AI governance, risk and compliance
AI policy as a living knowledge graph, checked against every AI system
VLINQ turns AI policies into a living knowledge graph that continuously checks every AI system against the rules that apply to it — and can block an AI agent's tool call when it doesn't comply.
For public administrations and regulated organisations deploying AI, including agents with tool access.
Where AI governance breaks down
“We have an AI policy, but nobody can tell me which systems it applies to.”
“Our AI inventory is a spreadsheet that's out of date the day it's finished.”
“Evidence for audits is scattered and expires without anyone noticing.”
“We're deploying agents with tool access and have no enforcement point.”
“When the regulator asks why a decision was made, we can't reconstruct it.”
How it works
Six steps from a policy document to enforcement.
-
Ingest
Human-gated
Upload a policy document as Markdown or PDF.
-
Extract
Human-gated
Principles, prohibitions with exceptions, obligations with evidence, cadence and role, and recommendations are extracted into a validated ontology.
-
Review and promote
Human-gated
A policy lead reviews the staged output and promotes it. Organisations add their own overlays.
-
Register
Human-gated
Each AI system is registered as a Work Stream with declared characteristics, safeguards and grading vectors.
-
Reason
Continuous
Deterministic reasoning finds violations, open obligations, expired evidence, telemetry breaches and attested-vs-observed discrepancies.
-
Enforce
Continuous
The same verdicts drive an MCP policy gateway that allows, annotates or denies agent tool calls.
What VLINQ gives you
Policy becomes executable
Policy documents become principles, prohibitions, obligations and recommendations in a validated ontology that reasoning runs against.
Human-gated, never autonomous
A policy lead reviews staged output and promotes it. A human approves every rule in the policy graph.
Continuous, evidence-based compliance
Obligations carry evidence, cadence and due dates. Scans surface open obligations, expired evidence and telemetry breaches.
Explainable and auditable
Every scan, verdict, promotion, override and gateway decision is a W3C PROV activity.
Enforcement at runtime
An MCP policy gateway allows, annotates or denies agent tool calls using the same verdicts.
Standards, not lock-in
RDF, SPARQL, SHACL, OWL, PROV-O and SKOS, with the AIRO, AIUP and DPV-EUAIAct ontologies.
Human oversight by design
Human-gated
Extracted policy is staged, not applied. A policy lead reviews and promotes it, and evidence judged by an LLM goes to a human review queue.
Deterministic reasoning
Findings come from SHACL and SPARQL reasoning over the approved, human-validated policy graph — not from a model deciding on the fly.
Decision support, not certification
VLINQ supports your assessment against the rules that apply to you. It does not certify compliance.
Who it's for
Chief AI / Data Officer
Know which rules apply to every AI system — and where you're weak
Policy / Compliance lead
Your policy, machine-readable, with a human approving every rule
DPO / Legal
Every verdict traceable to clause, version and reviewer
CISO / Platform security
A gateway that denies non-compliant agent tool calls
AI product owner
A clear list of open obligations and how to close them
Enterprise architect
Open W3C standards: RDF, SPARQL, SHACL, PROV-O, MCP
Enforcement for AI agents
Agents reach their tools through the VLINQ MCP policy gateway. For each tool call the gateway applies the verdicts from your policy graph. Agents are identified as agent principals, and tool definitions are pinned by hash.
- Allow
- The call complies and goes through.
- Allow with advisories
- The call goes through, annotated with what needs attention.
- Deny
- The call does not comply and is blocked.
Planned: human-in-the-loop approval for tool calls.
Open standards
Your policy is data, not a proprietary format: the policy graph is exportable as RDF.
Standards
- RDF
- SPARQL
- SHACL
- OWL
- PROV-O
- SKOS
- MCP
Ontologies
- AIRO
- AIUP
- DPV-EUAIAct
Request a briefing
Tell us about your organisation and what you would like to see.
Frequently asked questions
Does an LLM decide compliance?
No. An LLM helps extract policy content and judge evidence, and people review both: extracted policy is staged for a policy lead to promote, and evidence judgements go to a human review queue. Verdicts come from deterministic SHACL and SPARQL reasoning over the approved graph.
Can we encode our own policy?
Yes. Ingest your policy document as Markdown or PDF, review the staged extraction and promote it. You can work with a default policy plus your own overlays, and conflicts between them are detected.
Can we change what blocks and what only warns?
Yes. An enforcement matrix sets which findings lead to a deny and which to an advisory.
Which frameworks are covered?
EU AI Act reasoning is available today: high-risk classification, prohibitions, obligations and readiness, alongside Framework 3.0 five-tier grading. Planned: NIST AI RMF, ISO 42001 and UNESCO RAM report views.
How do AI agents integrate?
Through the Model Context Protocol. Agents call their tools via the VLINQ MCP policy gateway, which identifies each agent as a principal, pins tool definitions by hash and allows, annotates or denies each call.
Can we reconstruct a past decision?
Every scan, verdict, promotion, override and gateway decision is recorded as a W3C PROV activity in the audit trail, so each verdict is traceable to clause, version and reviewer. A dedicated audit reconstruction report is planned.
Where does our data go?
The graph and files stay in the deployment. Policy and evidence documents are sent to AWS Bedrock for extraction and judging — [confirm region].
Does VLINQ certify EU AI Act compliance?
No. VLINQ supports assessment; it does not certify.