Questions people actually ask
Including the ones with awkward answers. There are 65 controls in the app and none of them is "manage the customer's expectations".
Does this make us compliant with the EU AI Act or ISO/IEC 42001?
No, and nothing it produces says otherwise. It makes you ready: it organises what the law asks of each system, tracks where you stand against the standard's controls, and produces the documents an assessor asks for. Certification is done by a certification body, and legal conclusions are for your counsel. Every generated document carries a line saying so.
Do we need Jira Service Management, or will Jira Software do?
Jira Service Management. The app is licensed per JSM agent through the Atlassian Marketplace, and the access model uses JSM's project administration.
Where is our data?
In Forge storage, inside your own Atlassian tenancy. There is no database of ours, no third-party service, and the app's manifest declares no external permissions at all — which Forge itself enforces. A consequence worth knowing: we cannot see your data, including for support.
Can we upload our policies and evidence documents?
No, deliberately. An evidence record holds a title, an owner, a review date, a description and a link to where the artefact already lives. Your documents stay in Confluence or wherever you keep them, with the permissions and retention they already have. An app that held them would take on retention, deletion and export obligations that a link does not.
Who can see it once it is installed?
Jira administrators, and anyone a project administrator has granted access to — at Contribute or Read only. Everyone else sees an explanation of how to ask, and no AIMS content at all. See the roles page for the full model, including the trust boundary it implies.
Can we give an external auditor access?
Yes — Read only. They see the register, every control and its history, the evidence, the documents and the full audit trail, and can change none of it. That is usually better than sending a pack, because they can follow a control to its evidence themselves.
How long does it take to get useful?
About fifteen minutes to install and grant access. An hour or two to build the register and classify what is on it — and that alone answers most customer security questionnaires. The 65 controls are months of real work, but you get a true readiness figure from the first pass.
What happens if our licence lapses?
Your data is untouched and still readable. Nothing is deleted and nothing is hidden. An administrator restores access from Manage apps in Jira.
Is the ISO 42001 standard included?
No. The app carries paraphrased control titles and descriptions written for working use, each citing its clause number. Reproducing the standard's text would breach its licence. You will need your own copy of ISO/IEC 42001 to be certified against it.
Can we customise the controls or add our own?
Not today. The catalogue is the same 65 controls for everyone, which is what makes a fresh install complete on day one and keeps every customer on the same version. If you need your own control set, tell us — it is a real request and we would rather hear it than guess.
Does it integrate with our issue tracker, or create Jira issues?
It creates nothing in Jira. The register, controls and evidence are the app's own records, not issues — which is what makes the audit trail complete, since an issue can be bulk-edited by anyone with the project permission. The app requests no write scope on Jira at all.
What does it cost?
Per agent, through the Atlassian Marketplace, on your existing Atlassian bill. There are no tiers and no feature gates. The pricing page explains the model; the number is on the listing, which is not published yet.
Can we export our data?
The generated documents are your export today — print or save them as PDFs, and every version is kept. A structured export is a fair thing to want; ask us and it will weigh on what gets built next.
Who is behind it?
ITSM Ltd. Email support@itsm-ltd.com — a person answers.
Still have a question?
Ask it. We would rather answer than have you guess.
The Marketplace listing is not published yet, so there is nothing to link to. Email us and we will tell you the day there is.