Skip to content
AIRAS Cloud

The principle we build on

AI does notapproveAI

A model can draft, screen and explain. It cannot hold the obligation. AIRAS Cloud routes every consequential judgement to a named, competent person and keeps the evidence of who decided, on what basis and when.

Established 2021 · Built and operated in Ireland

Govern AI.Prove every decision.

One governed system for knowing what AI you use, assessing what applies, making accountable decisions and retaining the evidence behind them.

See AIRAS in actionBook 20 minutes with Richie or Amy
NewShadow AI Defence2026 Best Company Awards Finalist

Trust and assurance →

airascloud.app / governance / portfolio

AI governance portfolio

Northfield Group · All departments · Ruleset v2.4

Filters

Total AI use cases

64

Registered across 9 departments

Awaiting review

8

3 approaching due date

High risk

6

All with active conditions

Evidence completeness

91%

Across approved records

Risk distribution

  • Low21
  • Medium29
  • High14

Reviews due this month

12

Periodic review, condition expiry and vendor change checks.

Governance queue

  • Customer Service CopilotMedium
    Privacy reviewAwaiting evidence
  • Predictive Maintenance ModelHigh
    Quality and SecurityIn review
  • Supplier Document AssistantLow
    Governance leadApproved with conditions
  • Clinical Operations SummariserHigh
    Quality, Privacy, LegalRestricted

Lifecycle

  1. Registered
  2. Assessed
  3. Reviewed
  4. Decision
  5. Monitoring

Illustrative interface – synthetic data

Ireland
Built and operated in Ireland
Deterministic
Versioned rules, repeatable outcomes
Human-decided
Accountable people approve AI
Evidence-led
Hashed, append-only decision record
2,014
Automated verification cases executed
2026 Best Company Awards Finalist

Experience developed across complex enterprise environments

AIRAS Cloud is founded on experience delivering complex technology, governance and transformation programmes across regulated and enterprise environments.

  • Aer Lingus logoAer LingusAviation
  • Avolon logoAvolonAviation leasing
  • AIB logoAIBBanking
  • Bank of Ireland logoBank of IrelandBanking
  • IBM logoIBMTechnology services
  • Kyndryl logoKyndrylTechnology services
  • EirGrid logoEirGridCritical infrastructure
  • Virgin Media logoVirgin MediaTelecoms
  • Irish Government logoIrish GovernmentPublic sector

The problem

Know. Decide. Prove.

Governance rarely fails at the policy layer. It fails in the operating layer, where assessing, reviewing, evidencing and monitoring actually happen. AIRAS Cloud is that layer.

01

Know

What AI are we actually using?

Systems, models, agents and embedded vendor features arrive faster than any policy cycle. Without one authoritative register, nobody can answer the first question truthfully.

02

Decide

Who said yes, and on what basis?

Decisions get made in meetings, inboxes and slide decks. AIRAS Cloud puts the decision where the assessment is, with named accountability and segregation of duties.

03

Prove

Can we show our working next year?

Regulators, auditors and boards do not ask what you intended. They ask what you assessed, what you controlled and what you retained.

New in AIRAS Cloud 2.0 · Shadow AI Defence

You approved the supplier.Who assessed the AI?

AI now arrives through software you already trust. A feature update, an admin toggle, a new processing arrangement, and none of it triggers a new procurement or a governance event. A firewall rule can block a website. It cannot tell you what an approved cloud service does with your information.

  1. 01Discover from evidence

    Vendor material, contracts and specifications are read for AI capability, and every finding shows the passage it came from.

  2. 02A person confirms the facts

    Is it included, enabled and used? A marketing mention, an unused option and a deployed feature lead to different conclusions.

  3. 03ARIE assesses, people decide

    Versioned, deterministic rules classify the use. A prohibited use is a gate that no favourable score can override.

Shadow AI Defence · Discovery queueLive scan

  • Candidate matching

    Owner questioned

    Approved recruitment platform

    “…AI-assisted Talent Matching ranks applicants against the role profile…”

    Vendor release notes · p.4Confidence 92%

  • Meeting summaries

    Awaiting supplier evidence

    Approved collaboration suite

    “…generative summaries are enabled by default for all workspaces…”

    Service description · §7.2Confidence 81%

  • Invoice anomaly scoring

    Under review

    Finance automation tool

    “…machine learning model flags invoices for manual review…”

    Technical specification · p.11Confidence 67%

Illustrative synthetic findings. High confidence is not high risk.

