@Human EnterpriseThe AI governance platform for ISO 42001 & EU AI Act compliance
Build, run and prove every AI system in your enterprise.
One platform where AI applications are built, governed and evidenced together: accountable roles, signed approval gates, runtime guardrails, monitoring and incident tracking, with every system classified against the EU AI Act and ISO/IEC 42001. Sovereign, self-hosted and under your control.
Built on Corteza, Planet Crust's open-source low-code platform. Its core code is deployed by organisations including:
- Cisco
- KBR
- Nemak
Your AI estate is growing faster than your ability to govern it
AI adoption isn't the hard part any more. Control is. These are the six problems we hear from every enterprise CIO, CISO and DPO.
Agent sprawl
Every team is shipping assistants, agents and automations. Nobody can list them all, let alone say who approved them.
Two tools, one gap
Your GRC suite documents AI that was built somewhere else. Your build platform leaves governance to admin settings. Compliance fails in the gap.
Governance drift
A developer adds a field or changes a prompt on Tuesday. The risk register is updated next quarter, if ever. Your evidence is already wrong.
Runaway token bills
Agentic workflows call a model on every run. Costs grow with every ticket, claim and customer, and nobody budgeted for it.
Vendor lock-in
Your processes now depend on one AI provider's pricing, policies and uptime. If they change, your operations change with them.
Audit exposure
Regulators and auditors want evidence: who decided, on what data, under which policy. Screenshots and spreadsheets won't survive scrutiny.
The maximum EU AI Act penalty for prohibited AI practices, of worldwide annual turnover, whichever is higher. Most other breaches can reach €15m or 3% (Article 99, Regulation (EU) 2024/1689).
The questions your board will ask. Can you answer them today?
Every one of these questions has a precise answer in @Human, because governance is recorded as the system is built, not reconstructed afterwards.
| The question | Today | With @Human |
|---|---|---|
| Who approved this AI system? | An email thread, maybe | Named signatures, with evidence, per stage |
| What data does it touch? | A DPIA questionnaire from last year | A live register, down to prompts and agent memory |
| What changed since the audit? | Nobody is sure | Every change raised an impact review |
| Can it make promises it shouldn't? | Hope the prompt holds | Runtime enforcement blocks or rephrases it |
| What does it cost to run? | Grows with every run | Routine work runs as programmatic automation, with no tokens |
| What if the AI provider fails? | The process stops | Core operations keep running without AI |
One platform. Six stages. Every AI system governed by construction.
In @Human, every AI application is a governed project and a revision chain. Work happens on a draft, the governance record grows with the build, and only people can approve and publish the next version.
- SetupMembers, five accountable roles, approval gates, AI and infrastructure providers
- Policies and riskPolicies, sensitive data register and rights-based risk scenarios, before anything is built
- BuildData model, pages, charts, workflows, agents, chatbots and custom apps
- GovernAI system register, runtime enforcement, monitoring rules and residual risk
- ManageIncidents, features, privacy requests, tasks and reviews
- ComplyEvidence mapped to the EU AI Act, ISO/IEC 42001, UK frameworks and GDPR
A real project, governed end to end
This is the Govern view of a customer support assistant built in @Human. Its AI system is registered, two risk scenarios are assessed against the EU Charter, two runtime guardrails check every reply, and two monitoring rules watch the event log.
- No uncovered riskEvery scenario has a control, every control is monitored
- Readiness at a glanceWhat's done and what's missing, per stage
- One revision chainThe app and its governance record version together
Ten systems. One governed platform.
Everything an enterprise needs to build AI applications, and everything it needs to govern them, in the same project and the same revision chain. No integration project between your builders and your risk team.
Data and app builder
Modules, fields, validation, record pages, layouts and charts, including heatmaps, Sankey and sunburst.
Replace spreadsheets and shadow tools with governed apps.Workflow automation
Visual workflows and Trigger Action Queries fired by events, tested in a draft before release.
Predictable, repeatable, zero tokens on routine work.AI agents
Agents with guardrails, knowledge bases from project data, scoped tool access and a choice of LLM provider.
