AI assistance
Several modules can ask a language model to write a first draft for you — an observation, an audit finding, a report, a policy mapping. None of them do anything until an administrator turns them on, and they are turned on one module at a time.
Why this is a decision you make, not one we make
Whether this instance can reach a model at all is a deployment matter: someone configured a local model, or an API key, when the platform was installed. That is a technical capability, and it is not the same question as whether your organisation's material may be processed.
So Vantage treats a configured key as capability only. Permission is yours, it is recorded, and it is off by default. An upgrade that adds a new AI feature does not switch anything on — a new module arrives off like the rest.
Consent is per module
Settings → AI assistance lists five modules, each with its own switch:
| Module | What it covers |
|---|---|
| Compliance | Drafting a workpaper observation, the assessment assistant, generating and analysing findings |
| Internal Audit | Drafting an audit finding from a working paper, drafting an engagement report |
| Risk | Drafting a risk engagement report |
| Third-party risk | Analysing a vendor, analysing a third-party finding |
| Governance | Policy mapping and coverage, scaffolding, authoring and redlining policy text |
They are separate because they are not the same decision. Letting a model read your own control assessments is a narrower step than handing it a vendor's questionnaire answers, and both are narrower than giving it your policy library, drafts included. A single switch for everything would force you to accept the widest use in order to get the narrowest one.
They are not split any finer than a module, either. Within a module the features draw on the same material, so ten switches that all mean "our compliance data" would look like control without being it.
What is actually sent
Each module states, on the settings page and before you decide, exactly what leaves the platform when one of its features runs. Two points worth knowing in advance:
- Evidence files are never read. Compliance drafting works from the evidence record — the file name, the assessor's description, the version and when it was attached — not the contents of the document. A model is never handed your uploaded PDFs, spreadsheets or screenshots.
- Both compliance AI features honour the switch the same way. With Compliance off, Draft from evidence and the AI Assistant on the workpaper are not shown at all — not shown and then refused.
- Nothing is stored on the other side by us. A draft is returned to your screen and is yours to edit; the platform does not save the draft until you do. What the model provider retains is governed by your agreement with them, which is why the next section matters.
Local models and hosted models
The settings page tells you which kind this instance uses.
- Local model — the text is processed by a model running inside your own network and does not leave it. This is the usual on-premise configuration.
- Hosted model — the text is sent to a third-party provider. The page warns you when this is the case. Check this against your data-residency obligations before enabling anything, particularly for Governance and Third-party risk.
If no model is reachable at all, the page says so and the switches have nothing to act on.
Who can change it, and what is recorded
Turning a module on or off requires organisation administrator rights or above. Everyone else sees the current state read-only.
Every change is written to the audit trail with the person, the module, the direction and the time, so "when did we permit this, and who decided" has an answer.
Turning a module on
- Go to Settings → AI assistance.
- Read the module's What this sends list.
- Confirm the model type shown at the top of the page is acceptable for that material.
- Switch the module on. It takes effect immediately for everyone in the organisation.
Switching it back off is immediate too. Features that were drafted while it was on stay where they are — they are ordinary saved text at that point, indistinguishable from anything typed by hand, and the platform does not mark or remove them.