A useful starting point.
A clear scope.
A free workspace for teams making decisions about AI. Bring a question, structure the work, and take a practical plan into your next discussion.
Who it is for
Risk, compliance, information security, procurement, management and internal audit teams. The workspace supports initial research, workshops, evidence requests and control planning. It is not a system of record for an enterprise assurance program.
Management remains accountable for implementing controls. Internal audit provides independent challenge and tests both design and operating effectiveness.
What you can take away
- A researched briefing with public organization context, jurisdiction considerations, priority actions, audit tests, supplier questions and linked sources, when research is available.
- A 90-day starter control plan with accountable owners and evidence references.
- An Excel-compatible CSV register, a Markdown plan, a downloadable briefing, and a workspace JSON file to resume later.
- An on-demand watchlist for selected official publisher pages.
Research availability depends on the service connection and the free usage allowance. No visitor account or personal API key is required. If research is unavailable, the planner and sources remain accessible.
How dates and source coverage work
Catalog reviewed: . This is the date of the curated catalog review. It changes only after an actual content review.
Source checked is the last successful retrieval by the source monitor. Checks compare page fingerprints and can detect formatting or navigation changes. A changed page is a reason to review the publisher’s material, not a verified amendment to law. Shared results are cached for 30 minutes; comparison history can expire after 30 days. Publisher restrictions may prevent a check. No scheduled alerts are running.
Briefing generated records when a report was completed. Its citations identify public source excerpts retrieved for that request. Retrieval is not a legal review or a guarantee that every interpretation is correct.
The curated catalog covers selected EU, NIST, ISO, OWASP and IIA material. It is not a comprehensive register of national, state, sector or government procurement obligations. AI research can explore additional jurisdictions but cannot establish legal applicability from an organization name or headquarters alone.
Data handling
Use public information only. Do not enter confidential evidence, personal records, credentials, classified information or sensitive government material.
- Manual planning: context selections, owners and evidence notes remain in browser memory. The application does not automatically upload or retain them. Reloading or closing the page clears unsaved work.
- Research: the organization and question are sent to Vercel AI Gateway, an AI model provider and a web search provider. Public research may include the organization name and question context. Evidence notes are excluded. Provider retention and processing terms apply; this public workspace does not promise zero retention or a particular data residency.
- Usage allowance: the server stores a daily pseudonymous network identifier and request counters for up to 48 hours in the quota service. It does not put prompts, briefing text or raw IP addresses in that quota store. Hosting and provider infrastructure may retain separate operational records.
- Downloads: saved files include the data you entered and any completed briefing. They are not encrypted by this application. Store and share them under your organization’s policies. Opening a workspace file validates its format but does not independently verify its contents.
There are no advertising trackers or automatic mailing-list signups in this application. Google Fonts serves the interface fonts and receives a normal font request from your browser. Your organization’s policies may require a separately approved environment for AI use.
What the workspace does not establish
A reported evidence note does not demonstrate that a control is effective. A mapped standard does not make it equivalent to a law. A briefing does not certify compliance, determine legal scope, inspect your internal systems, implement safeguards, or constitute a legal or audit opinion.
Enterprise deployment programs may also need approved identity access, centralized records, retention controls, private data connections and ongoing regulatory review. Those capabilities are outside this free workspace.
Frequently asked questions
Do I need to know which AI regulations apply?
No. Start with your organization or official website and a question. Research can identify relevant public context and possible obligations. Confirm the entity, operating footprint and applicability with the responsible specialists.
Can I use it without AI research?
Yes. The context screen, starter control plan, evidence notes, downloads and official-source watchlist work independently of AI generation.
How do I keep my work?
Select Save workspace to download a JSON file. Use Resume to open it later. The spreadsheet export is suitable for team discussions; the workspace file preserves editable state.
Is the source monitor a regulatory alert service?
No. It checks selected pages when requested. A page change still needs interpretation, and the catalog is not automatically rewritten.