AI where judgement is needed, nowhere else.Embeddable chatbots
Chatbots that front your agents on websites and portals, with widget keys you can rotate.
Customer-facing AI with the same controls.Custom web apps
Sandboxed web apps that run inside @Human or open publicly by link.
Beautiful front ends without a separate stack.Policies, risk and data register
Versioned policies, FRIA risk scenarios for harms and benefits, and a sensitive data register down to prompts.
The governance record, written before the build.Runtime enforcement
Guardrails that check every agent reply, then block or rephrase anything that breaks your rules.
Stop unauthorised promises before customers see them.Monitoring and incidents
Monitoring rules over the event log that open incidents, with owners, reviews and corrective actions.
Know within minutes, not at the next audit.Roles and approval gates
Five accountable roles with a read, edit, request and grant matrix per stage, and signed gates per release.
Separation of duties by design. AI can never approve.Compliance evidence
Built-in mappings for the EU AI Act, ISO/IEC 42001, UK frameworks and GDPR, extensible to your own.
Evidence that stays true, release after release.Separation of duties, built in. AI can propose, never approve.
Five accountable roles, each with a precise matrix of what it can read, edit, request and grant at every stage. Approval gates require every named signatory, demand evidence, and lapse the moment anything changes.
Guardrails that act before your customer reads a word
Prompts are suggestions. Runtime enforcement is a control. Every agent reply is checked against the terms you set, then blocked or rephrased, and every trigger is written to the event log.
- Block or rephraseChoose the action per guardrail, linked to the risk it mitigates
- Monitoring rules on the event logCount patterns like repeated withheld replies or bulk deletions
- Alerts open incidentsOwners, reviews and corrective actions, tracked to closure
From alert to closed incident, on the record
Incidents, features, privacy requests, tasks and reviews live in the same project as the AI system they concern, so every fix is linked to its risk, its control and its evidence.
Governance that can't drift from what's running
The biggest weakness of standalone governance tools is that they depend on people keeping records in step with what developers ship. In @Human, the build itself raises the review.
- Change a module, agent, workflow, app, role or permissionAn impact review opens automatically
- New personal dataBecomes a sensitive data register entry
- New purpose or AI componentCalls for new risk scenarios before release
- Affects end usersThe privacy notice is re-versioned and re-accepted
Every version kept. Residual risk visible.
Current, draft and archived versions sit side by side. A draft can't publish while its AI systems carry unaccepted residual risk, and the scenario graph shows exactly which controls cover which risks.
Programmatic first. Agentic only where it pays.
Most AI platforms route every step through a model. @Human favours tested, programmatic automation wherever the choice exists, and calls an agent only for the steps that need judgement.
Where the token bill comes from
An agent-first process is billed on every run. A programmatic-first process spends tokens while you build and on the few steps that need judgement.
Illustrative only. Actual costs depend on your model, provider and volumes.Sovereign by design. Your estate, your models, your data.
Planet Crust is a software provider, not a SaaS provider. @Human runs inside your own infrastructure, under your own security controls and certifications, and keeps working if you unplug AI.
- Software you run, not SaaSPlanet Crust doesn't host or process your production data
- No AI lock-inAny LLM provider, EU-hosted or open models. Switch without rebuilding
- Operational without AICore processes are programmatic, so outages and policy changes don't stop you
- Open-source coreCorteza, already deployed by Cisco, KBR, Nemak and many others
Your systems
- Databases and line-of-business apps
- REST APIs and webhooks
- Workflows and connections
- OAuth2 clients for integrations
@Human instance
Includes an MCP server, so MCP-capable AI assistants can help build and govern projects under the same approval rules.
AI providers (optional)
- Any LLM provider
- EU-hosted models
- Open models on your servers
- Or none at all
Enterprise-grade applications, not prototypes
Full applications with data models, pages, workflows, agents and dashboards, each one a governed project from its first line.
Example applications with illustrative data. Dashboards are native @Human charts.
