UK AI law watch
UKAutomated decisions about people run on a rewritten rule since 5 February 2026 — UK GDPR Articles 22A to 22DUKThe ICO now has a statutory duty to write an AI and automated-decision code — regulations in force 12 May 2026UKThere is no UK AI Act — the Lords' AI (Regulation) Bill is a private member's bill, not lawUKA subject access request has one calendar month, not 30 days — and a tool that screens people unlawfully breaches the Equality Act whoever built itEUSelling into the EU? The AI Act's high-risk duties now apply from 2 December 2027
Build your plan
Start with AI Governance. Add what you need.
Every plan is built on the AI Governance module. Your tier sets the depth, and you switch on the management modules — Risk, IT, Data — as you need them. Flat pricing per tier, never per seat.
One flat price for your organization · never per seat · 20% off for nonprofits
Starter
For the org standing up its first AI governance program
$3,500/yr
≈ £2,590
billed annually, or $339 (≈ £251)/mo billed monthly
🏛️ Nonprofit: $2,800 (≈ £2,070)/yr
AI Governance plus one management module — a real program in place.
- ✓ Frameworks and laws: NIST AI RMF · ISO/IEC 42001 · United Kingdom AI law & guidance · Canada
- ✓ Grounded policy generation — every clause cites a control
- ✓ Risk register, impact assessments, incident log
- ✓ Privacy program, privacy impact assessments and a Privacy Policy
- ✓ Vendor and AI System registries — approval status, terms on file
- ✓ Shadow AI Discovery
- ✓ Approval gate for use cases; staff AI-tool reporting link
- ✓ Cost tracking with 60-day renewal alerts
- ✓ Board report, governance badge, Trust Page
- ✓ Unlimited staff participants and attestations
- ✓ AI Training & Certification — all 7 AI Leadership Course credentials
- ✓ REST API (read)
- ✓ Pay by card or ACH bank transfer
- ✓ 10 admin seats
ProMost popular
For growing programs with privacy obligations
$12,000/yr
≈ £8,870
billed annually — equates to $1,000 (≈ £739) per month
🏛️ Nonprofit: $9,600 (≈ £7,100)/yr
- ✓ Everything in Starter, plus:
- ✓ ISO/IEC 42005
- ✓ AI frameworks, standards & healthcare guidelines
- ✓ EU AI Act
- ✓ European Union AI law & guidance
- ✓ Italy AI law & guidance
- ✓ GDPR
- ✓ Global privacy laws
- ✓ Switzerland AI law & guidance
- ✓ Norway AI law & guidance
- ✓ NIST SP 800-53 Rev. 5
- ✓ NIST Cybersecurity Framework (CSF) 2.0
- ✓ Risk heat map
- ✓ Assessments auto-populate the risk register
- ✓ AI Strategic Plan and CAIO wizards
- ✓ GDPR privacy paperwork — processor agreements, notices and consent, privacy requests
- ✓ Branded document exports
- ✓ Shadow AI Discovery+
- ✓ Vendor questionnaires answered through a private vendor portal
- ✓ REST API (read + write) and signed outbound webhooks
- ✓ AI Agent Analysis
- ✓ Pay by card or ACH bank transfer
- ✓ 15 admin seats
Agency / Enterprise
For public agencies and regulated organizations
$25,000/yr
≈ £18,480
starting at, billed annually — always all four core modules + full Privacy
🏛️ Nonprofit: $20,000 (≈ £14,780)/yr
Buy the plan online, or get a written quote for a custom setup.
