Outsourcing IT doesn't outsource the obligation. See what the law expects →
For advisors, MSPs, insurers and resellers.
If you advise organizations on AI risk, insure them, or run their technology, your clients are being asked to show evidence of AI governance rather than describe it. SanctumShield produces that evidence as dated, verifiable documents in a single session. The Academy prepares each role to govern the AI it uses. Both sit above the security stack. This page is for partners who want to recommend them, resell them, or build them into their own service.
Why these records are required
None of the laws below name a product. Each names a record an organization must be able to produce, and together they describe the same five records.
| Record | What the obligation asks for | Where it says so |
|---|---|---|
| Executive Risk Report (findings tied to obligations, each with an owner) | A documented, current assessment of AI risk, with named accountability, that reaches the people responsible for oversight | EU AI Act Art. 9 and Art. 26; NIST AI RMF MAP, MEASURE and MANAGE; ISO/IEC 42001 risk assessment clause; HIPAA 45 CFR 164.308(a)(1); SR 26-2 model risk assessed individually and in aggregate; Caremark and Marchand |
| Acceptable Use Policy (written from the organization's actual AI use) | A written policy governing how AI is used, communicated to staff, and reviewed | EU AI Act Art. 4 and Art. 26; NIST AI RMF GOVERN 1.1; ISO/IEC 42001 AI policy clause; HIPAA 45 CFR 164.316; SOC 2 CC5.3; Colorado SB 26-189 (effective January 1, 2027) |
| Board Memo | Evidence that the board or a named committee received AI risk reporting and acted on it | Caremark (1996) and Marchand (2019): the absence of a board-level reporting system for a mission-critical risk is itself the breach; NIST AI RMF GOVERN 2; ISO/IEC 42001 leadership and management review clauses |
| Verification URL (on the report and the policy) | Records that can be retained and produced for a third party, with proof of when they were made and from what | EU AI Act Art. 12 and Art. 26(6); Colorado SB 26-189 three-year retention; HIPAA 45 CFR 164.316(b)(2) six-year retention; SOC 2 evidence requirements; every Caremark case turns on what the record shows |
| Role-based training with a verifiable Record of Completion | Measures that support AI literacy appropriate to each person's role, with evidence the measures were taken | EU AI Act Art. 4; Colorado SB 26-189 meaningful human review; NIST AI RMF GOVERN 2.2; ISO/IEC 42001 competence and awareness clauses; HIPAA 45 CFR 164.308(a)(5); SOC 2 control criteria |
Why only here. To our knowledge, no other product produces all five records as one dated, verifiable set from a single session, written from the organization’s actual AI use rather than a template, and priced for the mid-market. Security tools show what happened but they do not provide what the regulations require. These records show what was permitted, who agreed, and who was prepared. That is the layer the laws are describing, and it is the layer SanctumShield and the Academy were built to produce.
What each product does
SanctumShield. An organization answers a guided intake in roughly 15 to 30 minutes, including discovery of AI tools in use that nobody has written down. It receives an Executive Risk Report with findings tied to specific obligations, each with an owner; an Acceptable Use Policy written from its actual AI use; and a Board Memo. The report and the policy carry a Verification URL that an auditor, insurer or customer can check to confirm the assessment took place and when, without exposing the contents. Twelve frameworks inform the methodology. Seven render clause by clause in generated policy text today and five more are on the active roadmap. It runs on a cadence, so the record accrues and stays current. It is not a GRC platform and does not replace one where a client already has it.
SanctumShield Academy. AI governance training by role: Board and CEO, CISO, CTO and IT, Legal, and Employee Essentials. A Socratic AI Tutor grounded in the course material works through each module by asking questions. Each completion produces a Record of Completion with a public verification URL valid for three years. Team seats can be reassigned, so a small number of seats can move a whole department through in cohorts.
The AI Governance Coach. A real-time voice and text coach, available with either product or on its own, grounded in a reviewed corpus of about 290 pages of practitioner-grade material. It explains roles, obligations and next steps. It does not issue compliance verdicts.
