSV, Excel, or text. No reformatting required. AuditAlign accepts natural-language control descriptions as written by your team.
Choose NIST AI RMF (72 requirements), CRI FS AI RMF (230 control objectives), or run both simultaneously. Frameworks are built in — no configuration needed.
The engine uses sentence-level embeddings and reciprocal matching logic to compare each internal control against every framework requirement — capturing substantive coverage regardless of terminology. The process is fully deterministic: the same control library run against the same framework produces identical results every time, with no randomness or model variability.
Every finding is classified as Confirmed Match, Partial Match, or Gap by the matching algorithm, based on numeric similarity scores against fixed thresholds — not by an LLM. After the determination is made, an LLM generates plain-language rationale explaining why, written in the language an auditor would use in a workpaper. The algorithm determines the outcome. The LLM explains it.
Output is a 10-tab workbook: Dashboard, Confirmed Matches, Partial Matches, Gaps, NIST match status, gap register, summary views, and run metadata. Designed for audit trail purposes from the first run.
| Framework control | Best match | Score | Status |
|---|---|---|---|
| GV 1.6 | AI Model Inventory Registration | 0.81 | Confirmed |
| MS 3.1 | Performance & Drift Monitoring | 0.76 | Confirmed |
| GV 1.2 | AI Privacy & Data Governance | 0.61 | Partial |
| MG 4.1 | — no internal control — | — | Gap |
| GV 6.1 | — no internal control — | — | Gap |
| MS 2.5 | Bias & Fairness Testing | 0.58 | Partial |
The classification — Confirmed Match, Partial Match, or Gap — is the output of a deterministic algorithm: fixed thresholds, fixed logic, reproducible results. An LLM is used only to generate the plain-English rationale that explains a finding after the determination is made. This distinction matters to regulators, internal audit, and your board: every compliance determination in AuditAlign can be traced to a specific numeric similarity score, a documented threshold, and a recorded model version — all captured in run metadata. Your team can audit, challenge, and defend every finding without relying on the interpretation of a language model.
Both frameworks are bundled into the platform. No configuration, no manual uploads.
The voluntary, sector-agnostic framework that has become the de facto reference standard for AI governance in financial services. Four functions — Govern, Map, Measure, Manage — with 72 control requirements.
Co-developed by 108 financial institutions and the U.S. Treasury. The first framework purpose-built for financial services AI governance. Explicitly extends SR 26-2. Four maturity stages from Initial (21 controls) to Embedded (230). Examination implications begin now.
Every gap analysis is framed in SR 26-2 language — the supervisory standard examiners will cite during an AI governance review. Output rationale is written to address effective challenge, validation sufficiency, and governance documentation requirements.
Every output is structured for the people who will use it — second-line MRM teams, internal audit, and the examiners who review their work.
Each finding is classified by the deterministic matching algorithm — Confirmed, Partial, or Gap — based on a numeric similarity score. An LLM then generates plain-English rationale explaining the classification in the language an auditor would use in a workpaper. The algorithm makes the call; the LLM makes it readable.
Dashboard, match tables, gap register, framework-level summaries, category breakdowns, and full run metadata. Every tab is audit-ready on export.
Each gap has an owner, risk classification, remediation status, and evidence notes field. The register is designed to look the same in a board package as it does in an examiner's workpapers.
Coverage donut by NIST function, gap score histogram, stacked bar by framework category, and key findings summary — all from within the platform before export.
Design Partners co-build the product with us at no cost. Paid Pilots run a structured 8-week evaluation with full platform access and a path to subscription.
For institutions willing to help shape the product in exchange for early access. We run the analysis and give you the full deliverable; you give us honest feedback that steers the roadmap. Limited to 2–3 institutions per month.
A structured 8-week evaluation with live platform access, real users, multiple runs as your controls evolve, and a week-8 executive readout. The fastest defensible path from "we should look at this" to a subscription decision.
Tell us about your institution and which track fits. We follow up within one business day.
"Most institutions I've examined don't lack commitment to AI governance. They lack the operational infrastructure to demonstrate it."
I spent years on both sides of the examination table — first as a federal bank examiner, then in second-line model risk management roles at a regional bank and a Fortune 100 financial institution. The same problem appeared everywhere: institutions with genuine governance programs that couldn't produce the evidence an examiner needed to see it.
The manual process of mapping internal controls to regulatory frameworks — NIST AI RMF, SR 26-2, the new CRI FS AI RMF — takes weeks of practitioner time and still produces outputs that are inconsistent and hard to defend. I built AuditAlign to automate that specific workflow. Not to replace expert judgment, but to do the mapping work so practitioners can focus on the decisions rather than the documentation.
The platform uses semantic embeddings to compare control language against framework requirements, reciprocal matching logic to classify coverage accurately, and LLM-generated rationale to explain every finding in the language an auditor would recognize. The output looks like something an MRM team produced — because it was built by one.
Evaluate with a Design Partner engagement or a Paid Pilot, then scale into an annual subscription priced by asset size.
Limited to 2–3 institutions per month. We extract value from your feedback; you get the full deliverable at no cost.
A structured evaluation inside your team's workflow. Credit 25% of the pilot fee toward your first-year subscription if you convert.
For community and regional institutions standing up AI governance for the first time. Everything you need to demonstrate coverage for an exam.
For mid-size banks with mature MRM programs that need role separation, custom frameworks, and a read-only pipe into their GRC tool.
For large regional institutions with multi-entity reporting, SSO requirements, and continuous monitoring expectations.
For money-center and global institutions that need private deployment, BYO LLM, examiner workpaper formats, and SOC 2 Type II turnkey.
All annual tiers are billed yearly with no long-term contract. Features listed in future-facing italics (e.g. SOC 2 Type II, GRC connectors, examiner-workpaper exports) are part of the committed roadmap and delivered on the timeline agreed in your order form.
We handle sensitive institutional compliance data. Here are the security questions we hear most from compliance officers, CISOs, and vendor risk teams — with technically specific answers.