- ✓ Everything in Pro, plus:
- ✓ Every U.S. state law, added as they pass States covered todayAlabama · Arizona · California · Colorado · Connecticut · Delaware · Florida · Georgia · Hawaii · Idaho · Illinois · Indiana · Iowa · Kansas · Kentucky · Louisiana · Maine · Maryland · Minnesota · Montana · Nebraska · Nevada · New Hampshire · New Jersey · New York · North Dakota · Oklahoma · Oregon · Rhode Island · South Carolina · Tennessee · Texas · Utah · Vermont · Virginia · Washington · Wisconsin · Wyoming
- ✓ United States — federal law & state landscape
- ✓ CCPA
- ✓ U.S. state privacy laws
- ✓ SOC 2 (Trust Services Criteria)
- ✓ New York DFS cybersecurity regulation (23 NYCRR 500)
- ✓ NAIC AI model bulletin (insurance)
- ✓ NAIC Insurance Data Security Model Law (#668)
- ✓ HIPAA
- ✓ Global — Americas, Middle East, Asia-Pacific, Central Asia & international Countries covered todayArgentina · Australia · Brazil · China · Colombia · India · Indonesia · Israel · Japan · Kazakhstan · Mexico · Peru · Saudi Arabia · Singapore · South Korea · Taiwan · Thailand · Turkey · United Arab Emirates · Vietnam
- ✓ OMB M-25-21 / M-25-22 compliance pack
- ✓ Zero-trust agent checklist and scoring
- ✓ White-labeled Trust Page & badge, and Enterprise SSO
- ✓ Priority support and an advisory session
- ✓ Pay by card or ACH bank transfer
- ✓ 20 admin seats
Every plan includes AI Governance, multi-tenant security and an append-only audit log. Nonprofits save 20% on every plan: enter NONPROFIT20 at checkout. Not legal advice.
Creating an account takes a work email and no card. Every plan bills by card or U.S. bank account (ACH) through Stripe, and you can cancel any time; your plan runs to the end of the period you paid for. Billing terms →
Billed in US dollars. £ figures are approximate, at exchange rates from 4 September 2026.
Want someone alongside you? GOVERNBOX.ai Advisory Services → publishes a fee for every engagement — working sessions, half-day module training, a guided program launch — so you never need a call to learn a number.
Comparing tools? See GOVERNBOX vs OneTrust and GOVERNBOX vs Credo AI, side by side.
See the full plan comparison
Full Plan Comparison
| Feature | Starter | Pro Most Popular | Agency / Enterprise |
|---|---|---|---|
| Core Platform | |||
| AI Readiness Scorecard | ✓ | ✓ | ✓ |
| AI Use Case Log (inventory + named owner per system) | Unlimited | Unlimited | Unlimited |
| Grounded document generation — every clause cites a reviewed control | ✓ | ✓ | ✓ |
| EU AI Act risk tier classification + Art. 5 prohibited-use screen | — | ✓ | ✓ |
| Dashboard — My Workspace | ✓ | ✓ | ✓ |
| Notifications center (review countdowns, alerts) | ✓ | ✓ | ✓ |
| Append-only audit log | ✓ | ✓ | ✓ |
| Multi-tenant security + row-level isolation | ✓ | ✓ | ✓ |
| Document Generation | |||
| AI Use Policy | ✓ | ✓ | ✓ |
| AI Acceptable Use Standard | ✓ | ✓ | ✓ |
| AI Incident Response Plan | ✓ | ✓ | ✓ |
| Vendor AI Risk Assessment | ✓ | ✓ | ✓ |
| AI Strategic Plan (wizard) | — | ✓ | ✓ |
| CAIO Position Statement (wizard) | — | ✓ | ✓ |
| AI Committee Charter (wizard) | ✓ | ✓ | ✓ |
| Privacy Policy (consumer / data-subject rights) | NIST Privacy Framework | NIST Privacy Framework + GDPR | NIST Privacy Framework + GDPR + CCPA |
| OMB AI Compliance Plan (M-25-21 / M-25-22) | — | — | ✓ |
