What we sell against these gaps
10 paid products on redhub.ai. 8 of them close a domain this assessment measures, one is the starting point for a small team with none of the three preconditions yet, one is the subscription for keeping a passing answer true, and one domain it grades has nothing behind it at all. The table below says which is which.
None of them touches a system: they grade or produce what you write down. Five end in a verdict you can recompute rather than a judgment call. The rest produce the document itself, and the maintenance plan is a recurring service.
RedHub AI publishes this site and sells these products. We say so here rather than presenting them as neutral recommendations, and where the assessment finds a gap nothing here addresses, the row below says so.
None of these is an audit and none of them certifies anything. They are structured procedures that produce the documents an audit would ask to see, and buying one changes nothing about what applies to you.
The ten
Which one closes which gap
Finds what is actually in use, including the AI switched on inside tools you already bought and the tools running on personal accounts, and triages what it finds.
Produces the written rule itself: what AI may be used for, what it may not, and what happens at the edges.
Grades eleven domains on whether each has a named owner, and disqualifies any that does not. It is the product the no-owner column on your result is borrowed from. There it is a gate, and here it is only reported.
The same discovery work, applied to how a tool arrives and how it leaves. An inventory that only grows stops describing the estate.
The deeper policy build: named data categories, retention and training terms per tool, and the decisions at the edges written down.
Vendors, sub-processors, what data reaches each and whether an agreement is on file. This is the artifact a customer's security review asks for by name.
The risks you decided to accept, each with an owner and a review date, and a gate that refuses to call an accepted high-severity risk with no owner governed.
What a system produced, when, and who reviewed it, retained together so the answer exists before the question does.
Role-appropriate training with a record per role, which is the form this is asked for in, not a course everybody sits through.
Nothing on this shelf addresses independent challenge, and this one is not a gap in the catalog. What the control describes is a person with the standing to refuse. No download supplies one, and selling a workbook against a staffing decision would be selling you the wrong thing.
Why the Governance Starter Bundle is not on this page. It exists, it costs $399, and it contains the EU AI Act Readiness Kit, the Acceptable Use Policy Builder and the AI Literacy & Workforce Training Kit. Two of those three are products this page recommends and separately they cost $268, so the bundle is the more expensive route unless you also want a framework kit. This assessment measures against no framework. If the EU AI Act is the instrument you are being measured against, the bundle is good value and the assessment for that question is a different one.
An audit is performed by somebody else, who examines evidence and can disagree with you. Nothing on this page is that.
How the assessment is scored is published in full, weights and bands included.