Seven governed steps, six built-in safeguards and in-house QA results. See the full workflow behind Shadow AI Defence.

See the full workflow
Cover of 'Solve the AI problem you didn't know you had. Before it costs you.' by Richard Higgins, AIRAS Cloud

A CEO perspective · 24 October 2026

Solve the AI problem you didn’t know you had. Before it costs you.

Take one recently enabled feature in a platform you trust. Can you identify its AI assessment, accountable owner and approval record? If that answer depends on somebody’s memory, AIRAS can help bring the evidence and decisions together.
Operating profit
−25%
Gross margin
−1.5 pts
Sales to recover
€1m

Illustrative €20m services business absorbing €500k of corrective work. Not a customer result or claimed saving; fines are excluded.

Read the articleHow Shadow AI Defence works
Richard Higgins

Richard Higgins

Founder and Chief Executive

How AIRAS works

One governed path. Eight stages. Nothing left to memory.

Select a stage to see what the business does, what AIRAS Cloud does and what evidence remains on the record afterwards.

Discover and Register

Create a reliable inventory of AI use cases, systems, models, agents, vendor features and owners.

The business does
The business owner records the use case, its purpose and the accountable owner.
AIRAS Cloud does
AIRAS Cloud allocates a use-case reference, links related systems and vendors, and opens a draft record.
Evidence retained
Registration record, ownership, submission version and timestamp.

Typically involves: Business Owner, AI Governance Lead

Walk through every stageSee the platform modules

Platform and engine

Not a model that opines.A deterministic engine that can be re-run.

AIRAS Cloud governs the lifecycle. ARIE supplies the regulatory reasoning. People remain accountable for the decision. Three distinct responsibilities, deliberately kept apart.

  1. Layer 01

    AIRAS Cloud

    The governed control plane

    • Inventory
    • Context
    • Controls
    • Review
    • Human decision
    • Monitoring
    • Evidence

    Orchestrates the lifecycle: who owns what, what has been assessed, which controls apply, who reviewed it, what was decided and what evidence is retained.

  2. Layer 02

    ARIE

    The deterministic regulatory engine

    • Qualify
    • Role
    • Prohibit
    • Classify
    • Obligations
    • Explainable output

    Applies approved, versioned regulatory logic to the recorded facts and returns a classification, the applicable obligations and a readable explanation trace that can be re-run.

  3. Layer 03

    Accountability

    Authorised people, not models

    • Named reviewers
    • Segregation of duties
    • Versioned decisions

    ARIE never approves anything. Material decisions stay with authorised people, recorded against the assessment version they actually saw.

How ARIE reasonsRisk assessment method

Proof, not promises

Assessment you can defend. Decisions you can prove.

Two of the mechanisms at the heart of AIRAS Cloud: a deterministic risk engine with a readable explanation trace, and an append-only decision and audit record.

airascloud.app / use-case / UC-0147 / risk assessment

Risk dimensions

Ruleset v2.4 · approved
  • Impact on people4 / 5
  • Data sensitivity4 / 5
  • Autonomy of action3 / 5
  • Regulatory exposure5 / 5
  • Operational criticality3 / 5
  • Vendor dependency2 / 5

Calculated outcome

HighRaised by mandatory floor

Base calculation returned Medium. A regulatory floor for GxP-impacting use raised the band to High.

Explanation trace

  1. Special category data declared in intake → sensitivity floor applied
  2. GxP-impacting process confirmed → Quality review mandatory
  3. Operational write-back enabled → Security review mandatory
  4. No prohibited-use pattern matched

Routed to Quality, Cybersecurity and Privacy. Segregation of duties enforced: the submitting owner cannot approve this record.

Rules are versioned and human-approved. AI does not approve AI.