| Compliance Crosswalk export — five shelves: Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global | NIST AI RMF + ISO/IEC 42001 + United Kingdom AI law & guidance + Canada | + ISO/IEC 42005 + AI frameworks, standards & healthcare guidelines + EU AI Act + European Union AI law & guidance + Italy AI law & guidance + GDPR + Global privacy laws + Switzerland AI law & guidance + Norway AI law & guidance + NIST SP 800-53 Rev. 5 + NIST Cybersecurity Framework (CSF) 2.0 | + Colorado ADMT Act (SB 26-189) + Colorado Chatbot Safety (HB 26-1263) + Connecticut SB 5 (PA 26-15) + Texas TRAIGA + California ADMT Regulations + Hawaii AI Acts (247 / 248) + Alabama AI laws + Arizona AI laws + California AI laws (other statutes) + Colorado AI laws (other statutes) + Connecticut AI laws (other statutes) + Delaware AI laws + Florida AI laws + Georgia AI laws + Idaho AI laws + Illinois AI law & guidance + Indiana AI laws + Iowa AI laws + Kansas AI laws + Kentucky AI laws + Louisiana AI laws + Maine AI laws + Maryland AI laws + Minnesota AI laws + Montana AI laws + Nebraska AI laws + Nevada AI laws + New Hampshire AI laws + New Jersey AI laws + New York AI laws + North Dakota AI laws + Oklahoma AI laws + Oregon AI laws + Rhode Island AI laws + South Carolina AI laws + Tennessee AI laws + Texas AI laws (other statutes) + Utah AI laws + Vermont AI laws + Virginia AI laws + Washington AI laws + Wisconsin AI laws + Wyoming AI laws + United States — federal law & state landscape + CCPA + U.S. state privacy laws + SOC 2 (Trust Services Criteria) + New York DFS cybersecurity regulation (23 NYCRR 500) + NAIC AI model bulletin (insurance) + NAIC Insurance Data Security Model Law (#668) + HIPAA + Global — Americas, Middle East, Asia-Pacific, Central Asia & international |
| Word (.docx) export | ✓ | ✓ | ✓ |
| PDF export | ✓ | ✓ | ✓ |
| Organization logo on document exports | — | ✓ | ✓ |
| Compliance Frameworks | |||
| NIST AI RMF | ✓ | ✓ | ✓ |
| ISO/IEC 42001 | ✓ | ✓ | ✓ |
| U.S. State AI Laws — all states, added as they pass | — | — | ✓ |
| · Colorado ADMT Act (SB 26-189) — eff. January 1, 2027 | — | — | ✓ |
| · Colorado Chatbot Safety (HB 26-1263) — eff. January 1, 2027 | — | — | ✓ |
| · Connecticut SB 5 (PA 26-15) | — | — | ✓ |
| · Texas TRAIGA — eff. January 1, 2026 | — | — | ✓ |
| · California ADMT Regulations — eff. January 1, 2027 | — | — | ✓ |
| · Hawaii AI Acts (247 / 248) | — | — | ✓ |
| · Alabama AI laws | — | — | ✓ |
| · Arizona AI laws | — | — | ✓ |
| · California AI laws (other statutes) | — | — | ✓ |
| · Colorado AI laws (other statutes) | — | — | ✓ |
| · Connecticut AI laws (other statutes) | — | — | ✓ |
| · Delaware AI laws | — | — | ✓ |
| · Florida AI laws | — | — | ✓ |
| · Georgia AI laws | — | — | ✓ |
| · Idaho AI laws | — | — | ✓ |
| · Illinois AI law & guidance — eff. January 1, 2027 | — | — | ✓ |
| · Indiana AI laws | — | — | ✓ |
| · Iowa AI laws | — | — | ✓ |
| · Kansas AI laws | — | — | ✓ |
| · Kentucky AI laws | — | — | ✓ |
| · Louisiana AI laws | — | — | ✓ |
| · Maine AI laws | — | — | ✓ |
| · Maryland AI laws | — | — | ✓ |
| · Minnesota AI laws | — | — | ✓ |
| · Montana AI laws | — | — | ✓ |
| · Nebraska AI laws | — | — | ✓ |
| · Nevada AI laws | — | — | ✓ |
| · New Hampshire AI laws | — | — | ✓ |
| · New Jersey AI laws | — | — | ✓ |
| · New York AI laws | — | — | ✓ |
| · North Dakota AI laws | — | — | ✓ |
| · Oklahoma AI laws | — | — | ✓ |
| · Oregon AI laws | — | — | ✓ |
| · Rhode Island AI laws | — | — | ✓ |
| · South Carolina AI laws | — | — | ✓ |
