Start free

    Build and run your ISO 27001 management system with your AI agent.

    An ISMS is the policies, responsibilities, checks and records you use to manage information security.

    Your agent writes each policy and record with the licensed requirement in front of it, as plain files in your own repository. Your team decides and approves. You keep the ISMS if you leave.

    Comfortable with GitHub and an AI coding agent? Run it with your team. Not yet? We build it with you.

    We run Ansvar's own ISMS this way, and BSI audited it.

    ISO/IEC 27001:2022 audit passedBSI certification audit, November 2026. Certificate to follow; audit report under NDA on request.

    €590 per company a month, 12-month term, billed monthly (€7,080 a year). Includes the Premium plan, one named ISMS owner and one agent credential.

    Read how we did it

    You bring an AI coding agent (Claude Code, Codex, Copilot or Cursor) and a GitHub organisation. AI usage is billed by your AI provider.

    ISMS boardThis month
    • DueSupplier review due
    • CheckEvidence to confirm
    • ReadyPolicy update ready for review

      Agent prepared thisA pull request with the policy text and the risk change.

      You decide thisApprove the proposed change or send it back.

    • DecideManagement decision needed
    Example: one month on the board your agent keeps. The agent prepares each item; a person decides it.

    How it works.

    1. 1

      Connect.

      We help you connect your agent to Ansvar and to a private repository made from our template.

    2. 2

      Build.

      Your agent works through scope, risks, controls, policies and evidence with you, asking what an auditor would ask.

    3. 3

      Approve.

      Each change arrives as a pull request. The responsible person reviews it and approves it in GitHub. If your team works in tickets, the agent opens tickets for the people who need to act.

      ApprovedProposed by your agent

      Include A.8.23 Web filtering at browser level

      Requirement A.8.23 · SS-EN ISO/IEC 27002:2022 · cited part

      Files changed

      • soa.yaml
      • endpoint-attestations.yaml
      • decisions/2026-10-23-a823.md
      ISMS Manager · Approved
      A pull request is a proposed change submitted for review. In this example, your agent opened it and your ISMS Manager approved it.
    4. 4

      Audit.

      Prepare an auditor view from an approved version of your ISMS, and share the supporting records through your audit process.

    You choose what the agent sees: live configuration through connectors you approve, or files and screenshots you upload.

    Step 3 · Approve

    ApprovedProposed by your agent

    Include A.8.23 Web filtering at browser level

    Requirement A.8.23 · SS-EN ISO/IEC 27002:2022 · cited part

    Files changed

    • soa.yaml
    • endpoint-attestations.yaml
    • decisions/2026-10-23-a823.md
    ISMS Manager · Approved
    A pull request is a proposed change submitted for review. In this example, your agent opened it and your ISMS Manager approved it.

    What happens next month.

    • A supplier review falls due.

      The agent prepares the review record from your supplier register and the documents you give it.

      A person decides keep the supplier, change the terms, or end it.

    • Evidence needs refreshing.

      The agent prepares the list of controls whose newest evidence is older than a year, and what to collect.

      A person decides who collects it, or whether to accept the gap as a risk.

      Using Ansvar, list the controls whose newest evidence is older than a year.

    • A policy changes after a business change.

      The agent prepares a pull request with the policy and risk changes, for example after a new cloud service.

      A person decides approve the change or send it back.

    • Management review input.

      The agent prepares the input for the review, drawn from your registers and records.

      A person decides the review's decisions, recorded in your repository.

      Using Ansvar, draft the input for the next management review.

    An open ship's log handwritten in ink: ruled columns on the left page, dated remarks on the right.
    The log of HMS Dolphin, January 1765 · Photo: PRO ADM 51/4536 · Public domain

    Written in the standard's own terms.

    Your agent reads the requirement it is working on, one cited part at a time, and writes your policy or record with it in front of it. Your repository keeps the requirement id and your own words. Our auditor could trace our records back to the requirements.

    Requirement
    A.8.23
    Policy
    policies/endpoint-security.md
    Record
    endpoint-attestations.yaml
    Owner
    ISMS Manager
    Approval history
    decisions/2026-10-23-a823.md · approved
    Example auditor view: one requirement, traced to the policy, the record, the owner and the approval.

    Licensed from SIS. Through the Ansvar service, logged-in users and their agents receive selected parts of SS-EN ISO/IEC 27001:2023 and SS-EN ISO/IEC 27002:2022, under licence from SIS, the Swedish Institute for Standards. Access is licensed per named person or agent. SIS sells the complete standards at sis.se.

    One requirement, from Stage 1 to Stage 2.

    How A.8.23 changed in our own ISMS. The Statement of Applicability is the list of controls you apply or exclude, with the reason for each.

    Our own trace for A.8.23, from the requirement to the record an auditor samples. The auditor view above names the files.

    What you get, and what you keep.

    Included

    A repository template built from the management system BSI audited at Ansvar

    Agent skills for the build-out and the yearly cycle: internal audit, management review, risk and supplier reviews

    Selected parts of SS-EN ISO/IEC 27001:2023 and SS-EN ISO/IEC 27002:2022 for your named ISMS owner and one agent credential

    The Ansvar Premium plan: cited law for your legal register with case law, preparatory works and agency guidance, regulatory deadlines, threat and vulnerability data

    Ansvar guidance for every Annex A control

    Yours to keep

    Your repository, records and documents

    The template under Apache-2.0, the forms under a licence that lets you keep using them in your own ISMS

    If you leave, access to the standard parts, Ansvar guidance and lookups ends. You keep running your ISMS and buy the standard from SIS directly.

    Two ways to start.

    Run it with your team.

    Your agent builds and runs the ISMS with you. We help you connect, and hold one working session of up to two hours.

    €590 per company a month, 12-month term, billed monthly (€7,080 a year).

    One company and one ISMS scope. Includes the Premium plan, one named ISMS owner and one agent credential, both with selected parts of SS-EN ISO/IEC 27001:2023 and SS-EN ISO/IEC 27002:2022. People who only review and approve in GitHub need no Ansvar seat.

    Each extra person or agent that uses Ansvar or receives standard text: €179 a month.

    Optional: Guided setup, €2,500 once. A scope workshop, repository setup, the first changes merged, and training for your ISMS owner.

    Full service: we get you certification-ready.

    Our team and our agents build your ISMS with you, from scope to the evidence an auditor samples, and prepare you for your Stage 1 and Stage 2 audits. Afterwards you run it yourself with the Agentic ISMS, or keep us on.

    1. Where you are With Ansvar

      We read what you already have in place. This sets the price.

    2. Build With Ansvar

      Our team and agents build scope, risks, controls, policies and evidence with you.

    3. Stage 1 With Ansvar

      Documentation review.

    4. Stage 2 With Ansvar

      The auditor samples your records.

    5. Afterwards Your choice

      Run it with your team, or keep us on.

    Who builds it with you

    Our team holds the ISO/IEC 27001:2022 Lead Auditor and Lead Implementer certifications, and CISSP, CCSP, CISM, CISA, CRISC and OSCP. We built and run the management system BSI audited.

    Priced on your company's maturity: what you already have in place, your size and your scope.

    Certification-body fees are separate. The certification decision is your certification body's. Consultants are priced per client ISMS. The ISMS skills run in your own agent and do not use the Premium plan's assessment runs.

    See the ISMS BSI audited.

    We show you our own management system and set yours up from the same template.