Illustrative interface – synthetic data

Every dimension scored under approved, versioned rules — with floors, prohibited-use checks and the reason the outcome was reached.

airascloud.app / use-case / UC-0147 / decision record

Reviewer decisions

  • Quality12 Mar

    H. Okonkwo · Approved with conditions

  • Cybersecurity12 Mar

    L. Fereday · Approved

  • Privacy / DPO13 Mar

    A. Marchetti · Approved with conditions

  • Executive sponsor14 Mar

    S. Nairn · Final approval

Conditions: quarterly output sampling, documented human review of all customer- facing outputs, and reassessment on model or vendor change.

Audit history

  1. 14 Mar 09:41 — Decision recorded: Approved with conditions (v3)

  2. 13 Mar 16:02 — Condition added: quarterly output sampling

  3. 13 Mar 11:20 — Evidence attached: DPIA-0431 v2

  4. 12 Mar 08:55 — Risk recalculated under ruleset v2.4

Append-only. Entries cannot be edited or deleted.

Export

Assessment pack Decision pack Control evidence index

Illustrative interface – synthetic data

Reviewer decisions, conditions and rationale versioned against the record, with an exportable assessment and decision pack.

Verified the way engineering teams verify.

AIRAS Cloud maintains a controlled assurance programme supported by an extensive automated verification and regression estate, executed against the source tree and a running build, with results recorded as evidence rather than described in copy.

Open the trust centreDelivery governance records
Verification cases
2,014
Passed
2,014
Pass rate (executed)
100.0%
Suites
28

Independent recognition · 2026

Noticed for the direction. Founder-led by design.

AIRAS Cloud — 2026 Best Company Awards Finalist, Official Honoree Program

AIRAS Cloud named a 2026 Best Company Awards Finalist

AIRAS Cloud has been officially approved as a finalist in the Best Company Awards 2026 and invited to participate in its Official Honoree Program. For a young AI governance company, we see this as an encouraging external signal that the direction, execution and ambition behind AIRAS Cloud are being noticed.

2026 Best Company Awards Finalist · Official Honoree Program

Amy Feery, Co-Founder and Chief Product Officer at AIRAS Cloud, nominated for the Female Founder Rising Star Award at the Women in Tech & AI Global Awards 2026

Amy Feery nominated for the Female Founder Rising Star Award

Congratulations to our Co-Founder and Chief Product Officer on her nomination at the Women in Tech & AI Global Awards 2026, and her WomenTech Network Certificate of Appreciation. The people who designed AIRAS Cloud and its ARIE engine are the people you speak to.

View Amy’s nomination

Alpha programme

Tested in the field, in Ireland, by the people accountable.

Between 2024 and 2025 AIRAS Cloud was tested end to end by risk, compliance, quality, security and audit leaders across regulated Irish organisations. Their feedback shaped the operating model now in production.

  • HealthcareMarch 2025
    We put nine clinical decision-support tools through the guided intake. The screening picked up two that had never been recorded anywhere and correctly floored a triage model to high risk on human-oversight grounds. The DPIA linkage meant our data protection officer worked from the same record as the clinical governance committee, which had never happened before.

    Dr. Niamh Ó Braonáin

    Head of Clinical Digital Governance · Voluntary teaching hospital group, Dublin

    Tested: Clinical AI intake and DPIA linkage

  • Financial servicesApril 2025
    The point that convinced our audit committee was that the engine is deterministic and versioned. We re-ran an assessment from six weeks earlier against ruleset 1.0 and got the identical score and explanation trace. Segregation of duties is enforced rather than requested, so the approver genuinely cannot be the assessor.

    Cormac Whelan

    Director of Risk and Compliance · Irish retail bank, Dublin

    Tested: Deterministic scoring and reviewer segregation

  • Life sciencesMay 2025
    We tested it against a live Annex 11 readiness review. The evidence pack exported with hashed artefacts, control owners, due dates and the full decision history in one document. Our auditor's usual three-week evidence hunt became a single afternoon of review.

    Aoife Ní Chatháin

    Quality Systems Lead · Contract pharmaceutical manufacturer, Cork

    Tested: GxP evidence packs and Annex 11 alignment

  • InsuranceMay 2025
    Embedded vendor AI was our blind spot. Registering third-party features as first-class entries surfaced eleven capabilities switched on inside tools we already owned. Three needed contractual action. Without the register we would not have known they existed.

