ClarityGRC

For MSP advisors

How MSPs run client compliance in ClarityGRC.

Win the prospect, run the 90-day program, and hand every client an exam-ready story. One tool, one method, every client.

Become a partner Get the PDF field guide

The model

One program, two spines.

Everything in ClarityGRC flows from one place: the client's profile. Answer it well and the platform builds the program, the rules that apply, the work they create, the evidence that proves it, and the documents that show it.

The compliance spine

  1. Profile
  2. Applicability
  3. Obligations
  4. Tasks
  5. Evidence
  6. Reports

The applicability engine reads the profile and selects from a researched catalog of 70+ regulations. Only what applies generates work.

The AI governance spine

  1. Intake
  2. Gates
  3. Systems
  4. FIA
  5. Incidents
  6. Maturity

Every AI tool enters through intake, is risk-tiered Low, Medium, or High, and moves through four decision gates.

One posture score

Both spines converge on a single 0 to 100 posture score. The same number appears on the dashboard, the client page, and every document that reports it.

One attention inbox

Everything due, overdue, or waiting on someone feeds one prioritized list, and the same number shows up the same everywhere it appears.

One layout, everywhere

Every register works the same way: summary tiles that filter, a checklist, and the evidence behind it. Learn one and you know them all.

The one sentence to remember

Answer the qualifying profile early and honestly. It is the master switch: regulations, obligations, and AI oversight all flow from it.

Before they sign

Win the prospect first.

Run a preliminary assessment: a short pre-sales engagement that shows a prospect exactly what they are missing, under your brand, before they pay for anything. It is free, never billable, and everything you gather carries over when they convert.

  1. Create prospect
  2. Profile
  3. Send link
  4. Review
  5. Snapshot
  6. Convert
  1. 1

    Start a preliminary assessment from your firm home. Name and industry, no stakeholders, no logins.

  2. 2

    Answer the qualifying profile. The applicability engine instantly maps which regulations apply to them.

  3. 3

    Send the self-assessment link. A secure, 30-day link. The prospect answers in the browser, no account needed.

  4. 4

    Generate the Readiness Snapshot. A co-branded briefing deck: what applies, the duties nobody is tracking with their penalty exposure, their top gaps, and, once five or more industry peers are on the platform, their score against those peers.

  5. 5

    Convert when they sign. One click. Day 1 starts that day, and the profile, applicability, and assessment answers become the head start.

The hook

The Snapshot names the recurring duties their regulations already create, whether tracked or not, with the penalty exposure behind the biggest ones. Prospects rarely un-see that slide.

The method

The 90-day engagement.

Every client runs the same four phases. Target dates are set automatically, the engagement guide lists each phase's steps, and it ticks them off as the work happens. You always know where a client stands and what comes next.

  1. AssessDays 1 to 15
  2. EstablishDays 15 to 45
  3. OperationalizeDays 45 to 75
  4. HandoffDays 75 to 90

Assess

Scope the program, inventory AI in use, take the baseline self-assessment, confirm what applies.

Establish

Charter the program, classify systems by risk tier, stand up the registers and the steering committee.

Operationalize

Run the gates, test controls, log evidence, work the obligations as they come due.

Handoff

Board deck, audit pack, and a running program the client owns, with you in the operating seat.

The guide does the tracking

Inside each client, the engagement guide lists this phase's steps and links straight into the register where each happens. Most steps complete themselves as you work.

Practice first

Spin up the practice client from your firm home: a fictional community bank with the same rule engine behind it as a real client. Run one AI system through all four gates there before touching real data.

The daily loop

Your Monday morning.

Ten clients, one question: who needs me today? Your My work list answers it, then hands you to the work.

  1. My work
  2. Open client
  3. Phase guide
  4. Do the work
  5. It logs itself
  6. Next client

Distressed clients sort first

A blown phase target or a critical finding pins a client to the top of your My work list with a red flag. The urgent one never sinks under routine task load.

You always know whose data you are in

Open a client and their name and logo sit at the top of your sidebar. Every register, report, and score below it belongs to that one client.

Ctrl or Cmd-K goes anywhere

Press it and jump to any page by name. It only offers what your role can open. Type three letters, hit enter.

Ask an advisor

Stuck on a judgment call? Ask from the Advisor page, or right from an obligation, a policy, or an AI system. Every question and reply is kept as an auditable thread tied to that record.

Grace AI drafts, you decide

Policies, model cards, gate rationales, and board narratives draft themselves from the client's actual records, with citations to what grounded them. Review, edit, sign. A human always has the final say.

How decisions are made

The four gates.

Every AI initiative moves through four decision checkpoints. Gates run in order, outcomes are fixed, and the record is permanent. This is the part examiners remember.

  1. Gate 1Prioritize
  2. Gate 2Fund
  3. Gate 3Validate
  4. Gate 4Deploy

Gate 3 has three honest outcomes: Scale (roll it out), Extend (keep piloting), or Stop (shut it down).

The hard block

A High Risk or lending system cannot pass Gate 3 or Gate 4 without a completed Fundamental Impact Assessment and no active fair-lending hold. The platform itself enforces it, and there is no override, which is precisely what makes it worth showing an examiner.

A permanent record

A gate decision can never be edited or deleted, only added to. Withdrawing one records the withdrawal rather than erasing the decision, and a decision made on a system with an impact assessment carries a frozen copy of it exactly as it stood that day. Control tests work the same way, and attestation records are never deleted: what the examiner sees is provably what happened.

Risk tiers

Low, Medium, High. Systems that influence decisions about people are High and get the most scrutiny.

Guided decisions

Not sure how severe an incident is, or whether a use case needs review? Short wizards, four or five questions, document the call in minutes.

Incidents

Wrong, unsafe, or biased outcomes are logged S1 to S4 and tracked to resolution, feeding the program metrics the board sees.

What the client sees

Deliver value they can hold.

Every document generates from live data, carries your firm's brand, and names the client as the subject. Dated copies are archived automatically, keeping a versioned record of what you delivered and when.

Board update deck

The quarterly AI governance story, board-ready: posture, maturity movement, the gate pipeline, and what comes next.

Quarterly governance report

The written leave-behind: where the program stands, what changed, and the priorities ahead.

Audit and exam pack

The evidence an examiner asks for, bundled on demand: registers, decisions, tests, and attestations.

Readiness Snapshot

The pre-sales briefing from the prospect play above, and just as useful mid-engagement to show progress against the starting point.

Secure share links

Send a read-only, point-in-time summary by link. No login for the recipient, your brand on the page, aggregate numbers only.

Industry benchmarking

Once five or more peers share an industry, show each client where they stand against them, never who the peers are. K-anonymized across the ClarityGRC network.

Your brand, everywhere it counts

Set your firm's name and logo once in firm settings. Every deck, report, and Snapshot carries them, and every share page credits your firm by name.

Free download

Take the field guide with you.

This page as a designed PDF you can print, forward, or hand to a new advisor: the model, the prospect play, the 90-day method, the daily loop, the four gates, and the deliverables.

  • The same playbook as this page, designed for print and sharing.
  • The plain-English glossary your team will use every week.
  • A first-week checklist that gets a new advisor moving in five steps.

2026 edition.

We use your details only to send the guide and follow up once. No newsletters, no sharing. See our privacy note.

See the whole loop on a live client.

A 30-minute walkthrough with the team that builds and runs ClarityGRC. Bring a prospect in mind and we will map their first 90 days.

Book a demoExplore the platform

Pricing is published. Partner onboarding runs through a short demo, no quote runaround.