| · Tennessee AI laws | — | — | ✓ |
| · Texas AI laws (other statutes) | — | — | ✓ |
| · Utah AI laws | — | — | ✓ |
| · Vermont AI laws | — | — | ✓ |
| · Virginia AI laws | — | — | ✓ |
| · Washington AI laws | — | — | ✓ |
| · Wisconsin AI laws | — | — | ✓ |
| · Wyoming AI laws | — | — | ✓ |
| · U.S. state law landscape — specific statutes from 27 states | — | — | ✓ |
| EU AI Act | — | ✓ | ✓ |
| ISO/IEC 42005 (AI impact assessment) | — | ✓ | ✓ |
| SOC 2 Trust Services Criteria (AI controls mapped into your SOC 2 program) | — | — | ✓ |
| NIST SP 800-53 Rev. 5 and NIST CSF 2.0 (cybersecurity, each with its own crosswalk) | — | ✓ | ✓ |
| CCPA / CPRA privacy statute (California) | — | — | ✓ |
| GDPR (EU data protection) | — | ✓ | ✓ |
| HIPAA Security & Privacy Rules | — | — | ✓ |
| OMB M-25-21 / M-25-22 (Federal AI) | — | — | ✓ |
| Regulatory Jurisdictions — enabled as one unit on the Organization Profile | |||
| United States — federal law & state landscape — 2 frameworks, enabled as one unit | — | — | ✓ |
| Canada — 1 framework, enabled as one unit | ✓ | ✓ | ✓ |
| AI frameworks, standards & healthcare guidelines — 2 frameworks, enabled as one unit | — | ✓ | ✓ |
| Europe — EU regulation, Italy, UK, Switzerland, Norway — 5 frameworks, enabled as one unit (United Kingdom AI law & guidance from Starter) | — | ✓ | ✓ |
| Global — Americas, Middle East, Asia-Pacific, Central Asia & international — 21 frameworks, enabled as one unit | — | — | ✓ |
| Risk & Impact | |||
| Risk Register (CRUD + likelihood × impact scoring) | ✓ | ✓ | ✓ |
| Risk heat map visualization | — | ✓ | ✓ |
| AI Impact Assessment (7-section questionnaire) | ✓ | ✓ | ✓ |
| Auto-create risk entries from assessments | — | ✓ | ✓ |
| AI Project Management Module | |||
| AI project list & per-project board | Up to 2 | Up to 5 | Unlimited |
| 7-phase AI development lifecycle checklist | ✓ | ✓ | ✓ |
| 45-item NIST/ISO/EU grounded task checklist | ✓ | ✓ | ✓ |
| Kanban board (drag-drop, task detail, Edit mode) | ✓ | ✓ | ✓ |
| Cross-links: Use Cases / Projects / Risk Register | ✓ | ✓ | ✓ |
| Agentic AI Governance Module | |||
| AI Agents inventory — basic registration (identity, ownership, data access) | ✓ | ✓ | ✓ |
| 12-item zero-trust controls checklist (NIST SP 800-207) | — | — | ✓ |
| Zero-trust score + low-score alerts | — | — | ✓ |
| Agent registration wizard (3-step) | ✓ | ✓ | ✓ |
| Agent metrics in Board Report governance block | ✓ | ✓ | ✓ |
| Cross-links: Agents / Use Cases / Risk Register | ✓ | ✓ | ✓ |
| Training, Incidents & Operations | |||
| Training plan + completion tracking | ✓ | ✓ | ✓ |
| Acceptable-use acknowledgment sign-off | ✓ | ✓ | ✓ |
| Incident log + severity codes | ✓ | ✓ | ✓ |
| EU AI Act Art. 73 serious-incident flag | — | ✓ | ✓ |
| Reporting & Governance | |||
| Quarterly Board Report (full — maturity score + quarterly history) | ✓ | ✓ | ✓ |
| AI Cost Tracking & Roll-Up (per use case + program office, 60-day renewal alerts, Board Report totals) | ✓ | ✓ | ✓ |
| Board Report — AI Agents governance section | ✓ | ✓ | ✓ |
| Governance maturity score + stars (dashboard/badge) | ✓ | ✓ | ✓ |
| Shareable governance badge | ✓ | ✓ | ✓ White-labeled |
| Live public Trust Page + embeddable live badge | ✓ | ✓ | ✓ White-labeled |
| Employee Attestation Portal (unlimited signers) | ✓ | ✓ | ✓ |
| Regulatory horizon feed ("What's Changing") | ✓ | ✓ | ✓ |
| Gap report with advisory CTAs | ✓ | ✓ | ✓ |
| Integrations & API | |||
