Running an AI Risk Assessment with an AI Governance Platform

Maxim AI has released Bifrost, an open-source AI gateway written in Go that acts as a runtime control plane for enforcing AI risk assessments and governance policies. The tool is positioned to help enterprises map controls to frameworks including the NIST AI RMF 1.0, ISO/IEC 42001:2023, and the EU AI Act, addressing compliance gaps created by probabilistic model outputs and autonomous agent actions.

TL;DR According to a 2026 enterprise compliance survey by A-LIGN, 72% of organizations express serious concern over how artificial intelligence integrations affect their regulatory compliance and audit posture. Conventional IT audits assess static codebases and predictable network perimeters, but modern generative applications rely on probabilistic outputs, dynamic tool integrations, and third-party foundation models. Without specialized operational tooling, security teams struggle to identify where data flows, which models execute user queries, and whether automated agents adhere to security boundaries. Bifrost https://www.getmaxim.ai/bifrost , an open-source AI gateway https://github.com/maximhq/bifrost developed in Go by Maxim AI, provides the runtime control plane necessary to convert static risk frameworks into automated, enforceable technical policies. An AI risk assessment is a structured process for identifying, evaluating, and mitigating the security, operational, legal, and ethical vulnerabilities introduced by artificial intelligence systems across their lifecycle. Unlike conventional cybersecurity reviews, an AI risk evaluation accounts for non-deterministic model behavior, prompt manipulation, training data leakage, and automated agent actions. Enterprise risk assessments traditionally operate on static assumptions: an application receives defined inputs, applies deterministic logic, and writes structured outputs to a database. Large language models LLMs and multi-agent workflows invalidate this premise. Prompts accept arbitrary natural language, foundation models exhibit emergent failure modes, and autonomous agents call external application programming interfaces APIs based on intermediate reasoning steps. Evaluating enterprise AI risk therefore requires moving beyond point-in-time security questionnaires. Organizations must evaluate risks across three distinct operational layers: A modern AI governance platform unifies these disparate surfaces into a single observability and enforcement architecture, ensuring that risk ratings match runtime reality. To establish a defensible audit posture, security teams map their internal controls to recognized international frameworks. Three primary standards dominate current enterprise compliance requirements: the NIST AI Risk Management Framework AI RMF 1.0 https://www.nist.gov/itl/ai-risk-management-framework , the certifiable ISO/IEC 42001:2023 standard https://www.iso.org/standard/81230.html , and the binding European Union Artificial Intelligence Act Regulation EU 2024/1689 . Understanding the practical overlap and mechanical differences between these standards prevents organizations from building duplicative governance programs. | Governance Dimension | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | EU AI Act Regulation EU 2024/1689 | |---|---|---|---| | Legal Status | Voluntary guidance framework | Certifiable international management standard | Binding statutory regulation across EU jurisdictions | | Core Structure | Four functions: Govern, Map, Measure, Manage | Context, Leadership, Planning, Support, Operation, Evaluation, Improvement | Risk-tiered categories: Unacceptable, High-Risk, Specific Transparency, Minimal | | Primary Focus | Socio-technical trustworthiness and practical playbooks | Artificial Intelligence Management System AIMS organizational processes | Fundamental rights, product safety, CE marking conformity, transparency | | Technical Control Verification | Empirical evaluation of bias, robustness, and security | Formalized control implementation Annex A and third-party audit | Technical documentation, continuous post-market monitoring, mandatory incident reporting | | Runtime Enforcement Need | High ongoing telemetry for Measure and Manage | High continuous control operation under Clause 8 | Critical mandatory logging, human oversight, output filtering | While the NIST framework offers a tactical playbook for assessing socio-technical risks, ISO/IEC 42001 provides the auditable structure required by enterprise procurement departments. Meanwhile, the EU AI Act imposes strict compliance penalties for high-risk systems deployed without verified logging, risk management systems, or data governance protocols. An AI governance platform acts as the bridge between these written standards and real-world infrastructure. It transforms static framework policies into automated proxy rules, rate limits, content guardrails, and compliance logs. Conducting an AI risk assessment requires testing systems against specific, known vulnerability patterns. The