One decision every stakeholder can sign
Enterprise AI purchases stall when one function says no. @Human is built so that each of them can say yes.
CIO and CTO
One platform for building and governing AI, fewer tools to integrate, and no lock-in to any AI vendor or cloud.
CISO
Runs inside your estate and controls, runtime guardrails, event logging and real-time alerting.
Data protection officer
A live data register down to prompts and agent memory, versioned privacy notices, and your own signature on releases.
Chief risk and compliance
Rights-based risk scenarios, unlimited frameworks, and evidence mapped to the EU AI Act and ISO/IEC 42001.
Business owners
Apps that ship faster because legal, risk and data protection are part of the build, not a blocker at the end.
CFO and procurement
Lower token bills from programmatic automation, an open-source core, and one purchase instead of two.
Why enterprises choose @Human over two separate purchases
AI governance suites document AI built elsewhere. AI build platforms leave governance to admin settings. @Human does both, in one revision chain. Already run a GRC suite? @Human becomes the governed build layer that feeds it.
| Capability | AI governance suites | AI build platforms | @Human |
|---|---|---|---|
| Builds the application: data, workflows, agents, apps | No | Yes | Yes |
| Policies and risk written before the build | Separately | No | Yes |
| Rights-based risk assessment (FRIA) | Yes | Rarely | Yes |
| Data register down to prompts and agent memory | Partly | Partly | Yes |
| Re-review triggered by every build change | No | No | Yes |
| Signed approval gates that lapse on change | Partly | Partly | Yes |
| Runtime guardrails tied to risk scenarios | Partly | Partly | Yes |
| Core processes run without AI | Not applicable | Varies | Yes |
| Customer-run software, open-source core, any LLM | Rarely | Varies | Yes |
Category comparison based on publicly documented capabilities. @Human supports your compliance evidence; conformity remains the responsibility of the organisation deploying the AI.
Start with one system. Standardise across the enterprise.
No big-bang migration. Prove the value on the AI system that worries you most, then scale what works.
Pilot
One AI system you're unsure aboutClassify it, set up policies, the data register and risk scenarios, add guardrails and monitoring, and run it through signed gates.
Expand
A governed portfolioBring more teams and AI systems onto @Human. Reuse policies, frameworks, data models and workflows from the pilot.
Standardise
The enterprise way to build AIMake the governed project the standard path for every new AI system, with evidence ready for every audit.
Is @Human SaaS?
No. Planet Crust is a software provider. @Human runs in your own infrastructure, on Azure, AWS, Google Cloud, DigitalOcean, Hetzner or on-premises, inside your existing security controls.
Is Planet Crust ISO 27001 or SOC 2 certified?
Because @Human runs inside your estate and Planet Crust doesn't host or process your production data, it operates within the scope of your own certifications. We can share a shared-responsibility and security statement during evaluation.
Can @Human govern AI systems we didn't build in it?
@Human governs the applications built in it. For AI bought elsewhere, you can register the system as a project to record its policies, risks and approvals, and position @Human alongside your existing GRC inventory.
Which AI models can we use?
Any provider you choose, including EU-hosted and open models on your own servers. You can switch without rebuilding, and core processes keep running without AI.
How does @Human integrate with our systems?
Through APIs, workflows, connections and OAuth2 clients. Each instance also includes an MCP server for MCP-capable AI assistants.
Does @Human make us compliant with the EU AI Act?
@Human supports the evidence the EU AI Act and ISO/IEC 42001 call for: risk management, data governance, human oversight, logging and records. Conformity remains the responsibility of the deploying organisation.
How is @Human priced?
Talk to our sales team. Pricing depends on your deployment and scope, and an open-source core means no lock-in.
See @Human inside your own AI systems
A 20-minute walkthrough. Bring one AI system you are unsure about. We will show you how it would be classified, logged and reported for EU AI Act compliance inside @Human.
- How it would be classified under the EU AI Act
- Which ISO/IEC 42001 controls it touches
- Which guardrails and monitoring rules it needs
- Where you could cut token costs
