Which AI frameworks does Lavawall support?

Six AI-specific frameworks: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications, and Canadian AI governance. They share one control set with the rest of the frameworks Lavawall supports, so a control you satisfy once counts across every framework it maps to.

What other frameworks does Lavawall support besides the AI ones?

Over 160 in all, across security and governance, privacy, payment card, energy and critical infrastructure, government, healthcare, and financial services. They include SOC 2, ISO 27001, NIST CSF, CIS Controls, CMMC 2.0, PCI DSS, HIPAA, PIPEDA, and Quebec's Law 25. The full list is on this page and in the framework directory.

How does Lavawall know which framework I need?

Lavawall detects the AI tools already in use across your connected security and IT tools, then recommends the framework that fits your situation automatically. You are not left guessing which standard applies.

What is shadow AI and why does it matter?

Shadow AI is any AI tool your staff adopt on their own, without review, often pasting company or client data into them. It creates data-leakage and compliance risk you cannot see. Lavawall surfaces the AI already in your environment so you can govern it instead of hoping it isn't there.

Do I need an AI expert to use this?

No. Lavawall recommends the right framework, generates the matching policies and disclosures, and explains each step in plain language, so a small team can stand up credible AI governance without hiring a specialist.

Does adopting one framework help with the others?

Yes. Because the frameworks share one control set, progress on one framework advances the others at the same time, which is how you cover NIST, ISO, EU, OWASP, and Canadian AI expectations, and your security and privacy frameworks, without separate projects.

What AI evidence does Lavawall gather automatically?

AI apps and AI agents connected to Microsoft 365 and Google Workspace and whether they can read mail and files, AI apps found through SaaS discovery and whether they are approved, Microsoft 365 Copilot and Gemini activity including the jailbreak and hidden-instruction attempts Copilot itself detects, AI tools and local model servers on computers, AI browser extensions that can read every website, AI services listening on computers or the internal network, and AI services the domain scan finds exposed to the Internet. Each check keeps a dated history.

AI governance & compliance

Your staff already use AI. Now govern it.

Lavawall® detects the AI already in your environment from the security and IT data you have, recommends the right AI governance framework automatically, and generates the matching policies and disclosures. Six AI frameworks share one control set with every other framework Lavawall supports, and every step is written in plain language anyone can use. Somewhere in your business, someone is pasting client data into an AI tool nobody approved.

Start with the GRC Wizard See GRC & compliance

NIST AI RMF · ISO/IEC 42001 · ISO/IEC 27090 · EU AI Act readiness · OWASP Top 10 for LLMs · Canadian AI governance · Over 160 frameworks in all

Six AI frameworks, one control set

Find the shadow AI first

Built from the security and IT data you already have, Lavawall detects the AI tools in use across your environment, including the ones nobody logged. You can't govern what you can't see, so this is where governance actually starts.

The right framework, recommended for you

Based on what it finds and how you operate, Lavawall recommends the framework that fits: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27090 for AI security threats, EU AI Act readiness, the OWASP Top 10 for LLM Applications, or Canadian AI governance. No guessing which standard applies to you.

Satisfy one control, cover many

The AI frameworks share a single control set with your security and privacy frameworks. A control you turn on typically counts across NIST, ISO, EU, OWASP, and Canadian expectations at once, and toward SOC 2, ISO 27001, or PIPEDA where they ask for the same thing, so you cover them all without separate projects.

Policies and disclosures, generated

Lavawall generates the AI policies your team needs and the disclosures your clients and regulators expect, matched to the framework you're adopting and kept current, not copied from a stale template.

Plain language anyone can use

Every step is explained in language a non-specialist can follow, so a small team can stand up credible AI governance without hiring an expert or decoding a standard line by line.

A live view of where you stand

See which AI controls are in place, which are open, and how to close them, per framework, so AI governance becomes an ongoing score instead of a one-time scramble.

The six AI frameworks you can adopt

NIST AI RMF

The US AI Risk Management Framework for identifying, measuring, and managing AI risk across its lifecycle.

