When your auditor asks "how do you govern employee AI use?", Northbeams gives you a 30-second answer and a 30-page evidence pack. Pre-mapped to the controls auditors actually expect.
01 / The audit question
It's the question on every Vendor Security Questionnaire and every SOC 2 Type II control review in 2026. It's a deal-stopper if you don't have a 30-second answer.
Most companies answer with a Notion doc and an awkward shrug. The auditor asks for evidence. The shrug doesn't fit on a CSV.
VENDOR SECURITY QUESTIONNAIRE Q.41
"Describe the controls your organization has in place to govern, monitor, and limit employee use of third-party AI tools. Provide evidence."
Answer: Northbeams (Sentinel tier). Discovery across browser, desktop, CLI, and MCP. Per-tool policy, including per-MCP-tool allow / warn / block. Signed audit logs. EU AI Act Article 4 evidence pack. Attached as audit-log-2026-Q1.csv.
02 / The compliance checklist
Who used what, when, and for what kind of prompt - across browser, desktop apps (Claude Desktop, ChatGPT Desktop, Cursor), CLI tools (Claude Code, Aider), and MCP servers (filesystem, GitHub, Postgres, Stripe, Slack, and the rest). Discovery refreshed continuously and dated, not a quarterly snapshot.
Every MCP tool call your team's coding agents make: server name, tool name, action (allow / warn / block), timestamp, sha256 hash of the arguments. Argument values stay on the laptop. Auditors get the same signed CSV format as the rest of the evidence pack.
Credentials, PII, source code, customer data, contracts. Categorized at capture time so the auditor sees the rationale. Desktop and CLI activity tracked by tool name and frequency, never prompt content.
Sanctioned, Sandboxed, or Blocked status per tool. Every state change is timestamped and signed for audit trail.
SHA-256 signed CSV exports. Tamper-evident retention structured around SOC 2 CC7.2 and ISO 27001 A.12.4. Bring it to your auditor as evidence; they make the determination.
The classifier runs in the browser. Only category labels and a redacted snippet leave the device. Designed in alignment with GDPR Art. 25 (privacy by design) principles and CCPA data-minimisation expectations.
A board-ready summary every quarter: tool sprawl trend, incident count by severity, and policy-change history.
03 / The evidence pack
A signed CSV. SHA-256 hash. Structured around SOC 2, EU AI Act Article 4, HIPAA technical safeguards, and ISO 27001 controls. Download from the dashboard, attach to the questionnaire, ship.
Q1 2026 sample. Real audit logs scale to thousands of rows per quarter.
04 / For the board, every quarter
Sentinel ships a board-ready PDF every quarter. No screenshots-and-Slack-threads. The compliance officer reads it, the CISO presents it, the board approves it.
Pulled from the same signed audit log the auditor sees, so internal and external numbers always agree.
05 / Related laws & frameworks
When the auditor asks "how do you govern employee AI use?", they are asking against a specific framework. Here are the field-guide pages for the laws and standards that drive the questions. Cite them, link them, share them with counsel.
Every US state, EU, and standards-based AI rule covered in one place. At-a-glance comparison matrix.
Effective Feb 2026. Annual impact assessments, consumer notice, 90-day discrimination report. NIST AI RMF and ISO 42001 are recognized safe harbors.
Effective Jan 2026. Prohibits discriminatory and manipulative AI uses. Texas AI Council. Regulatory sandbox for testing.
Risk-based tiers, Article 4 AI literacy, high-risk obligations, penalties up to 7% of global revenue. Companion to the EU AI Act readiness PDF.
The world's first AI management system standard. Plan-Do-Check-Act. 38 Annex A controls. Now appearing in Fortune 500 vendor questionnaires.
Govern, Map, Measure, Manage. Voluntary, free, US-government-published. Recognized as a Colorado safe harbor.
06 / Reading list
Free PDF · 7 pages
A 7-page printable checklist. Article 4 (AI literacy), risk classification for employee AI use, documentation requirements. In your inbox in under a minute.
07 / What you'd actually buy
A sentinel stands watch and keeps records. For the auditor, the regulator, and your insurer.
$20/ user / moBilled annually · Save 20%
Free for 14 days on Sentinel. Talk to us about your audit timeline if it's tight.