Add AI governance to the security program you already run.
Throughline is a linked kit for tech companies of 1 to 50 people. Register every AI tool, rate its risk, review your AI vendors and answer customer questionnaires with evidence. It plugs into the ISO 27001 system you already have.
| ID | System | Tier | Vendor review | Review status |
|---|---|---|---|---|
| AIS-004 | HireSift résumé screening | T1 | Full · 2 red flags | On track |
| AIS-003 | Report Summaries feature | T1 | Full · acceptable | Overdue |
| AIS-006 | Support desk reply drafting | T2 | Core · acceptable | On track |
| AIS-001 | Enterprise chat assistant | T2 | Core · acceptable | Due in 30 days |
| AIS-005 | Marketing image generator | T3 | Terms check · approved with conditions | On track |
The AI section is already in your customers’ security questionnaires.
“Do your vendors train on our data?”
Expect it in any questionnaire with an AI section. You need a written answer for every AI tool that touches customer data.
“Show us your AI inventory and risk assessments.”
Auditors and enterprise customers want records. A policy on its own does not answer the question.
“Which AI tools are your staff using?”
AI now ships inside the help desk, the CRM, the office suite and the code editor. It is easy to switch on without anyone reviewing it.
Free templates give you four separate documents. They use different terms, they don’t connect, and none of them tells you what to do next. Throughline is one system.
One loop. Every record traces back to one system ID.
The policy says the loop must run. The workbook is where it runs. The answer bank is how you show customers it runs.
Every AI tool gets a record
Owner, purpose, our role, data class and regulatory flags. Staff must ask before using anything new.
Eight questions set the tier
The tier decides the approver, the depth of assessment, the depth of vendor review and the review cadence.
Depth follows risk
Risk and impact assessments with 5 × 5 scoring. Vendor reviews sent as a web questionnaire. Red flags need executive sign-off.
Decide, then answer customers
Approval conditions are recorded. Thirty ready answers turn your records into questionnaire responses.
AI risks use your existing ISO 27001 risk scale and land in the same risk register, internal audit and management review.
Everything a small team needs to run AI governance and prove it.
AI Governance Workbook
XLSXInventory with automatic risk tiers, vendor register, risk and impact assessments, vendor AI review with scoring and red flags, exceptions and a live dashboard. Blank edition plus a fully worked example.
Vendor AI questionnaire
WEB · XLSX35 questions in three depths. Send vendors a link; they answer in their browser and return one file that pastes straight into the workbook. Nothing passes through our servers.
AI Policy
DOCXThe short policy leadership signs: commitments, red lines, roles, risk appetite and the processes that enforce it. Guidance notes explain each choice.
AI Acceptable Use Standard
DOCXPlain-language rules for staff, a data-by-tool table, a one-page summary and an attestation form. Includes the clause Colorado’s new law looks for in chat-tool policies.
Customer Questionnaire Answer Bank
DOCX30 answers to the AI questions customers ask, each with the evidence to attach and a condition that stops you overclaiming.
Implementation Guide
DOCXA 30-day plan with owners and outputs for each week, ways to find AI already in use, and a worked example from start to approval.
NIST AI RMF crosswalk
XLSXEvery field, question and policy clause traced to NIST AI RMF 1.0 subcategories, with ISO/IEC 42001 clause references.
Readiness scorecard
WEBRe-run the 18-question scorecard after 30 days to show leadership the change.
Halden Analytics, a fictional 28-person SaaS company.
The workbook ships blank and fully completed for Halden, and the guide walks through its decisions. Here is how one system moved through the loop.
- RequestThe People Lead wants to pilot an AI résumé screener. She raises a request, as the acceptable use standard requires.
- Triage: T1Its rankings influence hiring decisions. Flags: employment, EU AI Act high-risk, Colorado automated decision tool.
- Vendor review: conditions requiredScores 87%, but two critical answers are weak. The vendor cannot confirm it won’t train on applicant data, and it hasn’t shared bias-test results.
- AssessmentSix risks and five impacts on applicants. The biggest risk drops from 15 to 8 with recruiter review and a quarterly bias check.
- DecisionThe CEO approves a pilot to year end with recorded conditions. One row in the inventory now shows the whole trail.
“I led SOC 2 Type II and ISO 27001:2022 certification as the security leader of a B2B SaaS company. Then customers started asking about AI. Throughline is the kit I wanted on my desk that week.”
Jacob Hesse, founder of All These Worlds Are Yours. Twenty years running delivery, operations and security governance for services and software companies.
One price. Files you keep.
Compare it with a few hours of consulting, or with a deal that stalls on the AI section of a questionnaire.
For teams answering customer AI questions and building their first AI governance records.
- AI Governance Workbook, blank and worked example
- Vendor AI questionnaire: web page and Excel
- AI Policy and AI Acceptable Use Standard
- Customer Questionnaire Answer Bank
- 30-day Implementation Guide
- Free minor updates
For teams preparing for ISO/IEC 42001 certification alongside ISO 27001.
- Everything in Starter
- AI management system scope and context worksheet
- ISO/IEC 42001 Annex A Statement of Applicability extension
- AI objectives, internal audit and management review templates
- EU AI Act and India data protection modules
An optional annual update plan covers new versions of NIST AI RMF, ISO/IEC 42001 guidance and the AI laws in the kit.
Before you buy
Will this get us ISO/IEC 42001 certified?
No kit can do that. Certification comes from an accredited body that audits a management system once it has been running. Throughline gives you the core of that system: policy, roles, inventory, risk and impact assessment, supplier control and records. Certification Prep adds the remaining documents most audits look for.
Do we need ISO 27001 first?
No. Throughline is designed to plug into ISO 27001 and uses its risk scale, incident process and management review. If you run SOC 2 or a less formal security program, use the same hooks in your own processes.
What do we actually get?
Excel and Word files you edit and keep, plus a web questionnaire for vendors. There is no software to install and no account to create. Your data stays in your files.
Does it cover the EU AI Act and US state laws?
Every AI system gets regulatory flags, and assessments include an EU AI Act screen. The acceptable use standard includes the chat-tool clause Colorado’s 2027 law looks for. Treat them as prompts for a conversation with counsel.
How long does it take?
The guide is built around 30 days for a company with 5 to 15 AI tools. If a customer questionnaire is due sooner, start with the inventory and the answer bank’s fallback wording.
Is this legal advice?
No. It is practitioner-built governance material. We recommend a short legal review of the policy clauses flagged in the guidance notes.
Can consultants use it with clients?
A consultant licence is planned. Get in touch through alltheseworlds.us if you want early access.