Who it is for
- Mid-market organizations, roughly 50 to 2,000 people, using AI without a CISO or a formal AI policy.
- Cyber insurers and brokers who want a consistent, verifiable record from the organizations they cover.
- Legal teams and outside counsel who need a clear, dated account of what governance was in place.
- Any organization that has received a regulator or attorney general inquiry.
- Organizations that already know their AI footprint and want governance without slowing innovation.
Not the right fit. Large banks and insurers that need a full model risk management program; SanctumShield complements that work rather than replacing it. Organizations looking for runtime enforcement, monitoring or agent guardrails; those are a different layer and SanctumShield works alongside them. Anyone wanting a certification; the Academy issues a Record of Completion and SanctumShield issues verifiable documents, and neither is a certification.
How partnering works
- Partner code. Clients you refer enter your code at sign-up. Attribution is automatic and visible to you and to us.
- Referral share. A share of first-year subscription revenue on referred accounts, for SanctumShield and Academy seats alike. Terms are agreed with each partner.
- Pricing. Clients pay the published price. No discount is tied to the code, which keeps pricing simple for everyone. Current pricing is on each product’s pricing page.
- Your account. A demo account on both products so you can show them to a client directly.
- Introductions both ways. Where we see an organization that needs the kind of advisory or service you provide, we introduce you.
How to introduce it to a client
Something like this works in conversation: “Your board and your insurer are going to ask you to show what AI you use, who owns it and what it is allowed to do. There is a tool that produces that record in about half an hour, as documents an auditor can verify. It will not replace your security tools, and it is not a certification. It gives you the written record that sits above all of that.”
What to send first: the free Board AI Register template and the free AI literacy self-check, because they cost the client nothing and show the approach. For the methodology and its sources: /under-the-hood. For the Academy curriculum by role: academy.sanctumshield.com/curriculum.
What happens next: send us the client’s name and best contact, or make the introduction directly. We offer a 30-minute walkthrough on their own AI use, and they can run the intake during the call. You stay in the loop on every referred account.
For litigation, regulatory action, insurance disputes, and board-level standard-of-care assessments.
When AI governance failures result in litigation, regulatory action, or insurance disputes, courts and tribunals increasingly require expert evidence on the prevailing standard of care. SanctumShield’s founder, Lindsay Hiebert, CISSP (verifiable on Credly), accepts a limited number of engagements for:
- Plaintiff and defense counsel in AI governance negligence litigation
- Class action and shareholder derivative matters involving AI governance, board oversight, or Shadow AI exposure
- Cyber insurance subrogation and coverage disputes, including denied claims where Due Care evidence is contested
- Regulatory investigations: HIPAA OCR, state Attorney General offices, EU AI Act competent authorities, NAIC examinations
- Board-level Due Care / Due Diligence assessments in pre-litigation contexts: privileged standard-of-care opinions and forensic assessments before a matter reaches filing
Engagements are case-by-case with conflict-of-interest screening at intake. Both plaintiff- and defense-side engagements considered; the integrity of an expert witness depends on availability across both sides of the docket.
Initial inquiry leads to a 30-minute no-cost scoping conversation. Engagement terms discussed during scoping. Standard professional indemnity / E&O coverage maintained.
The 2026 forcing functions (EU AI Act enforcement, Colorado SB 26-189, the SOC 2 Type II observation cycle, cyber insurance renewal questionnaires asking AI governance questions for the first time) guarantee that organizations without an AI Acceptable Use Policy and a documented Shadow AI risk assessment will face Due Care challenges. The litigation, regulatory, and insurance workstreams that follow need expert evidence on the prevailing standard. SanctumShield’s founder is one of the few CISSP-credentialed practitioners with both the platform-engineering background (15 years Cisco, 7 years Intel) and the regulation-anchored AI governance specialization to provide that evidence credibly.