| Vendor registry — approval lifecycle, terms on file, backfill from your records | ✓ | ✓ | ✓ |
| AI System registry — model, vendor, hosting, training-data notes | ✓ | ✓ | ✓ |
| REST API with scoped keys (every change audited as the key) | Read | Read + write | Read + write |
| Outbound webhooks — HMAC-signed, retried for up to a day | — | ✓ | ✓ |
| Intake connector — Zapier, Jira, ServiceNow, email or any webhook | — | ✓ | ✓ |
| Shadow AI Discovery — browser extension shows which AI tools staff use | ✓ | ✓ | ✓ |
| Shadow AI Discovery+ — Okta / Google Workspace / Entra / Netskope / Zscaler / Cloudflare One imports | — | ✓ | ✓ |
| Vendor questionnaires answered through a private vendor portal | — | ✓ | ✓ |
| Use-case approval gate — an Admin signs off before a use case goes active | ✓ | ✓ | ✓ |
| Interactive API reference (OpenAPI) | ✓ | ✓ | ✓ |
| Administration | |||
| Admin Console (full data inventory & controls) | Owner + Admin | Owner + Admin | Owner + Admin |
| User roles (Owner / Admin / Member) | ✓ | ✓ | ✓ |
| User invite & role management | ✓ | ✓ | ✓ |
| Enterprise SSO (SAML / OIDC) | — | — | ✓ |
| Data export (full org snapshot) | ✓ | ✓ | ✓ |
| Retention policy + danger zone (Owner only) | ✓ | ✓ | ✓ |
| Admin seats included (people who log in) | 10 | 15 | 20 |
| Staff participants — report AI tools, sign policies, complete training (no seat needed) | Unlimited | Unlimited | Unlimited |
| Staff AI-tool reporting portal (anonymous shadow-AI intake) | ✓ | ✓ | ✓ |
| Support & Advisory | |||
| Email support | ✓ | ✓ | ✓ |
| Onboarding walkthrough | — | ✓ | ✓ |
| Priority support | — | — | ✓ |
| Advisory session (1:1 with the founder) | — | — | ✓ Included |
Agency / Enterprise includes one advisory session. Working sessions, half-day module training and a guided program launch are also available on their own, at published fees — see GOVERNBOX.ai Advisory Services →
Modular pricing
The more you add, the more you save
Every configuration includes AI Governance. Add Enterprise Risk, IT Inventory, and Data Management on top — each with its own scorecard, wizards, board-report chapter, and unlimited-signer attestations.
Configuration (all include AI)
Starter /yr
Pro /yr
Agency / Enterprise /yr
AI + 1 management module
$3,500 (≈ £2,590)
$12,000 (≈ £8,870)
—
Each additional module
+$1,750 (≈ £1,290)
+$5,000 (≈ £3,700)
—
AI + 2 management modules
$5,250 (≈ £3,880)
$17,000 (≈ £12,560)
—
Complete — AI + all three
$7,000 (≈ £5,170)
$19,900 (≈ £14,710)
$25,000 (≈ £18,480)
Monthly from $339 (≈ £251)/mo. Billed in US dollars. £ figures are approximate, at exchange rates from 4 September 2026.
What each program adds
Five programs, one shared graph
AI Governance runs through all four management programs, which is why it is in every plan rather than sold beside them.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from StarterEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
AI Governance
In every plan
AI runs through all four — so it’s the foundation, not a fifth box.
AI Governance
In every plan
AI runs through all four below — it’s the foundation, not a fifth box.
Privacy
HIPAA, GDPR and CCPA — the duties AI stretched.
Included from StarterEnterprise Risk
One register, six plain categories, named owners.
IT Inventory & Management
Every tool, asset and admin account, with a renewal date.
Data Management
What you hold, where it flows, how long you keep it.
