A group has a problem a single organization does not: the parent carries responsibility for the group’s AI compliance but must not simply reach into its subsidiaries’ data. Group governance solves that with three building blocks: a directed link between organizations, a read-only aggregate view, and policy templates that are offered rather than imposed.

At a glance

Included from: Enterprise
Where in the app: Left navigation → Group
Output: A group rollup across all subsidiaries plus distributed templates
API: /api/v1/group-governance

Linking organizations

The link is not assigned top-down; it is created by an invitation the subsidiary redeems. Both sides actively consent.

1The parent creates an invitation – optionally with a label and the target organization’s email address.
2This produces a pairing code. It is valid for 7 days by default, 14 at most; after that it simply expires.
3The subsidiary first checks the code in a preview: it sees who is inviting it before agreeing.
4After redeeming, the link is active and the subsidiary appears in the parent’s rollup.
5Either side can dissolve the link at any time – the parent for a specific child, the child for itself. The reason for revocation is recorded.

What the rollup shows

The rollup is a metrics view, not a data view. The parent sees where things are stuck – not the contents of subsidiary files.

Per subsidiary: name, plan, status and the level in the group – 1 is a direct subsidiary, 2 a grandchild.
Number of AI systems, broken down by risk class: minimal, limited, high, prohibited and unassessed.
Systems with an overdue review – overdue means not reviewed for more than a year.
Open incidents per subsidiary. Only incidents with status "resolved" or "closed" count as closed.
The group structure separately as a plain organizational tree – deliberately without metrics when you only need the hierarchy.

Distributing policy templates

A template is a prepared AI system entry the parent distributes to subsidiaries. Distribution creates an offer – not write access.

Create a template

Either by hand or from an existing AI system of the parent. A template has a status: draft, published or archived. Only published templates can be distributed.

Distribution with preview

Before distributing, a preview shows which organizations would receive an offer. So you do not accidentally distribute to the entire group.

Accept or decline

The subsidiary decides for itself. When declining it can state a reason. Accepted, the offer becomes a real record in its own data, owned by the subsidiary from then on.

Auto-adopt

Optionally a template can be flagged for automatic adoption. That is a decision with governance consequences – define beforehand who may make it.

The parent gets no write access

A link creates a read-only aggregate view and the ability to offer templates. It does not create access to the subsidiary’s files, evidence or incidents. Anyone who actually has to work in several organizations needs their own permission there – the group link is no substitute.

Via the API

Group rollup, structure, links and templates are readable with an API key. Writing group actions stays reserved for a signed-in session – with one exception: accepting, declining and syncing offers works via the API too, because that is the receiving subsidiary’s decision about its own data.