Try it on your own organization
Fifteen days with all four modules open: AI Governance — the AI tools your team uses, the policies staff sign, and the board report; Enterprise Risk — the risks you’re watching, scored plainly; IT — devices, software, systems, and who has access; Data Management — what you hold, where it flows, and how long you keep it. Privacy — what you owe the people your data is about — is open too: the Privacy Program and privacy impact assessments. The Privacy Policy generator unlocks when you subscribe. No credit card, and nothing to cancel: on day 15 your workspace goes read-only until you pick a plan, and nothing is deleted.
Request your free trial
- 1Ask belowTell us who you are and about your organization. It takes about a minute.
- 2We reach outSomeone from our team replies by email, usually within one business day, to make sure the trial suits what you need.
- 3Use your code on StarterWe send you a promotion code. Choose the Starter plan and enter it at checkout. The total is $0 and no card is asked for. Stripe shows next year’s price as standard, but we cancel that subscription as soon as you finish, so it never bills.
- 4Fifteen days on your own organizationYour workspace opens with every module. On day 15 it goes read-only until you pick a plan, and nothing is deleted.
What you’re actually trying
GOVERNBOX is one place that keeps track of how your organization uses AI — and, if you want, your wider risks, technology, data, and privacy duties too. It holds the list of AI tools your team uses (each with a named owner), the policies your staff actually sign, the risks you’re watching, and the report your board reads each quarter.
Every policy it writes cites a real control from an expert-written library — nothing is invented — and nothing counts until you’ve reviewed and approved it. During the trial the policy generators stay in preview — creating and approving policies unlocks with a paid plan — but everything else is the real system on your own organization, not a demo with fake data: your tools, your risks, your board report.
Why organizations need this now
Your team is already using AI
ChatGPT and tools like it are already inside your organization, whether or not anyone approved them. The first question boards, funders, and insurers ask is “who’s keeping track?” — and for most organizations the honest answer today is nobody.
The rules now have dates
State AI laws in Colorado and California take effect January 1, 2027, Texas is already live, and the EU’s AI Act is in force. GOVERNBOX covers those individually — alongside U.S. federal law, the UK, Canada and 26 countries in total — so you pick the ones you operate under. They expect plain-language notice, human review, and records — things you can’t produce the week someone asks for them.
Proof beats promises
When a funder’s questionnaire or a board member asks “who owns this tool, what data does it touch, and what happens when it fails,” you open a page instead of scheduling a meeting.
Four people are about to ask you the same question
Not eventually — on a schedule someone else set. Here is who asks, what they ask, and the five things you need to be able to answer.
“What's our AI policy?”
Usually followed, one meeting later, by “and how do we know it's working?” The second question is the hard one.
“How are you handling AI?”
Increasingly a line item in grant applications and renewal packets. A live trust page answers it without a scramble.
“Complete this AI questionnaire.”
Security reviews now carry AI sections. The answers come straight out of your inventory and crosswalk.
“Show your assessment.”
State and international AI rules are arriving on a schedule. Where they apply, they ask for records you either have or don't.
- What AI are we using?
Every tool, who owns it, and what data goes into it. Most organizations cannot answer this on the day they're asked.
- What are people allowed to do with it?
A written policy and a practical standard, both short enough that staff will actually read them.
- What could go wrong, and who's watching?
A named owner per risk, a sense of how likely and how bad, and a date you'll look again.
- Does everyone know the rules?
Training, then a dated signature per person. Unsigned staff are the gap auditors find first.
- Can you prove all of the above?
Dated records, a report each quarter, and a page you can send to anyone who asks. This is the part a template can't do.
What we’re not claiming
Most of these rules are new, and plenty may not apply to you. We'll tell you which ones do.
It doesn't. It gives you a defensible starting point and the records to back it up. You review and approve everything.
The first package takes about an hour. Running the program is a rhythm, not an event, and that's the point.
This is the short version. Read the full 2026 executive briefing — the deadlines, the numbers and every primary source, last verified by a human on July 29, 2026.
The laws, everywhere you operate
AI law stopped being one deadline in one state. GOVERNBOX cites specific statutes from 27 U.S. states, covers 43 state AI laws across 38 states with dedicated frameworks and crosswalks, and reaches U.S. federal law, the EU, Italy, the UK, Switzerland and Norway, Canada, the standards bodies and 26 countries in total — as selectable frameworks, not as a blog post. Pick the ones you operate under and every policy, crosswalk and gap report is generated and checked against exactly those.
38 states go further, with 43 state AI-law frameworks of their own — own controls, own crosswalk report. New states are added as they pass.
National AI law and guidance, plus the EU as a bloc and the international instruments.
Selectable per organization — your documents are generated and checked against the ones you pick.
Expert-written, versioned, and cited by ID in every clause we generate. Nothing is invented.
U.S. state AI law coverage
The library cites specific statutes from 27 states in its state law landscape controls, and 38 states have 43 AI-law frameworks of their own, each with its own controls and crosswalk report. The rest are reached through the U.S. state law landscape framework, which tracks disclosure, chatbot, biometric, deepfake, health, insurance and employment-AI statutes as they pass — so a new law does not mean a new setting for you.
