Attestation cycles now run quarterly, semi-annually or annually, every reassignment stays on the record, and certifying over a known gap takes an exception with an owner, a compensating control and an end date. The AI Tool Registry records who approved each tool and what data it may handle, and your AI assistant can answer both.
Attestation is the step where the people accountable for each AI use case sign off on its record. This release makes it run on your schedule, keeps every hand-off, and turns an exception into a commitment with an owner and an end date. It also gives the AI Tool Registry two things a reviewer asks about first: who approved a tool, and what data it may handle.
Admins choose how often PulseAI opens an attestation cycle: quarterly, semi-annually or annually, under Settings, Governance. Periods follow the calendar, so a semi-annual cycle opens on January 1 and July 1, and an annual one on January 1. Records are due 14 days after the period ends.
A change takes effect when the current period ends. Until then, cycles keep opening on the old cadence, so no month is left out and none is attested twice. Settings shows a pending change and the date it starts.
An attestation can be reassigned when the person it was assigned to is away or is not the right signer. The current attester, or any manager or admin, can hand it on, and the new holder can hand it on again.
Until now, a second reassignment replaced the first. Now every hand-off is kept in order: who made it, who held the record, who received it, why, and when. The review page shows the full reassignment history, the attestation list marks a record that has been reassigned, and the history is sealed with the certification in the Evidence Vault.
Certifying with exceptions now takes one exception for each known gap on the record: each critical governance flag, and each policy expectation answered as not met. An exception says what is not in place, what is done instead while it is open, who owns it, and when it ends, at most twelve months out. The end date follows your organization’s own calendar day.
The review page shows each exception as active until its end date and as expired after it, and the attestation list shows how many exceptions a record carries and how many have expired. Exceptions are recorded with the certification and are not edited afterward: to change one, certify the use case again.
Each tool in the AI Tool Registry can now record who approved it and when, and its data classification: restricted, confidential, internal, or public. Admins and managers enter them on the tool. The approver is chosen from your organization’s active users, an approval date cannot be in the future, and PulseAI keeps who entered the approval and when.
The registry filters by data classification, and each card shows who approved the tool or that no approval is recorded. Tools already in your registry show no approval recorded until one is entered.
If your active AI policy has a rule that a new AI tool must be approved before it is used, the Policy Center now checks every adopted tool against it. A tool with no approval recorded, or approved by someone other than the person the rule names, raises a finding.
Your AI assistant can now list registered tools by approver, by whether an approval is recorded, by data classification, and by registration date. “Show me every AI tool registered in the last 30 days, who approved it, and its data classification” gets a direct answer. The assistant can also read a use case’s reassignment history and exceptions, and it reports an expired exception on a use case’s current certification as a finding.
At a glance
partnerships@pulseai.now