CZ Test your AI
Inovai Platformrunning Testing, monitoring and evidence in one placeIt attacks your AI after every change and documents every finding. How the platform tests

AI security

AI inventoryEverywhere AI runs in your company, including the unapproved Chatbot and agent testingModel, widget code and data flow, before deployment and in operation Copilot auditPermissions and data leaks in Microsoft 365 Monitoring and evidenceA new run after every change, a report for the auditor OSINT investigationWhat an attacker finds about you and your people

AI integration

Digital colleagueA chatbot for your website and e-shop, and an in-house colleague on top of data and BI AI workflows and agentsConnections to ERP and CRM, agents that write and send Copilot StudioCustom agents in Microsoft 365 Local modelsData never leaves the company

Document extraction

Invoices and ordersExtraction and export to ERP without retyping Contracts, certificates and delivery notesData and deadlines, 10,000+ certificates at Favex Production ordersFrom email through the order to production documents Checks against rulesERP, standards and contracts, exceptions for approval

BI and data

Power BI and Qlik SenseReporting that management actually opens Data platformFabric, Databricks, data warehouses AI on top of reportsCopilot in Power BI and data agents Forecasts and recommendationsDemand forecasting, recommendations, anomalies

Workshops and analysis

Analysis and solution designWhere AI saves time and money, and how to build it AI for managementWhere AI makes sense and where it doesn’t Secure AI for ITAttacks, defence and evidence in practice AI literacy for teamsSafe use of AI, Article 4 of the AI Act
All areas

When you’re dealing with

We’re launching a chatbot or agentPre-deployment testing, retest and evidence for management We’re rolling out CopilotBefore Copilot finds what it shouldn’t We’re buying AI from a vendorTesting before you sign off acceptance We don’t know where AI is runningAn inventory of deployed and unapproved AI An audit or inspection is comingEvidence for the auditor, Czech National Bank or NÚKIB

Industries

Banks and insurersDORA and Czech National Bank supervision Public sectorChatbots for citizens, Copilot in public offices HealthcareSensitive data and the higher-obligations regime Energy and industryAgents on operational data

Partners

Chatbot vendorsSecurity testing under your brand Integrators and IT vendorsAI testing for your projects Law firmsTechnical partner for the AI Act

Evidence

Favex case studyAI we built: 10,000+ certificates in production Use casesEighteen situations, from chatbots to invoices Czech AI Security IndexHow easily models are bypassed in Czech, in progress

Company

TeamFour people, AI, data and security How we workConnect, attack, verify, document BlogFrom practice, no hype

Infrastructure

Coming soonGPU server in CzechiaLocal models, fine-tuning and attack testing without cloud APIs.What it will run

Inovai / AI security

How much AI is really running in your company?

We find approved and unapproved AI, who owns it and what to test first.

Request an AI inventoryHow the platform tests
Inovai / AI inventory / register5 found, 2 unapproved
SystemOwnerDataStatus
Website chatbotvendorpublictest first
Microsoft 365 CopilotITinternalaudit
Public assistant in the browsersales, 14 peoplecontractsunapproved
Email translatorHRpersonal dataunapproved
Invoice assistantfinanceinternalapproved
Problem

People paste contracts into tools IT doesn’t know about.

What we’ll do

We combine interviews, aggregate logs and an anonymous questionnaire into a register.

Result

An AI register with owners and a priority list of what to test first.

What you get

Register, data map and testing priority list. Material for management and the auditor.

AI registerAll tools found, with owner, data and vendor. In a format you can enter into your asset overview.
Data mapWhere data leaves the company and on what terms: a contract with the vendor, consumer terms, or nothing.
Risks and test planWhich tools can do harm first: AI with personal data, contracts or the right to take actions. We test those straight away.

How we proceed

Three sources, one register. A human is involved from the first step.

MmanagersITITFfinance
Step 1InterviewsShort talks with team leads and IT: what they use and what they have ordered.Verified by a human
Step 2Proxy and logsFrom the proxy, DNS and Microsoft 365 we read where requests go. Totals only.
TranslatorI use itPublic assistantI use itOther toolanonymous
Step 3QuestionnaireAnonymous, for employees: which tools they use and what for. Rules, not penalties.
Website chatbottest firstCopilotauditInvoice assistantok
Step 4AI registerTool, owner, data, vendor, approval, risk. Based on it, we agree what to test first.

We read logs only in aggregate and only with management’s consent, we do not read the content of employees’ conversations. From you we need aggregate logs from the proxy or Microsoft 365 and a short talk with each team lead.

Start with an inventory of one department.

AI register and a testing priority list. All it takes is a talk with the team lead and aggregate logs.

Request an inventory

FAQ

We don’t know where AI is runningChatbot and agent testingMonitoring and evidence
Won’t employees see this as surveillance?

The questionnaire is anonymous and we read logs only as totals per service, not per person. We recommend that management announces the inventory, stating that the outcome is rules, not penalties.

How does this relate to the Czech Cybersecurity Act (Act No. 264/2025 Coll.)?

From the perspective of Czech Decrees No. 409/2025 and 410/2025, an AI tool is an asset and its provider is a supplier. The AI register is the basis for the asset overview, supplier assessment and deciding what to test.

Is a one-off inventory enough?

Once is a start, but new tools appear every month. That is why we maintain the register as part of the Monitoring and evidence service, and new entries show up in the next quarterly report.