CZ Test your AI
Inovai Platformrunning Testing, monitoring and evidence in one placeIt attacks your AI after every change and documents every finding. How the platform tests

AI security

AI inventoryEverywhere AI runs in your company, including the unapproved Chatbot and agent testingModel, widget code and data flow, before deployment and in operation Copilot auditPermissions and data leaks in Microsoft 365 Monitoring and evidenceA new run after every change, a report for the auditor OSINT investigationWhat an attacker finds about you and your people

AI integration

Digital colleagueA chatbot for your website and e-shop, and an in-house colleague on top of data and BI AI workflows and agentsConnections to ERP and CRM, agents that write and send Copilot StudioCustom agents in Microsoft 365 Local modelsData never leaves the company

Document extraction

Invoices and ordersExtraction and export to ERP without retyping Contracts, certificates and delivery notesData and deadlines, 10,000+ certificates at Favex Production ordersFrom email through the order to production documents Checks against rulesERP, standards and contracts, exceptions for approval

BI and data

Power BI and Qlik SenseReporting that management actually opens Data platformFabric, Databricks, data warehouses AI on top of reportsCopilot in Power BI and data agents Forecasts and recommendationsDemand forecasting, recommendations, anomalies

Workshops and analysis

Analysis and solution designWhere AI saves time and money, and how to build it AI for managementWhere AI makes sense and where it doesn’t Secure AI for ITAttacks, defence and evidence in practice AI literacy for teamsSafe use of AI, Article 4 of the AI Act
All areas

When you’re dealing with

We’re launching a chatbot or agentPre-deployment testing, retest and evidence for management We’re rolling out CopilotBefore Copilot finds what it shouldn’t We’re buying AI from a vendorTesting before you sign off acceptance We don’t know where AI is runningAn inventory of deployed and unapproved AI An audit or inspection is comingEvidence for the auditor, Czech National Bank or NÚKIB

Industries

Banks and insurersDORA and Czech National Bank supervision Public sectorChatbots for citizens, Copilot in public offices HealthcareSensitive data and the higher-obligations regime Energy and industryAgents on operational data

Partners

Chatbot vendorsSecurity testing under your brand Integrators and IT vendorsAI testing for your projects Law firmsTechnical partner for the AI Act

Evidence

Favex case studyAI we built: 10,000+ certificates in production Use casesEighteen situations, from chatbots to invoices Czech AI Security IndexHow easily models are bypassed in Czech, in progress

Company

TeamFour people, AI, data and security How we workConnect, attack, verify, document BlogFrom practice, no hype

Infrastructure

Coming soonGPU server in CzechiaLocal models, fine-tuning and attack testing without cloud APIs.What it will run

Inovai / Who it’s for

The auditor will ask about your AI.

An evidence pack: what you run, how you tested it and what you fixed.

Get audit materialMonitoring and evidence
Inovai / monitoring / chatbot-supportruns after every change

Blocked attacks by run

prompt fix, 3 → 0 findingsnew model from the vendor, P1 regressionretest, 0 findings

Evidence for run 9

Inputattack CZ-114
Modelv2.3, prompt #41
Resultblocked 40/40
RegulationDecree 409, AI Act Art. 50
Confirmed bytester, 12:40
Problem

AI is missing from the asset register and there are no records of tests.

What we’ll do

Inventory, tests with records and mapping to regulations.

Result

A pack for the auditor and a quarterly report.

What usually happens without preparation

Three questions from an ISO auditor, a NÚKIB (the Czech cyber security authority) inspection or ČNB supervision that have no answer without preparation.

AI is missing from the asset registerNobody recorded the chatbot and Copilot as technical assets. The auditor asks for the risk assessment and there is nothing to point to.
There was a test, but no evidenceSomeone tried the chatbot, but nothing was written down: when, who, what was found. For an inspection, it is as if no test took place.
Vendor without an assessmentDecrees No. 409 and 410 require you to assess vendors and their products. For the chatbot vendor, the folder holds only an invoice.

How we proceed

From the register to the quarterly report.

Website chatbottest firstCopilotauditInvoice assistantok
Step 1Inventory and registerAI systems and vendors in the asset register, with owner, data and purpose.
Finding confirmed by a humanReproduction attached
Step 2Test with recordsDate, responsible people, model version, every finding with reproduction steps. A tester confirms serious findings.Verified by a human
Report, run 9P1Prompt leakP2AI labellingokInjection in PDF
Step 3Mapping in the reportFindings mapped to Decrees No. 409 and 410, DORA, the AI Act and ISO/IEC 42001, in a report for the auditor.
new model: P1 regression, 0 after the fix
Step 4Monitoring and quarterly reportA new run after every change. A quarterly summary for management and the auditor.

A pack for the auditor: register, test logs with reproduction steps, records of the retest and of briefing management.

FAQ

Monitoring and evidenceAI inventoryBanks and insurers
Can you promise the inspection will go well?

No. Compliance is decided by the auditor or the supervisory authority. We provide evidence that answers their questions and help remove the grounds for objections that can be removed.

Is the material also suitable for the ČNB under DORA?

Yes. DORA requires ICT resilience testing and third-party risk management. A report with reproduction steps and a vendor register are the supporting material; the assessment is up to the supervisor.

The audit is close. Where to start?

With a register and a test of the systems the auditor cares about most: those that talk to clients or have access to sensitive data. We add the rest according to the audit plan.