ISO/IEC 42001

The international standard for an AI management system, the ISO 27001 equivalent for AI.

ISO/IEC 27090

International guidance on the security threats specific to AI, from prompt injection to data poisoning, for organizations that use AI as well as those that build it.

EU AI Act readiness

Prepare for the risk-tiered obligations of the EU AI Act before they apply to your use of AI.

OWASP Top 10 for LLM Applications

The security baseline for anyone building or deploying large-language-model features.

Canadian AI governance

Align with Canada's direction on responsible and accountable AI use.

AI evidence, gathered automatically

Much of the evidence for AI security already sits in the systems Lavawall® connects to, so it is tested against live data instead of answered from memory.

Connected AI apps and agents: AI apps and AI agents connected to Microsoft 365 and Google Workspace, and whether they can read mail and files.
Shadow AI: AI apps found through SaaS discovery, and whether each one is approved.
Copilot and Gemini activity: whether Microsoft 365 Copilot and Gemini activity is being recorded, and whether anyone reviewed the jailbreak and hidden-instruction (cross-prompt injection) attempts Copilot itself detects.
AI on computers: AI tools and local model servers installed on computers.
AI browser extensions: extensions that can read every website a person visits.
AI services on your network: AI services listening on computers or open on the internal network.
AI services on the Internet: model servers, AI chat interfaces, and notebooks the domain scan finds exposed to the Internet.

Each check keeps a dated history and counts toward every AI framework that asks for the same control. See how it maps to ISO/IEC 27090.

Every framework, one engine

Every framework Lavawall supports

Over 160 frameworks in all. Your AI governance runs in the same control set as the security, privacy, and industry frameworks your clients, insurers, and regulators already ask about. Turn on a control once and it counts toward every framework below that asks for the same thing.

Frameworks, standards, and regulations Lavawall® maps and evidences:

Security & governance

Privacy

Payment card

Energy & critical infrastructure

Government & public sector

Healthcare

AI governance

Financial services

Open the full categorized framework directory →

Common questions

Which AI frameworks does Lavawall support?: Six AI-specific frameworks: the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27090, EU AI Act readiness, the OWASP Top 10 for LLM Applications, and Canadian AI governance. They share one control set with the rest of the frameworks Lavawall supports, so a control you satisfy once counts across every framework it maps to.
What other frameworks does Lavawall support besides the AI ones?: Over 160 in all, across security and governance, privacy, payment card, energy and critical infrastructure, government, healthcare, and financial services. They include SOC 2, ISO 27001, NIST CSF, CIS Controls, CMMC 2.0, PCI DSS, HIPAA, PIPEDA, and Quebec’s Law 25. See the full list.
How does Lavawall know which framework I need?: Lavawall detects the AI tools already in use across your connected security and IT tools, then recommends the framework that fits your situation automatically. You are not left guessing which standard applies.
What is shadow AI and why does it matter?: Shadow AI is any AI tool your staff adopt on their own, without review, often pasting company or client data into them. It creates data-leakage and compliance risk you cannot see. Lavawall surfaces the AI already in your environment so you can govern it.
Do I need an AI expert to use this?: No. Lavawall recommends the right framework, generates the matching policies and disclosures, and explains each step in plain language, so a small team can stand up credible AI governance without hiring a specialist.
Does adopting one framework help with the others?: Yes. Because the frameworks share one control set, progress on one framework advances the others at the same time, including your security and privacy frameworks.
What AI evidence does Lavawall gather automatically?: AI apps and AI agents connected to Microsoft 365 and Google Workspace and whether they can read mail and files, AI apps found through SaaS discovery and whether they are approved, Microsoft 365 Copilot and Gemini activity including the jailbreak and hidden-instruction attempts Copilot itself detects, AI tools and local model servers on computers, AI browser extensions that can read every website, AI services listening on computers or the internal network, and AI services the domain scan finds exposed to the Internet. Each check keeps a dated history. See ISO/IEC 27090 for how this evidence maps.

Start with the GRC Wizard →See GRC & compliance