Skip to content
Koralis AIBook a free Scoping Review

Kovac · in beta · for risk and audit

AI for your whole workforce, one team at a time.

What can your AI reach, and what stopped it?

The board or an auditor asks before AI goes near client data, and you have to approve it on evidence, not a vendor's word.

Book a free Scoping Review← Other teams

With both founders, no data. Pilots from £5,000 + VAT + your AI model's usage. Half at the start, and half when we send your payback report.

The week before the audit committee, the head of risk is asked a plain question: what can our AI reach? The honest answer is a policy nobody has tested against a real request, and no record of anything being stopped.

An illustration, not a customer's story.

One request, from your files to the result

Risk and audit: one request, start to finishYour material: Your AI policy (a document, by end Oct 2026) and Commercial's contracts register (a spreadsheet). Fields you mark: Client names, Contract values. Kovac checks requests to your data against your policy. From late October 2026, the AI model you choose drafts renewal notes from the contracts register, working through that check. On every AI call the fields you mark reach it masked: Client names arrives as [CLIENT_1]. Unmarked fields, and the text inside Word and PDF documents, arrive as they are. The result: Renewal notes for commercial to edit. Separately, today: A lead not cleared for contracts asks for contract values, a marked field. Kovac refuses the request and records the refusal. People search that record today; from late October 2026, the AI model can also draft from it. Solid lines work today; dashed lines are dated.Your materialYour AI policyby end Oct 2026Commercial's contracts registerFields you markClient namesContract valuesKovac checks against your policyMarked fields masked on every AI callfrom late Oct 2026The AI model you chooseDraftrenewal notes from the contractsregister[CLIENT_1]in place of client namesUnmarked fields and Word or PDF text asthey areThe resultRenewal notes for commercial toeditClearance decides what a person may read.A lead not cleared for contractsasks for contract valuesRefusedKovac checks against your policy, todayRefused, and recordedA lead not cleared for contracts askedfor contract valuesPeople search it today.From late Oct 2026, the AI model candraft from it.
  • Works today
  • The AI model's part, from late Oct 2026; Raw files and previews, by end Oct 2026
The detail: the example, what it works on, and what stays governed

The quarterly AI paper for the risk committee

The head of risk asks the AI model to check a proposed AI use against the written policy and to draft the committee's decision note. The model receives the policy and the proposal as written, and the risk register with its client-name column masked. The evidence section is the head of risk's own search of Kovac's refusal record: a project manager not cleared for contract values, for instance, refused that column. The note says what that record is today: refusals only, not signed.

Fields you mark sensitive reach the AI model masked with placeholders; fields you don't mark reach it as they are. The same value always gets the same placeholder, so masked data can still be linked to a person and remains personal data.

On records loaded into Kovac, someone not cleared for a column you have marked who asks for it is refused, and the refusal is recorded.

Clearance decides what a person may read. It never unmasks a field for the AI model: a marked field reaches the model masked on every call, whoever asks.

What it works on

Document
Your AI policy and acceptable-use policy
Document
Risk and audit committee papers
Document
Audit requests and supplier questionnaires about AI
Spreadsheet
Data inventories and the risk register

Columns this team would mark

  • Client names
  • Contract values and fees
  • Open findings and ratings in the risk register

What the AI does, and what your team does

From late October 2026, the AI model you choose, working through Kovac's check. Each card says who does it. Your team can search Kovac's record of refusals today; once pilots run, the model can draft from it too. Kovac does not draft or search; its check decides what the model may see.

Draft

The AI model does this

A summary for the risk committee of this quarter's refused requests, drafted from Kovac's record of refusals

More it could draft
  • The AI section of the risk committee's papers, from your AI policy and the uses approved so far
  • A summary of refused requests for the committee, from Kovac's record of refusals
  • A decision note on a proposed AI use: what it would read, which fields are marked, and what the record can and cannot show

Find

Your team does this

Who was refused which marked column, and when, searched in Kovac's record by your own team

More the AI model could find
  • Past committee decisions on AI uses like the one now proposed
  • The fields in your data inventory that your policy says to mark, as a first list for your team to check

Check

The AI model does this

A team's proposed AI use against your policy, clause by clause, listing the gaps it finds

More it could check
  • A proposed AI use against your written AI policy, clause by clause, before it goes to the committee for approval
  • A supplier's answers to your questionnaire about AI, listing any question left open

Questions your team will ask

Is Kovac's record evidence an auditor will accept?

