Questions we get asked

What is Glacis?

We help make AI more controllable and accountable, so organizations can see what happened, enforce their rules and show the record later.

Glacis sits between an application and the models it calls. For each AI action it governs, it enforces the agreed controls and signs a record of the decision. A Glacis notary countersigns the record, which buyers, auditors and insurers can check without relying on a dashboard.

What problem does it solve?

The controls meant to keep an AI system in bounds, such as a clinician’s sign-off or a technical check, usually run inside software that an insurer, a regulator or a court cannot examine. When something goes wrong, there may be little evidence that those controls ran.

Glacis records what those controls did in production so someone outside the company can check.

What do I get?

If you oversee AI someone else built, you get a signed record from the vendor’s live workflow that you can check in your browser. You do not need a Glacis account, a dashboard or access to the application or its logs. The vendor’s security packet describes the intended controls; the record shows which control ran, what it decided and which parts of the workflow it covered.

If you sell AI, you get a managed layer between your application and the models it calls, with controls agreed with your team and run for you. Each decision produces a signed record. You can generate an evidence pack for a specific workflow and period to share with a customer’s security team.

If you insure AI, you get records showing which controls ran on every governed action, what they returned and where the gaps are, for a defined workflow and period. An underwriter can use the count of governed actions to calculate how often a control ran.

Where does Glacis sit, and what can it decide?

Glacis sits between the application and the models it calls, with one call at the point of action. A governed action is a model call, tool call or agent step that a control was asked to evaluate. Before it runs, the agreed controls allow it, hold it for human review or deny it.

Each decision is signed and countersigned, so the record of what the controls did is not the vendor’s word alone. The independence of the countersignature depends on the assurance level you choose.

What controls can Glacis enforce?

Your organization defines its own controls and risk tolerance. Glacis does not prescribe controls. We work with you to write them as policy and enforce them on every governed action.

The catalog today includes keeping a system inside its intended domain, grounding checks, prompt injection checks, output format checks, data classification, consent checks, PHI checks, bias checks and drift checks against the baseline agreed for the workflow.

What happens when the model behind a system changes?

A model update can invalidate the assumptions behind a prior assessment. Records carry the model identity and the control outcomes, so a reviewer can compare what the controls reported before and after the change.

Drift checks compare behavior over time against the baseline agreed for that workflow. Changes after an update appear in the records, so reviewers do not have to wait for a post-incident review to find them.

What is in a record?

The action, the controls that ran, what each returned, the decision, the time and the policy version in force. It carries hashes of the content rather than the content itself, so a reviewer can check a record without receiving a prompt, a draft note or a patient’s data.

Records use OVERT, an open standard, and remain readable and verifiable without Glacis.

Can a record be skipped, or changed afterwards?

Missing or altered records are detectable. Every governed action gets a record. The records are numbered and linked, so a missing record leaves a visible gap and an altered record fails verification. Nothing can be written in afterwards.

A vendor can use the records to show which controls ran. Reviewers can also see gaps in that record.

Who can check a record, and do they need anything from us?

Anyone holding a record can verify it against the open standard, in a browser, at verify.glacis.io. No Glacis account, no dashboard, nothing from the application or its logs. It stays verifiable whether or not you are still a customer.

The verifier shows which signatures and hashes it checked, which keys signed the record and what the record links to.

How much assurance do we need?

It depends on what the system does and who will rely on the record. OVERT defines four assurance levels based on how much a reviewer has to take on trust. Glacis offers a matching set of options:

• Records signed by the system’s operator. They are tamper-evident, but the evidence comes from the operator alone.
• Records countersigned by a Glacis notary the operator does not control. The operator cannot alter or skip a record alone.
• Records countersigned by an independent third party as well, for systems whose reviewers need a trust root outside both the operator and Glacis.
• Hardware-rooted attestation, where the layer runs in a trusted execution environment and its measurements are anchored, so a record cannot be faked at the source.

The level is chosen for each system according to its risk. Greater independence costs more. The standard defines its levels in section 4.1 at overt.is.

Where does Glacis run?

There are three deployment options:

• Entirely inside your environment, with nothing leaving it.
• Inside your environment, with only hashes, decisions and signatures sent to the Glacis notary for countersignature.
• Hosted by Glacis.

The deployment option and assurance level are chosen together according to the system’s risk.

What data leaves our environment?

In either deployment inside your environment, prompts, model output and patient data stay there. The fully internal deployment sends nothing out. The deployment using an external Glacis notary sends only content-free record material: hashes, decision fields and signatures. With Glacis hosting, calls pass through Glacis infrastructure under your DPA.

In every deployment, the record carries hashes rather than payloads, so a reviewer can check it without receiving PHI.

What is OVERT, and who controls it?

OVERT is an open, royalty-free specification for verifying AI safeguards at runtime. It is moving to shared stewardship under the Coalition for Health AI and the AIGovOps Foundation, with Glacis as non-voting editor. Stewardship covers the standard, not Glacis products.

It is published at overt.is under an irrevocable royalty-free patent covenant, so anyone, including a competitor, can implement a verifier from the specification and check your records without our involvement.

Does this make us compliant with the EU AI Act, ISO 42001 or the NIST AI RMF?

No. Those frameworks and laws address policy, ownership, risk, documentation, controls, testing and other obligations. For governed actions, Glacis can contribute operational records to the wider evidence set. It does not classify a system, certify safety or establish compliance.

EU AI Act Article 12 requires automatic logging capabilities appropriate to covered high-risk systems. Signed, scoped records may support part of that design when their fields and coverage are relevant. Evidence-pack mappings to NIST AI RMF, ISO 42001, the EU AI Act or OSCAL are navigation aids for reviewers, not proof that a requirement is satisfied.

Our buyers send AI security questionnaires. Does this help?

Many AI security reviews ask where data flows, where controls run, what happens on an exception and what record remains for a specific decision. A SOC 2 report or architecture diagram may be relevant, but it does not answer every workflow-level question.

A signed record for each governed action can support those rows with inspectable evidence. It does not replace the buyer’s diligence or guarantee acceptance.

What does an insurer get from this?

For a defined workflow and period: which controls ran on every governed action, what they returned and where the gaps are, in records the insurer can check without access to the policyholder’s systems. That is a denominator, which a questionnaire does not give.

Glacis is working with insurers on this now and was selected for Cohort 17 of Lloyd’s Lab, where we will test whether verifiable evidence from AI systems can inform underwriting and claims decisions. Glacis does not underwrite, price or decide coverage.

Who is Glacis for, and where is it working today?

Glacis serves health systems and enterprises overseeing AI they did not build, vendors responding to customer reviews and insurers assessing either. Current work is in healthcare and insurance. Controls vary by industry; the record format is the same across regulated industries.

nVoq, which builds ambient documentation for clinicians, is our first customer and design partner.

Is Glacis (glacis.io) the same company as Glacis (glacis.com)?

No. They are two different companies, both based in Seattle, and search engines and AI assistants routinely merge the two into a single entity.

We are GLACIS Technologies, Inc. at glacis.io. We build tools to supervise AI in consequential applications and record how its controls operate. Glacis at glacis.com is a separate business. Our other domains include overt.is, docs.glacis.io, trust.glacis.io, app.glacis.io and verify.glacis.io.