What is the Council of AI?

The Council of AI (CSOAI LTD, UK 16939677) is a neutral measurement body for AI. It measures AI system behaviour against published regulatory provisions and issues verified measurement credentials — signed, provision-anchored records anyone can verify offline. It is not a certification or accreditation body.

Is CSOAI a certification body?

No. CSOAI is a measurement body. You receive a verified measurement credential — a signed record of measured behaviour. Accredited conformity certification requires a national accreditation chain, which CSOAI does not hold and does not claim.

What does the Council of AI measure?

AI system behaviour against published regulatory provisions. The live GSPC API (GET councilof.ai/api/gspc) exposes 13 measured axes, a jail floor (measured but empty on this 12 Aug stamp), and an unnamed slot-15. 19 models. Current stamp unsigned. UNMEASURED results are reported openly, never hidden or scored as failures.

Does CSOAI use LLM-as-judge?

No. Every primary governance score is produced by deterministic predicates — same model, same input, same output, byte-identical. The LLM is used only for narration, never for scoring. When the LLM is disabled, every score is identical to when it is enabled.

How current is the regulatory data behind the scores?

The public corpus-watch instrument re-hashes 127 provisions across four instruments (EU AI Act, UK GDPR, DPA 2018, NIS2-UK) every day and publishes drift events. Measurement records go stale when the underlying provision text changes.

CSOAI OS · cyber self-scan

Scan your own business. The Council assistant fixes it.

A CISO-grade stack of reputable open-source tools to test your own cyber — network, web, cloud, containers, code, supply chain. Run them, bring the findings, and the Council assistant triages, maps them to the regulations that bite, and guides the fix. Signed to Layer 0.

🛰Attack surface & recon

Amass (OWASP)

Map your external footprint — subdomains, exposed services.

amass enum -d yourdomain.com

NIS2 asset mgmt · CRA product surface

theHarvester

Find exposed emails, hosts, and leaked surface for your org.

theHarvester -d yourdomain.com -b all

NIS2 · ISO 27001 A.5

Nmap

Discover open ports and services across your estate.

nmap -sV -sC -oX scan.xml TARGET

NIS2 risk mgmt · CIS 4/12

🩻Vulnerability scanning

OpenVAS / Greenbone

Full network vulnerability assessment with CVE scoring.

greenbone / gvm-cli — scan TARGET

NIS2 vuln handling · DORA ICT risk

Nuclei (ProjectDiscovery)

Fast template-based checks for known CVEs + misconfigs.

nuclei -u https://yourapp.com

CRA vuln handling · ISO 27001 A.8

🕸Web application

OWASP ZAP

Dynamic app scan — injection, XSS, auth, session flaws.

zap.sh -quickurl https://yourapp.com -quickout zap.html

OWASP Top 10 · SOC 2 CC · ISO 27001

Nikto

Quick web-server misconfiguration + known-issue scan.

nikto -h https://yourapp.com

NIS2 · CIS 4

☁️Cloud posture

Prowler

AWS/Azure/GCP security posture vs CIS + best practice.

prowler aws

CIS Benchmarks · SOC 2 · ISO 27017

ScoutSuite

Multi-cloud config audit with an HTML report.

scout aws

DORA ICT · NIS2 · CSA CCM

📦Containers & images

Trivy (Aqua)

Scan images, filesystems, and IaC for CVEs + secrets.

trivy image yourimage:tag

CRA SBOM · supply-chain · ISO 27001 A.8

kube-bench

Check Kubernetes against the CIS Kubernetes Benchmark.

kube-bench run

CIS K8s · NIS2 hardening

🏗Infrastructure-as-code

Checkov (Prisma)

Scan Terraform/CloudFormation/K8s for misconfig before deploy.

checkov -d .

CIS · SOC 2 · secure-by-design (CRA)

tfsec / Trivy config

Static analysis of Terraform for security issues.

trivy config .

CRA secure-by-default · NIS2

🔑Secrets & code

Gitleaks

Detect hardcoded secrets/keys across your repos + history.

gitleaks detect --source .

ISO 27001 A.8 · SOC 2 · NIS2

Semgrep

Fast SAST — find insecure code patterns in your source.

semgrep --config auto .

OWASP · secure-by-design (CRA)

🧬Dependencies & SBOM

OSV-Scanner (Google)

Find known-vulnerable dependencies from the OSV database.

osv-scanner -r .

CRA vuln handling · EO SBOM · NIS2

Syft

Generate an SBOM (CycloneDX/SPDX) of everything you ship.

syft yourimage:tag -o cyclonedx-json

CRA SBOM · US EO 14028 · ISO 27001

🖥Host & benchmark

Lynis

Audit Linux/Unix host hardening + compliance posture.

lynis audit system

CIS Benchmarks · NIS2 hardening

OpenSCAP

Automated compliance scanning against SCAP baselines.

oscap xccdf eval --profile cis ...

CIS · NIST 800-53 · ISO 27001

Bring your findings — the Council assistant triages them live

You are interacting with an AI system.

The triage box sends pasted scanner output to the live Council chat endpoint (councilof.ai/api/gspc), where a model ranks the findings and maps them to frameworks. The Article 50(1) notice is mounted above the input.

Disclosed under EU AI Act Article 50(1). Every surface and its classification

Paste raw output from any tool above. The Council assistant ranks by real risk, gives concrete fixes, and maps each to the frameworks it affects. Your findings stay in your browser.

Why this beats an expensive certificate

✓You run the tools — your data never leaves your control. Open source, no lock-in.
✓The Council assistant maps every finding to the frameworks that bite (NIS2, DORA, CRA, ISO 27001, SOC 2) — not just a scary list.
✓Remediation guidance you can act on, prioritised by real risk — then re-scan to prove it's fixed.
✓Every fix signed to Layer 0 — provable evidence for auditors and regulators.
✓Value back to you and your team — not a five-figure certificate from a governance middleman.

See the Regulator Atlas →Sign a proof →Why CSOAI vs the rest →

The Council assistant guides your own authorised testing of systems you own or have permission to test. Always scan only what you're authorised to. CSOAI provides tooling guidance and analysis — not a penetration-testing service.