- Colorado — Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Colorado AI laws (other statutes)
- Connecticut — Connecticut SB 5 (PA 26-15) · Connecticut AI laws (other statutes)
- Texas — Texas TRAIGA · Texas AI laws (other statutes)
- California — California ADMT Regulations · California AI laws (other statutes)
- Hawaii — Hawaii AI Acts (247 / 248)
- Alabama — Alabama AI laws
- Arizona — Arizona AI laws
- Delaware — Delaware AI laws
- Florida — Florida AI laws
- Georgia — Georgia AI laws
- Idaho — Idaho AI laws
- Illinois — Illinois AI law & guidance
- Indiana — Indiana AI laws
- Iowa — Iowa AI laws
- Kansas — Kansas AI laws
- Kentucky — Kentucky AI laws
- Louisiana — Louisiana AI laws
- Maine — Maine AI laws
- Maryland — Maryland AI laws
- Minnesota — Minnesota AI laws
- Montana — Montana AI laws
- Nebraska — Nebraska AI laws
- Nevada — Nevada AI laws
- New Hampshire — New Hampshire AI laws
- New Jersey — New Jersey AI laws
- New York — New York AI laws
- North Dakota — North Dakota AI laws
- Oklahoma — Oklahoma AI laws
- Oregon — Oregon AI laws
- Rhode Island — Rhode Island AI laws
- South Carolina — South Carolina AI laws
- Tennessee — Tennessee AI laws
- Utah — Utah AI laws
- Vermont — Vermont AI laws
- Virginia — Virginia AI laws
- Washington — Washington AI laws
- Wisconsin — Wisconsin AI laws
- Wyoming — Wyoming AI laws
Includes California's ADMT regulations and a pack of AI laws for each of 37 states (Illinois's covers the AI Safety Measures Act plus its employment, deepfake and mental-health AI laws). The CCPA privacy statute is a separate framework (Pro on the US plans; Agency elsewhere). All 51 jurisdictions shown are reachable through the U.S. state law landscape framework; 27 have their own statutes cited in it, and 38 have dedicated controls and a coverage report of their own. This map describes what GOVERNBOX covers — it is not a survey of which states have passed AI legislation, and it is not legal advice.
- U.S. State AI LawsAgency / Enterprise
Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws
- United States — federal law & state landscapeAgency / Enterprise
Federal legislation, executive orders and agency regulation, a cross-state view of AI disclosure and training-data laws. Per-state statutes — Illinois included — are the U.S. State AI Laws jurisdiction above.
- CanadaStarter+
PIPEDA and provincial privacy law, the Directive on Automated Decision-Making, and the Canadian Human Rights Act as they apply to AI.
- AI frameworks, standards & healthcare guidelinesPro+
NIST profiles, ISO/IEC standards, IEEE, OECD and the healthcare AI reporting/assurance frameworks (FDA, WHO, CHAI, CONSORT-AI…).
- Europe — EU regulation, Italy, UK, Switzerland, NorwayPro+United Kingdom AI law & guidance from Starter+
EU regulation beyond the AI Act itself (GPAI code of practice, guidance), plus Italy's national AI law and the UK, Swiss and Norwegian frameworks. The EU AI Act and GDPR are not part of this unit — select each on its own under Laws & regulations below.
- Global — Americas, Middle East, Asia-Pacific, Central Asia & internationalAgency / Enterprise
Twenty further countries' AI laws and guidance plus the international instruments (Council of Europe, OECD, UNESCO, UN).
The EU AI Act, GDPR, HIPAA, CCPA, NIST AI RMF, ISO/IEC 42001 and 42005 and SOC 2 are chosen individually alongside these. See coverage by plan for exactly what each plan can select. GOVERNBOX gives you a defensible starting point that you review and approve — it is not legal advice.
What most people get done
The first hour
Your organization profile, your readiness score, and a preview of the AI use policy you'd approve on a paid plan — the generators themselves stay locked during the trial.
The list and the risks
Add the AI tools your team uses, assign owners, and score the handful of risks that matter. This is the part boards ask about.
Something to show
Generate the board report and see your maturity score with your own data in it — the thing you walk into the next board meeting holding.
Scorecard, trial, or plan — which is which
Five minutes, no sign-up: your maturity score, your gaps ranked, and a NIST AI RMF preview.
Take the scorecardEvery module open, so you can build the real thing on your own organization. No credit card.
Request the trial ↓Unlimited records, exports, the trust page, and the framework maps your sector needs.
See the plansBefore you request it
It stays in your account. If you subscribe later, you pick up where you left off rather than starting again.
Your workspace goes read-only until you pick a plan. There is no card on file, nothing to cancel, and nothing is deleted.
No. The questions are about your organization, not about models or code.
Yes. Seats depend on the plan you choose afterwards, and staff signatures are unlimited on paid plans.
No — every policy and document generator is visible in preview, but creating and approving policies unlocks with a paid plan, along with the framework crosswalks and staff attestations. Everything you do build during the trial carries over.
Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.
Fifteen days is enough to know
Build the real package on your own organization and decide from there.
Request the 15-day trial ↑GOVERNBOX.ai gives you a defensible starting point that you review and approve. It is not legal or compliance advice, and we don’t promise audit outcomes.