CZ Test your AI
Inovai Platformrunning Testing, monitoring and evidence in one placeIt attacks your AI after every change and documents every finding. How the platform tests

AI security

AI inventoryEverywhere AI runs in your company, including the unapproved Chatbot and agent testingModel, widget code and data flow, before deployment and in operation Copilot auditPermissions and data leaks in Microsoft 365 Monitoring and evidenceA new run after every change, a report for the auditor OSINT investigationWhat an attacker finds about you and your people

AI integration

Digital colleagueA chatbot for your website and e-shop, and an in-house colleague on top of data and BI AI workflows and agentsConnections to ERP and CRM, agents that write and send Copilot StudioCustom agents in Microsoft 365 Local modelsData never leaves the company

Document extraction

Invoices and ordersExtraction and export to ERP without retyping Contracts, certificates and delivery notesData and deadlines, 10,000+ certificates at Favex Production ordersFrom email through the order to production documents Checks against rulesERP, standards and contracts, exceptions for approval

BI and data

Power BI and Qlik SenseReporting that management actually opens Data platformFabric, Databricks, data warehouses AI on top of reportsCopilot in Power BI and data agents Forecasts and recommendationsDemand forecasting, recommendations, anomalies

Workshops and analysis

Analysis and solution designWhere AI saves time and money, and how to build it AI for managementWhere AI makes sense and where it doesn’t Secure AI for ITAttacks, defence and evidence in practice AI literacy for teamsSafe use of AI, Article 4 of the AI Act
All areas

When you’re dealing with

We’re launching a chatbot or agentPre-deployment testing, retest and evidence for management We’re rolling out CopilotBefore Copilot finds what it shouldn’t We’re buying AI from a vendorTesting before you sign off acceptance We don’t know where AI is runningAn inventory of deployed and unapproved AI An audit or inspection is comingEvidence for the auditor, Czech National Bank or NÚKIB

Industries

Banks and insurersDORA and Czech National Bank supervision Public sectorChatbots for citizens, Copilot in public offices HealthcareSensitive data and the higher-obligations regime Energy and industryAgents on operational data

Partners

Chatbot vendorsSecurity testing under your brand Integrators and IT vendorsAI testing for your projects Law firmsTechnical partner for the AI Act

Evidence

Favex case studyAI we built: 10,000+ certificates in production Use casesEighteen situations, from chatbots to invoices Czech AI Security IndexHow easily models are bypassed in Czech, in progress

Company

TeamFour people, AI, data and security How we workConnect, attack, verify, document BlogFrom practice, no hype

Infrastructure

Coming soonGPU server in CzechiaLocal models, fine-tuning and attack testing without cloud APIs.What it will run

Inovai / Who it’s for

Who in the company uses which AI?

The inventory shows what you have, who owns it and what to test first.

Request an AI inventoryAI inventory
Inovai / AI inventory / register5 found, 2 unapproved
SystemOwnerDataStatus
Website chatbotvendorpublictest first
Microsoft 365 CopilotITinternalaudit
Public assistant in the browsersales, 14 peoplecontractsunapproved
Email translatorHRpersonal dataunapproved
Invoice assistantfinanceinternalapproved
Problem

Approved Copilot, a vendor’s chatbot and tools IT doesn’t know about.

What we’ll do

Inventory, AI register and rules for people.

Result

You know what you have, who owns it and what to test first.

What usually happens without an inventory

AI is spreading faster than anyone can keep track of it.

Company data in third-party toolsPeople paste contracts, code and personal data into public assistants because the company didn’t offer one. Nobody knows how much has leaked.
AI in the tools you already haveYour CRM, helpdesk or accounting system switched on AI features in an update. They process your data but aren’t on any list.
The auditor asks for the register firstDecrees No. 409 and 410 require an inventory of assets and suppliers, the AI Act requires employee AI literacy. Without an overview, you can’t demonstrate either.

How we proceed

From overview to priorities and the first test.

MmanagersITITFfinance
Step 1AI inventoryA questionnaire for managers, an export from identity and logs, a check of AI features in SaaS.
Website chatbottest firstCopilotauditInvoice assistantok
Step 2Register and risk rankingEvery system with its owner, data and vendor, ranked by risk.
deviation
Step 3Rules and a workshop for peopleAn employee policy and a workshop for managers as evidence for Article 4 of the AI Act.
Finding confirmed by a humanReproduction attached
Step 4Testing what comes firstWe test the systems at the top of the list with the platform, a tester confirms serious findings, then monitoring follows.Verified by a human

From you we need an hour with team leads and a summary export from identity and logs. The register feeds into the asset inventory under Czech Decrees No. 409/2025 and 410/2025; whether it is sufficient is for the auditor to judge.

FAQ

AI inventoryCopilot auditAn audit or inspection is coming
Won’t the inventory feel like a witch hunt?

No. We look at tools and data flows, not names, and the result is a safe approved alternative, not a ban.

How much is likely running here?

Usually more than you expect: public assistants in the browser, translators in email and AI features switched on in a CRM or helpdesk update. Only the inventory gives the exact number for your company.

Is doing the register once enough?

The register is a living document. We set up who updates it when a new tool is bought, and we review it with you at every subsequent test.