Vailor: the sovereign AI-native GRC alternative to GRChive

A risk register is not a list of threats. It is the set of links between an asset, a risk scenario, its likelihood and impact levels, the treatment decision taken, the person accountable for it and the residual risk accepted, together with the date of the last review and the reasoning behind each trade-off. ISO/IEC 27005 provides the guidelines for that work, and ISO/IEC 27001 requires documented information on the results of risk assessments to be retained. Without those links, a register records a state without explaining how it was reached.

Because what it describes changes faster than it does. An asset is decommissioned, a supplier is replaced, a mitigation slips by a quarter, a risk owner moves on. Each of those events should trigger a review and none of them does on its own. Twelve months later the register describes last year's scope. The familiar symptom is the rebuild in the weeks before an audit, which produces a document that is accurate on the day of the audit and wrong for the rest of the year.

Evidence holds up when it is dated, attributable to a named author, attached to the requirement or the control it supports, and retrievable without relying on anyone's memory. The real constraint is duration: an ISO/IEC 27001 certification cycle runs over three years, punctuated by surveillance audits, and an auditor may ask how a decision was reached two years earlier. A screenshot with no timestamp and no context cannot answer that question.

Vailor treats the register as a live object rather than an annual deliverable. Each risk is linked to the measures in the action plan, with their priority, and reminders help keep the pace. On the analysis side, the AI reads the project documents and prefills the fields, citing its sources, and every proposal stays subject to validation. EBIOS RM is covered end to end, so the register does not have to be rebuilt for each new exercise.

Every decision is timestamped and attributed in an audit log with no delete function. The audit trail is therefore built as the work happens, not assembled the night before an audit. When the AI contributes, it quotes the passages from your documents it relies on, checked word for word, and nothing is validated without a human: an auditor sees what was kept, by whom and when, and a read-only auditor role gives them access with no risk of changes. Your registers and the supporting evidence are hosted in France by default.

The work happens before the switch. Freeze the scope, align the likelihood and impact scales so that levels keep the same meaning, then replay a few known scenarios to check that the results still make sense. Past decisions have to travel with the register and stay attached to the risks they belong to, otherwise the history disappears at the exact moment an auditor asks for it. The move runs in stages, with dedicated support, and without interrupting the audit cycle under way.