Every plan is built on AI Governance. You switch on the management modules — Risk, IT, Data — as you need them, and Privacy comes with every plan (the privacy program and a Privacy Policy from Starter; CCPA from Pro; GDPR and HIPAA on Agency). Price your configuration →
Price your configuration
Pick a tier, switch on the modules
Platform spine
Every tier · every module- ✓Its own readiness scorecard
- ✓Guided document wizards
- ✓A dedicated chapter in your quarterly Board Report
- ✓Unlimited-signer attestations
- ✓Admin Console, append-only audit log & two-step sign-in your organization can require
- ✓Shadow AI Discovery (browser extension) from Starter; Discovery+ (identity-provider / CASB imports, intake connector) from Pro
- ✓REST API with scoped keys (read from Starter, read + write from Pro); intake connector for Zapier, Jira and ServiceNow from Pro
- ✓Outbound webhooks — signed, retried — from Pro
Step 1 · Pick your depth
Starter — a real governance program
- ✦NIST AI RMF · ISO/IEC 42001 · United Kingdom AI law & guidance · Canada
- ✦Risk register, impact assessments, incident log
- ✦Privacy program, privacy impact assessments & Privacy Policy
- ✦Full quarterly Board Report + Governance Badge
- ✦Word + PDF export
- ✦10 admin seats
- ✦Monthly payment option available
Step 2 · Switch on your modules
AI Governance
Foundation · in every plan
- ✓Free AI Readiness Scorecard + gap report
- ✓AI Use Case Log — inventory every AI tool, incl. shadow AI (EU AI Act prohibited-use screen on Agency)
- ✓Grounded document generation — 11 policy & plan types, every clause cited to a control
- ✓Vendor & AI System registries — approval status, terms on file, everything that depends on each
- ✓AI Risk Register + 7-section Impact Assessments
- ✓AI Incident Log — severity codes (EU AI Act Art. 73 flag on Agency)
- ✓AI Agents inventory — 12-item zero-trust checklist
- ✓AI Cost Tracking & Roll-Up — 60-day renewal alerts, board totals
- ✓Training Plan + Employee Attestations — unlimited signers
- ✓AI Project Management — Kanban + 7-phase lifecycle checklist
- ✓Compliance Crosswalks — NIST AI RMF · ISO/IEC 42001 · all 43 dedicated U.S. state AI laws, plus specific statutes from 27 states · U.S. National, on five shelves (Frameworks / United States / EU / Canada / Global); more by tier
- ✓Quarterly Board Report — maturity score + history
- ✓Governance Badge + public Trust Page
- ✓Regulatory “What’s Changing” feed
- ✓Org-wide risk register — 6 plain-language categories
- ✓Guided risk discovery — draft register in ~30 minutes
- ✓One-page risk appetite statement
- ✓Treatments & actions with named owners
- ✓Simple KRIs — green / amber / red
- ✓Quarterly board risk report chapter
- ✓Your AI risk register becomes the ‘technology & AI’ category
Tap to add IT Inventory & Mgmt and see what it includes.
Tap to add Data Management and see what it includes.
AI + 1 module
$3,500/yr
≈ £2,590
Billed annually · $339 (≈ £251)/mo
Nonprofit: $2,800 (≈ £2,070)/yr (20% off)
🤖 AI Governance (foundation)Included
AI + ⚠️ Enterprise Risk$3,500 (≈ £2,590)
Total / year$3,500 (≈ £2,590)
Billed in US dollars. £ figures are approximate, at exchange rates from 4 September 2026.
Continue to checkout →Every plan includes AI Governance, multi-tenant security & an audit log. Cancel anytime. Not legal advice.
Would rather not build it alone? GOVERNBOX.ai Advisory Services → publishes a fixed fee for every engagement, from a single working session to a guided program launch. Advisory is additive — the platform is designed to be run without it.
Coverage by plan
What’s covered on each plan
Each plan keeps everything below it and adds the frameworks listed. Free previews NIST AI RMF only. Every framework here is backed by controls in the library and verified on one of the crosswalk shelves (Frameworks / Cybersecurity / United States / European Union & Europe / Canada / Global).
Starter
Included on every paid plan:
- NIST AI RMF
- ISO/IEC 42001
- United Kingdom AI law & guidance
- CanadaPIPEDA and provincial privacy law, the Directive on Automated Decision-Making, and the Canadian Human Rights Act as they apply to AI.
Pro
Everything in Starter, plus:
- ISO/IEC 42005
- AI frameworks, standards & healthcare guidelinesNIST profiles, ISO/IEC standards, IEEE, OECD and the healthcare AI reporting/assurance frameworks (FDA, WHO, CHAI, CONSORT-AI…).