    Seán Mac Giolla Phádraig

    Chief Information Security Officer · Insurance group, Dublin

    Tested: Vendor and embedded AI discovery

  • Public sectorJune 2025
    The prohibited-use checks stopped a proposed profiling use case at intake, with a written rationale we could hand straight to elected members. Being able to show the decision, the version of the rules applied and who approved it is what makes this defensible in a public setting.

    Máire Donnelly

    Data Protection Officer · Local authority, Galway

    Tested: Prohibited-use screening and public accountability

  • MedTechJune 2025
    We ran two autonomous agents through oversight for six weeks. Scoped permissions, escalation thresholds and the moderation log gave our engineering leads something they had never had: a factual record of what the agent was allowed to do and what it actually did.

    Declan Fitzgerald

    Head of Data and AI · Medical technology manufacturer, Limerick

    Tested: Agent oversight and runtime moderation

  • ManufacturingJuly 2025
    As an auditor my first instinct is to try to break the trail. The history is append-only, decisions are versioned and nothing can be quietly edited after approval. I tested it deliberately and could not manufacture a gap. That is a rare thing to be able to write in a report.

    Sinéad Kavanagh

    Group Internal Audit Manager · Food and agribusiness group, Kilkenny

    Tested: Audit trail integrity

  • TelecomsJuly 2025
    Configuration governance was the surprise. Ruleset changes go through controlled versioning, so our risk function can evolve criteria without invalidating historic assessments. Integration into our existing identity and ticketing estate took days, not a quarter.

    Ruairí Ó Donnchadha

    Enterprise Architect · Telecommunications operator, Dublin

    Tested: Multi-tenant configuration and integration

  • Life sciencesAugust 2025
    We used it to build our EU AI Act inventory position. Classification, obligations and control coverage sit against each system rather than in a spreadsheet a single person maintains. It turned a mapping exercise into an operating routine.

    Orla Brennan

    Head of Regulatory Affairs · Clinical research organisation, Dublin

    Tested: EU AI Act readiness mapping

  • Financial servicesSeptember 2025
    Our reviewers are not data scientists. The adaptive intake asks only what the context needs and the explanation trace is written in plain language, so a board committee can read the rationale without a translator. Adoption was the fastest I have seen for a governance tool.

    Pádraig Lynch

    Director of Technology · Credit union services body, Cork

    Tested: Adoption by non-technical reviewers

  • Professional servicesOctober 2025
    Most tools stop at approval. Periodic reassessment triggers and the incident register meant a model that drifted after a data change was picked up, reassessed and re-approved with the change captured against the original decision. That closed loop is the whole point.

    Caoimhe Ní Mhurchú

    Head of Responsible AI · Professional services firm, Dublin

    Tested: Periodic reassessment and incident handling

  • LogisticsNovember 2025
    The executive view gave me one honest number: how many AI use cases we run, how many are governed and where the gaps sit. Assessment turnaround dropped from roughly five weeks to eight days across the alpha, and the board stopped asking for a status deck because they could see it.

    Fergal Byrne

    Chief Operating Officer · Logistics and supply chain group, Waterford

    Tested: Value realisation and executive reporting

Controlled document

Alpha participants are named with their permission and organisation names are withheld under the confidentiality terms of the programme. Feedback is recorded in a controlled internal record, summarised here, and made available to assurance reviewers under agreement rather than published as a public reference.

Bring us one supplier, one feature, one decision

Book 20 minutes with Richie or Amy. We will show how AIRAS Cloud takes a recently enabled feature from evidence to an accountable, defensible decision.

Register interestBook a call

No commercial commitment. No confidential information required.

Cover of The Irish Guide to AI Governance by Richie Higgins, Founder and Chief Executive of AIRAS Cloud

Free eBook · 28 pages

The Irish Guide to AI Governance

What the EU AI Act means after 2 August 2026 — and the practical steps Irish organisations should take next. Written by our founder, Richie Higgins. No form, no paywall.

Get the free guideAll guides

Explore AIRAS Cloud