OWASP Top 10 for Large Language Model Applications https://owasp.org/www-project-top-10-for-large-language-model-applications/ documents the primary technical failure modes security teams encounter during evaluation. Employees and customer-facing workflows routinely submit prompts containing personally identifiable information PII , protected health information PHI , payment records, or proprietary source code. If these prompts route to public commercial APIs without data scrubbing, the organization risks regulatory non-compliance under GDPR, HIPAA, or CCPA. An assessment must determine whether the system detects and redacts secrets before requests leave the enterprise boundary. Both direct prompt injection jailbreaking and indirect prompt injection where untrusted web content or external database records alter model instructions can hijack an application's decision logic. If an LLM processes external documents or emails, an attacker can embed hidden instructions that force the model to exfiltrate database contents, execute unauthorized API commands, or bypass corporate compliance filters. Software engineering and product teams often bypass centralized procurement by creating isolated accounts with diverse model providers. When developers configure disparate API keys across ad-hoc microservices, security teams lose visibility into which model versions process company data. Risk assessments must evaluate whether all outbound generative AI traffic routes through a centralized gateway or flows unmonitored over public networks. Modern AI architectures increasingly employ agentic patterns where models autonomously trigger external functions. If an agent integrates with Model Context Protocol MCP servers or third-party webhooks without granular role-based authorization, prompt manipulation can lead to arbitrary code execution, unintended file deletions, or unauthorized database mutations. Denial-of-wallet attacks and looping recursive agent calls can exhaust provider rate limits and inflate operational cloud expenditures. Without dynamic budget caps, request throttling, and semantic caching, a sudden spike in traffic or an infinite tool-calling loop can exhaust an organization's monthly inference budget in hours. To satisfy auditors and maintain secure operations, organizations cannot rely on manual code reviews of individual model prompts. Instead, engineering teams deploy a centralized AI governance platform to enforce policies systematically. Bifrost https://www.getmaxim.ai/bifrost serves as a unified enforcement layer between client applications and downstream foundation models. Operating with an ultra-low latency footprint, Bifrost adds only 11 microseconds of overhead per request at 5,000 requests per second in sustained performance benchmarks https://www.getmaxim.ai/bifrost/resources/benchmarks , ensuring that enterprise governance does not degrade application responsiveness. Security teams use the gateway to operationalize risk mitigations across several key domains: Client Application / Agent │ ▼ ┌────────────────────────────────────────────────────────┐ │ Bifrost AI Gateway │ │ ┌──────────────────────────────────────────────────┐ │ │ │ 1. Virtual Key Auth & Budget Enforcement │ │ │ └──────────────────────────────────────────────────┘ │ │ ┌──────────────────────────────────────────────────┐ │ │ │ 2. Guardrails PII Redaction, Secrets Detection │ │ │ └──────────────────────────────────────────────────┘ │ │ ┌──────────────────────────────────────────────────┐ │ │ │ 3. Semantic Caching & Token Optimization │ │ │ └──────────────────────────────────────────────────┘ │ │ ┌──────────────────────────────────────────────────┐ │ │ │ 4. Load Balancing & Automatic Fallback Routing │ │ │ └──────────────────────────────────────────────────┘ │ │ ┌──────────────────────────────────────────────────┐ │ │ │ 5. Immutable Audit Logs & Telemetry Export │ │ │ └──────────────────────────────────────────────────┘ │ └────────────────────────────────────────────────────────┘ │ ▼ ┌────────────────────────────────────────────────────────┐ │ Downstream Providers OpenAI, Bedrock, Vertex, vLLM │ └────────────────────────────────────────────────────────┘ Rather than distributing raw provider API keys across engineering teams, administrators issue virtual keys https://docs.getbifrost.ai/features/governance/virtual-keys . Virtual keys act as internal identity tokens with hard boundaries: Bifrost integrates runtime guardrails https://docs.getbifrost.ai/enterprise/guardrails that inspect both incoming prompts and outgoing model responses before network transmission completes. By applying native secrets detection https://docs.getbifrost.ai/enterprise/guardrails/secrets-detection powered by Gitleaks alongside custom regex filters https://docs.getbifrost.ai/enterprise/guardrails/custom-regex , the gateway intercepts API keys, private certificates, Social Security numbers, and credit card numbers. Bifrost also integrates directly with third-party enterprise filters such as AWS Bedrock Guardrails, Azure