- EU AI Act
- European Union AI law & guidance
- Italy AI law & guidance
- GDPR
- Global privacy laws
- Switzerland AI law & guidance
- Norway AI law & guidance
- NIST SP 800-53 Rev. 5
- NIST Cybersecurity Framework (CSF) 2.0
Agency / Enterprise
Everything in Pro, plus:
- U.S. state AI laws (43 today — added as they pass)Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws. The U.S. state law landscape framework additionally cites specific statutes from 27 states.
- United States — federal law & state landscapeFederal legislation, executive orders and agency regulation, a cross-state view of AI disclosure and training-data laws. Per-state statutes — Illinois included — are the U.S. State AI Laws jurisdiction above.
- CCPA
- U.S. state privacy laws
- SOC 2 (Trust Services Criteria)
- New York DFS cybersecurity regulation (23 NYCRR 500)
- NAIC AI model bulletin (insurance)
- NAIC Insurance Data Security Model Law (#668)
- HIPAA
- Global — Americas, Middle East, Asia-Pacific, Central Asia & internationalTwenty further countries' AI laws and guidance plus the international instruments (Council of Europe, OECD, UNESCO, UN).
Jurisdictions (U.S. State Laws, U.S. National, Canada, AI Standards, Europe, Global) are each enabled as one unit on the Organization Profile; the standalone frameworks are chosen individually. New state laws are added as they pass. Not legal advice.
Where the tiers differ
Feature
Starter
Pro
Agency / Enterprise
NIST AI RMF · ISO/IEC 42001 · United Kingdom AI law & guidance · Canada
✓
✓
✓
ISO/IEC 42005 · AI frameworks, standards & healthcare guidelines · EU AI Act · European Union AI law & guidance · Italy AI law & guidance · GDPR · Global privacy laws · Switzerland AI law & guidance · Norway AI law & guidance · NIST SP 800-53 Rev. 5 · NIST Cybersecurity Framework (CSF) 2.0 · NIST SP 800-53
—
✓
✓
Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws · United States — federal law & state landscape · CCPA · U.S. state privacy laws · SOC 2 (Trust Services Criteria) · New York DFS cybersecurity regulation (23 NYCRR 500) · NAIC AI model bulletin (insurance) · NAIC Insurance Data Security Model Law (#668) · HIPAA · Global — Americas, Middle East, Asia-Pacific, Central Asia & international · OMB M-25-21/22
—
—
✓
Grounded document generation and the certified regulatory crosswalk
✓
✓
✓
Regulatory-change notifications ("What's Changing")
✓
✓
✓
Vendor and AI System registries
✓
✓
✓
REST API with scoped keys
Read
Read + write
Read + write
Outbound webhooks — signed, retried for a day
—
✓
✓
Intake connector — Zapier, Jira, ServiceNow, any webhook
—
✓
✓
Vendor questionnaires and the vendor portal
—
✓
✓
Use-case approval gate — an Admin signs off before a use case goes active
✓
✓
✓
Shadow AI Discovery — browser extension, staff AI-tool reporting link
✓
✓
✓
Shadow AI Discovery+ — identity-provider / CASB imports and the intake connector
—
✓
✓
AI Agent Analysis
—
✓
✓
Risk heat map · assessments auto-populate the register
—
✓
✓
AI projects running at once
Up to 2
Up to 5
Unlimited
Zero-trust agent checklist and scoring
—
—
✓
Document exports
Word + PDF
Branded
Branded
White-labeled Trust Page & badge
—
—
✓
Enterprise SSO (SAML / OIDC)
—
—
✓
Admin seats (people who log in)
10
15
20
Staff participants — report tools, sign policies, train
Unlimited
Unlimited
Unlimited
AI Training & Certification — all 7 AI Leadership Course credentials
✓
✓
✓
Support
Email
+ Onboarding
Priority + advisory
🏔️ On every plan
Colorado readiness, before the clock runs out
SB 26-189 and HB 26-1263 take effect January 1, 2027. Starter and up include a dedicated Colorado crosswalk, so the work is grounded well ahead of the deadline.
Not ready to pick a plan?
See where you stand with the free scorecard, or ask us anything first.