It is one part of your evidence, not the verdict. Read who can write to it today before you rely on it. Your policy, approvals and committee papers carry the rest. See the limit: who can write to the record

What does the record hold today?

Refusals: who asked for which marked column, on records loaded into Kovac. Your team searches it; once pilots run, the AI model can draft from it too. See the limit: what the record holds today

What can we show our own auditors about Koralis AI?

What is in place and what is not, in one list on this page. Bring your supplier questionnaire to the Scoping Review, and we go through it, gaps included. See the limit: what Koralis AI holds today

Signing it off?

One page on what Koralis AI holds, what it does not, and a date for each gap where there is one. Read it, or send it to whoever reviews suppliers.

Email the brief to a colleagueRead the one-page IT & legal brief →

What to bring to the Scoping Review

No data: descriptions are enough.

  • Your written AI policy, or the draft you have
  • One proposed AI use a team has asked you to approve
  • The last question your audit committee or board asked about AI

What it does not do yet, and what a pilot is

  • The record is searchable, but any signed-in user can add an entry in anyone's name, and entries are not signed or linked together when written. By the end of October 2026, only Kovac itself can write to the record; by then, every entry is signed and linked to the one before it as it is written, permitted requests as well as refusals.
  • Masking works on the fields you mark: the columns of a spreadsheet or record set. It does not reach into the text of a Word or PDF document.
  • Three failure cases still let a request through when they should stop it: a deploy whose policy call fails, a read of a record whose clearance lookup errors, and a plan that cannot be signed, which runs unsigned rather than halting. Every route blocks a request when the policy check cannot run, by the end of October 2026.
The other eight limits

What the check does today

  • Today the check covers three of seven routes to data; opening raw files and previews is checked by the end of October 2026.
  • Kovac's record holds the decisions on the routes it checks: refusals today; permitted requests too by the end of October 2026.

What a pilot is

  • The first step is one team: a four-week pilot on your own machines, with one dataset, supplied as files, one workflow, and the AI model you choose working through Kovac's check from late October 2026.
  • Reading straight from your database tables comes in December 2026.
  • Kovac does not sit in front of Microsoft Copilot, Gemini for Google Workspace or web chat assistants.

What we do not hold yet

  • Kovac is in beta. Koralis AI holds no certification today.
  • Professional indemnity insurance is not held today.
  • A pilot on personal data waits for a data processing agreement, which has no date yet.

Bring the question your board would ask.

Bring your AI policy and one proposed use, not a dataset. We set out what Kovac's record could show your committee, and what it cannot yet. Both founders, no data, a written pack within 48 hours.

The terms

  • The Scoping Review is free. It signs you to nothing.
  • Four-week paid pilots, with Kovac on your own machines, from late October 2026.
  • Quick-Start, for mid-sized businesses: £5,000 + VAT, fixed.
  • Proof Pilot, for regulated and larger organisations: £7,500 + VAT, fixed.
  • The pilot's job is to give you a payback figure, measured on your own work.
  • Half at the start, and half when we send your payback report. By invoice.
  • You pay for your AI model's usage, either to its provider directly or passed through by us.
  • Stop at the day-five go/no-go and you pay only the first half.
  • If you subscribe within 90 days of the pilot ending, the pilot fee you've paid is credited against your first year's subscription.
  • Your contract is with Koralis AI Limited (company number 16558134).
  • Kovac is not yet in production anywhere.
Book a free Scoping Review

Rather write first? enquiries@koralis.ai reaches both founders. Or message Dylan or Marko on LinkedIn.