Content Safety, and Patronus AI, rejecting adversarial injections and toxic content before models process the query. Model outages and provider rate-limit errors represent severe operational risks for mission-critical software. Bifrost resolves provider fragility through automatic fallbacks https://docs.getbifrost.ai/features/fallbacks and adaptive load balancing. If a primary provider returns 5xx HTTP server errors or throttles requests, the gateway immediately routes the payload to a configured secondary provider or an equivalent private model without downtime. Regulations like the EU AI Act and standards like SOC 2 require continuous traceability of automated decisions. Bifrost generates immutable audit logs https://docs.getbifrost.ai/enterprise/audit-logs capturing request timestamps, virtual key identities, token consumption, latency, and applied guardrail actions. Enterprise teams can export these logs to Amazon S3, Google Cloud Storage, or enterprise SIEM platforms via the gateway's log export pipelines https://docs.getbifrost.ai/enterprise/log-exports and Datadog connector https://docs.getbifrost.ai/enterprise/datadog-connector . Beyond routing, Bifrost applies governance https://www.getmaxim.ai/bifrost/resources/governance and security controls virtual keys, budgets, guardrails, audit logs centrally, and Bifrost Edge https://www.getmaxim.ai/bifrost/edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement https://docs.getbifrost.ai/edge/security on each device. A significant blind spot in enterprise AI risk assessments occurs outside production server clusters. Employees regularly interact with generative AI directly from their laptops using desktop applications like Claude Desktop, IDE extensions such as Cursor or Claude Code, and browser-based chat interfaces. Because these interactions bypass central application servers, they introduce untracked shadow AI into corporate operations. Bifrost Edge addresses this challenge by functioning as an endpoint extension of the centralized AI gateway. Rather than requiring employees to manually reconfigure base URLs or configure proxy tokens, Edge runs as an operating system agent on macOS, Windows, and Linux. Currently in alpha, Edge intercepts outbound AI requests at the machine level and transparently forwards them through the organization's Bifrost control plane. This architecture closes key enterprise risk gaps: By linking gateway policies to endpoint enforcement, organizations ensure that risk controls apply uniformly to internal developers, customer-facing applications, and administrative staff alike. Executing an enterprise AI risk assessment requires coordinating security, engineering, and compliance teams through a structured workflow. The following five-stage methodology aligns technical evaluation with regulatory verification. The assessment begins by cataloging every artificial intelligence asset operating across the organization. This includes foundation model endpoints, self-hosted open-source models, vector databases, and desktop tools. Teams configure Bifrost to act as a centralized drop-in replacement https://docs.getbifrost.ai/features/drop-in-replacement proxy for popular SDKs, immediately capturing traffic volume, active model IDs, and caller identities without refactoring application logic: python from openai import OpenAI Bifrost acts as a drop-in replacement by updating the base URL client = OpenAI base url="https://bifrost.internal.enterprise.com/v1", api key="bf-virt-key-finance-production" response = client.chat.completions.create model="gpt-4o", messages= {"role": "user", "content": "Analyze quarterly transaction ledger."} Simultaneously, security teams deploy Bifrost Edge across company machines to discover unapproved coding agents and local MCP servers. Once assets are mapped, teams evaluate the threat exposure of each use case against established taxonomies like the OWASP Top 10 for LLMs. Each system receives a severity score based on its data sensitivity and autonomy: In this stage, security teams translate the risk mitigation strategy into enforceable rules within the AI governance platform. Administrators configure virtual keys with explicit provider routing rules, token limits, and guardrail policies. For high-risk applications, teams configure sensitive data redaction profiles on the gateway: { "guardrails": { "secrets detection": { "enabled": true, "action": "block" }, "custom regex": { "name": "corporate customer id", "pattern": "CUST- 0-9 {8}", "action": "redact" } , "providers": { "provider": "aws bedrock guardrails", "guardrail identifier": "gr-sec-prod-01", "guardrail version": "DRAFT" } } } AI risks evolve as models receive fine-tuning and users change prompt techniques. Teams establish automated observability to continuously measure system drift, error frequencies, and policy violations. Engineers configure Bifrost's native Prometheus metrics https://docs.getbifrost.ai/features/observability/prometheus and OpenTelemetry OTLP tracing https://docs.getbifrost.ai/features/observability/otel