We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
SureCloud logo

SureCloud review

Software product

An AI governance module in SureCloud's risk and compliance software, for recording AI use cases, classifying them under the EU AI Act and tracking AI incidents.

Relevant if you already use SureCloud and want to add EU AI Act risk classification

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

SureCloud scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 3/5
What it publishes about fees 1/5
Knowledge of your sector 3/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 1/5

What SureCloud offers, and what it publishes

SureCloud is software your team configures, not a consultancy, though SureCloud offers implementation support. It keeps a register of AI use cases and models, classifies each against the EU AI Act's risk tiers, and tracks AI incidents until they are closed. It links into SureCloud's existing vendor, risk and control modules.

SureCloud does not publish a price. A quote comes only after contacting sales. Its leadership page shows ISO 27001 and Cyber Essentials badges but no certificate numbers to check them. It does not publish a liability cap, and its service-levels page showed no content when we looked.

The product page claims a 75% cut in AI audit preparation time and a 65% improvement in risk register maintenance, with no stated method. Its AI assistant, Gracie AI, gives compliance, privacy and regulator-style views on assessments. Its leadership page names co-founder Nick Rafferty as chief executive; 2023 press reports named Tom Obermaier as incoming chief executive.

Strengths

  • AI use-case register is explicitly mapped to the EU AI Act risk-classification framework, directly supporting the August 2026 enforcement deadlines
  • Nearly 20-year track record as a GRC platform vendor (founded 2006) with its own ISO 27001 and Cyber Essentials certification disclosed
  • AI Governance module is natively linked to SureCloud's existing vendor, control and risk GRC modules rather than sold as a standalone silo

Things to check

  • Headline performance metrics such as a 75% reduction in AI audit prep time and a 65% improvement in risk register maintenance are presented on the product page without a named methodology, sample size or independent verification.
  • No pricing figures, tiers or indicative costs are published anywhere on the reviewed pages; a quote is only available after contacting sales.
  • Public reporting on SureCloud's CEO is inconsistent: 2023 press coverage named an incoming CEO different from the co-founder currently listed as CEO on the vendor's own leadership page.

Common questions

Does SureCloud publish prices for AI Governance?

No. Its product pages show no prices, tiers or ranges; quotes come through sales.

Is AI Governance a standalone tool?

No. It is a module in SureCloud's wider risk and compliance platform, linked to the vendor, risk and control modules customers already run there.

What certifications does SureCloud show for itself?

It shows ISO 27001 and Cyber Essentials badges on its leadership page, but no certificate numbers.

Evidence for each SureCloud score

Show our working

Notes behind each thing to check

  • Headline performance metrics such as a 75% reduction in AI audit prep time and a 65% improvement in risk register maintenance are presented on the product page without a named methodology, sample size or independent verification. (surecloud.com/product/ai-governance lists these percentage figures as marketing statistics with no citation or methodology note.)
  • No pricing figures, tiers or indicative costs are published anywhere on the reviewed pages; a quote is only available after contacting sales. (surecloud.com/product/ai-governance and related pages show no price list, only contact and demo call-to-actions.)
  • Public reporting on SureCloud's CEO is inconsistent: 2023 press coverage named an incoming CEO different from the co-founder currently listed as CEO on the vendor's own leadership page. (Third-party press (Corporate Compliance Insights, IT Europa, 2023) reported Tom Obermaier as incoming CEO, while surecloud.com/company/leadership currently lists co-founder Nick Rafferty as CEO.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 The product page documents an AI incident-management workflow where every incident is recorded, tracked to resolution and closed, and links EU AI Act risk classification to the wider GRC evidence base, though it does not detail a dedicated regulator-facing export format.
Qualifications of the people who do the work 3/5 The vendor's own leadership page names a full C-suite (CEO Nick Rafferty, CFO/COO Charles Ryan, Chief Product Officer Matthew Davies and others) and displays ISO 27001 and Cyber Essentials badges, but no certificate registry number accompanies the badges for independent lookup.
What it publishes about fees 1/5 No pricing figures, ranges or tiers are published on the product or platform pages reviewed.
Knowledge of your sector 3/5 General GRC and EU AI Act framing applies across sectors; content references cyber-intensive organisations broadly rather than naming distinct vertical modules specific to the AI Governance product.
Independence from what it sells 2/5 ISO 27001 and Cyber Essentials are independently certified, but the AI Governance product's own headline efficacy statistics are self-reported marketing claims without a named independent auditor.
Who carries the risk if the advice is wrong 1/5 A dedicated service-levels page exists on the site but returned no accessible SLA content during review, and no liability cap or indemnification terms were found published elsewhere.

Sources for SureCloud

  • SureCloud Limited is registered with Companies House and shown as an active company. (Company no. 05703655; incorporated 9 February 2006; status: Active) (Companies House, checked 17 July 2026)
  • The AI Governance product provides an AI use-case and model register classified against the EU AI Act risk framework, risk assessment, AI incident management, and an AI assistant ('Gracie AI') offering compliance, privacy and regulator-style perspectives, integrated with SureCloud's wider GRC modules. (Product scope confirmed on vendor site) (surecloud.com, checked 17 July 2026)
  • No pricing figures are published on the AI Governance or platform pages reviewed; SureCloud's model is quote-based via sales contact rather than a public price list. (Pricing disclosure: gated / quote-based) (surecloud.com, checked 17 July 2026)
  • SureCloud publicly discloses ISO 27001 and Cyber Essentials certification badges on its leadership/company page; no UK-government-specific AI engagement (e.g. AI Safety Institute, FCA sandbox, gov.uk AI Assurance directory) was found published. (ISO 27001 and Cyber Essentials disclosed; no gov.uk AI Assurance listing found) (surecloud.com, checked 17 July 2026)

ISO 27001 Cyber Essentials

Exposed to the EU AI ActSeeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.