to stream transaction metrics into monitoring dashboards. Alerts trigger when guardrail breach attempts spike or when unexpected MCP servers attempt network connections. The final stage compiles runtime operational metrics into formal audit documentation. Security teams review immutable access logs to prove that: These artifacts satisfy external auditors examining ISO/IEC 42001 conformity or regulatory authorities conducting EU AI Act compliance checks. Security teams can use the following remediation matrix during an audit to map identified risks to required regulatory controls and concrete gateway configurations: | Identified AI Risk Vector | Target Framework Mapping | Technical Platform Control | Operational Verification Method | |---|---|---|---| | Exposure of internal API keys or tokens in training/prompts | NIST AI RMF: Manage 2.4 ISO 42001: A.8.4 | Gateway secrets detection https://docs.getbifrost.ai/enterprise/guardrails/secrets-detection and PII regex | Send test payloads containing test canary keys; verify HTTP 400 rejection in logs. | | Uncontrolled API spending from agent retry loops | ISO 42001: A.6.2 SOC 2: Common Criteria 6.1 | Virtual keys https://docs.getbifrost.ai/features/governance/virtual-keys with monthly budget limits | Simulate burst queries; verify gateway returns 429 response when limit is reached. | | Data leakage through employee coding plugins | EU AI Act: Article 10 ISO 42001: A.7.2 | Bifrost Edge app governance https://docs.getbifrost.ai/edge/app-governance and MDM enforcement | Inspect fleet dashboard; verify unvetted coding agents are flagged as denied. | | Arbitrary local script execution via MCP tools | OWASP LLM07: System Overreliance NIST AI RMF: Govern 1.2 | Gateway MCP tool filtering https://docs.getbifrost.ai/features/governance/mcp-tools and Edge MCP discovery | Attempt calling unauthorized MCP tool names; verify immediate proxy block. | | Single-point-of-failure outages during provider downtime | ISO 42001: A.8.2 SOC 2: Availability 1.1 | Multi-provider automatic fallbacks https://docs.getbifrost.ai/features/fallbacks and health monitoring | Simulate upstream 503 provider errors; confirm automatic re-routing to backup models. | Traditional cybersecurity assessments focus on network access controls, software vulnerabilities, and deterministic application logic. An AI risk assessment specifically evaluates non-deterministic model behaviors, prompt injection vulnerabilities, training data rights, model hallucination rates, tool-use permissions, and automated agent actions across dynamic environments. NIST AI RMF provides flexible, practical guidance ideal for organizations establishing their initial AI risk management taxonomy. ISO/IEC 42001 is an internationally recognized, certifiable management standard designed for enterprises that must prove third-party audited compliance to enterprise buyers, partners, or regulatory bodies. An AI gateway inspects request payloads before they leave the enterprise boundary using automated pattern-matching tools. Bifrost combines native Gitleaks secrets detection, custom regular expression matching, and external integrations with cloud safety services like AWS Bedrock Guardrails to identify, mask, or block sensitive tokens in real time. While no single mechanism completely eliminates prompt injection risks, an AI governance platform provides layered defense-in-depth. It applies input classification guardrails, strips unauthorized system prompt overrides, restricts downstream model capabilities through virtual key permissions, and restricts which external tools or MCP servers an agent can invoke. Shadow AI occurs when employees submit proprietary company data or customer records into unvetted desktop applications, web browsers, or terminal coding agents. This bypasses corporate data protection policies, creating severe compliance violations under frameworks such as GDPR, HIPAA, and the EU AI Act due to unmonitored data transfers. The Model Context Protocol standardizes how language models interact with local databases, file systems, and web APIs. If left ungoverned, malicious or poorly configured MCP servers can allow models to run arbitrary terminal commands, leak file contents, or execute database mutations without human oversight or authentication safeguards. Static risk reviews can no longer keep pace with rapid generative AI adoption. When development teams integrate new foundation models weekly and employees use autonomous coding agents daily, governance must operate at runtime. Evaluating and mitigating risks requires an integrated platform approach. Deploying a performant AI gateway gives organizations complete control over server-side inference traffic, while extending those controls to the endpoint eliminates shadow AI across employee laptops. Engineering and security teams evaluating infrastructure for continuous AI risk governance can request a Bifrost demo https://getmaxim.ai/bifrost/book-a-demo or review the open-source repository https://github.com/maximhq/bifrost to get started.