Question 1

What is GOVERNBOX.ai, and who is it for?

Accepted Answer

GOVERNBOX.ai ("AI Governance in a Box") is a self-service platform that helps a nonprofit, association, public-sector body, or small-to-midsize business produce a defensible AI governance package — an AI use policy, an acceptable-use standard, a risk register, and compliance crosswalks to frameworks like NIST AI RMF, ISO/IEC 42001 and 42005, the U.S. state AI laws (Colorado's ADMT and Chatbot Safety Acts among them), U.S. federal law, the EU AI Act, HIPAA, GDPR, and CCPA, and Canadian, European and global AI law and guidance by plan — without hiring a consultant or buying an enterprise platform built for a dedicated AI risk team.

Question 2

How is this different from hiring a compliance consultant, or buying an enterprise platform?

Accepted Answer

Enterprise AI governance platforms typically cost tens to hundreds of thousands of dollars a year and assume a dedicated risk team. Consultants are effective but expensive and slow to engage. GOVERNBOX.ai serves the underserved middle: a guided, affordable, sector-aware product for organizations that need a real, defensible program now — with the option to bring in expert consulting for anything that genuinely needs a human.

Question 3

How long does it take to get a usable AI governance package?

Accepted Answer

Most organizations can complete the free Readiness Scorecard, sign up, complete their organization profile, and generate a first grounded, tailored policy document in well under an hour.

Question 4

Do I need AI or compliance expertise to use this?

Accepted Answer

No. The product is built for the "accidental AI owner" — someone handed AI governance responsibility without specialist training. Every generated document uses plain language, not jargon, and is written for a board or funder audience, not data scientists.

Question 5

What's the free AI Readiness Scorecard, and is it really free?

Accepted Answer

Yes — genuinely free, no credit card and no account needed. It's a 15-question assessment scored out of 30 that reads your organization's current AI governance maturity, names your strongest area and your biggest exposure, and shows which module of the platform closes each gap. Your answers are saved in your browser as you go, so you can finish it later. You see your score before anything is asked of you; a business email sends you the full written briefing.

Question 6

Does the AI ever invent compliance controls or citations?

Accepted Answer

No. Every generated clause is required to cite a specific control from our proprietary, human-authored control library — the model tailors and phrases retrieved controls to your organization, it never introduces a requirement that isn't in the library. If no relevant control is found for a given topic, the system says so rather than fabricating language.

Question 7

Who actually writes the underlying control library — is it AI-generated?

Accepted Answer

No. The control library is authored and reviewed by our founder, a subject-matter expert in NIST-based governance frameworks. The AI model's job is to format, tailor, and cross-check against that library — never to author governance requirements itself.

Question 8

Do the generated documents count as legal advice?

Accepted Answer

No. Generated documents are drafting aids grounded in our control library, not a substitute for legal review. Every document requires human review and explicit approval inside your organization before it's relied on, published, or shared.

Question 9

How current is the control library as laws change?

Accepted Answer

The library and every document generated from it are framework-version-stamped, so you always know which version of a regulation a given document was built against. We update the library as frameworks change — for example, when Colorado repealed its 2024 AI Act in 2026 and replaced it with the ADMT Act (SB 26-189), the library and every dependent crosswalk were rebuilt against the new statutory text.

Question 10

Which laws and frameworks does the platform cover?

Accepted Answer

NIST AI RMF, ISO/IEC 42001 and ISO/IEC 42005; every dedicated U.S. state AI law, added as they pass (Colorado ADMT Act (SB 26-189); Colorado Chatbot Safety (HB 26-1263); Connecticut SB 5 (PA 26-15); Texas TRAIGA; California ADMT Regulations; Hawaii AI Acts (247 / 248)); the EU AI Act, HIPAA, GDPR and CCPA; and five enable-as-one-unit jurisdictions — U.S. National (federal law and the state landscape), Canada, an AI frameworks, standards and healthcare-guidelines pack, Europe (EU regulation beyond the Act, the UK, Switzerland and Norway) and Global (sixteen further countries plus the international instruments). Every framework except HIPAA has a compliance crosswalk today (HIPAA grounds policy generation; its crosswalk is not yet published) — shelved as Frameworks, United States, EU, Canada and Global — showing exactly which requirement is covered by which policy clause, and which are still gaps.

Question 11

Does Colorado's ADMT Act (SB 26-189) apply to my organization?

Accepted Answer

It applies based on what your organization does with AI — specifically, whether you develop or deploy automated decision-making technology that influences a consequential decision about a consumer (hiring, lending, housing, and similar) — not on your headcount or revenue. There's no blanket small-organization exemption. It takes effect January 1, 2027, alongside Colorado's separate Chatbot Safety Act (HB 26-1263) for consumer-facing chatbots. Both are covered from the Starter plan.

Question 12

Does the EU AI Act apply if my organization isn't based in the EU?

Accepted Answer

Often yes. The EU AI Act applies extraterritorially to any provider or deployer whose AI system's output is used in the EU, including a US organization serving EU-based clients, donors, or program participants — it doesn't turn on where you're incorporated.

Question 13

What if more than one framework applies to us at once?

Accepted Answer

That's the common case, not the exception. The right approach is one AI governance program — inventory, risk register, policies, training, incident log — with a crosswalk mapping it to whichever specific frameworks actually apply to you, rather than a separate, disconnected effort per law.

Question 14

Which frameworks are included at each plan tier?

Accepted Answer

Starter includes NIST AI RMF, ISO/IEC 42001, every dedicated U.S. state AI law (Colorado ADMT Act (SB 26-189); Colorado Chatbot Safety (HB 26-1263); Connecticut SB 5 (PA 26-15); Texas TRAIGA; California ADMT Regulations; Hawaii AI Acts (247 / 248)) and the U.S. National jurisdiction (federal law and the state landscape). Pro adds ISO/IEC 42005; CCPA; Canada; AI frameworks, standards & healthcare guidelines. Agency adds EU AI Act; HIPAA; GDPR; Europe — EU regulation, UK, Switzerland, Norway; Global — Americas, Middle East, Asia-Pacific & international. Free previews NIST AI RMF only. The EU AI Act, HIPAA and GDPR are Agency-only — they are not included on Pro. See the full comparison table for the complete breakdown by feature.

Question 15

Is my organization's data shared with, or visible to, other customers?

Accepted Answer

No. Every organization's data is logically isolated by organization ID, enforced in application code and at the database level. No organization can query or view another organization's records.

Question 16

Is my data used to train the AI model?

Accepted Answer

No. We never train or fine-tune on customer content, and never log tenant content beyond what's needed to operate the product.

Question 17

Is my data encrypted, and how is access controlled?

Accepted Answer

Data is encrypted in transit and at rest, and access is governed by your organization's own role-based permissions (Owner, Admin, Editor, Viewer) plus platform-level authentication with multi-factor authentication required for every account.

Question 18

Where is my data stored, and can I request deletion?

Accepted Answer

Data is hosted with reputable infrastructure providers in the United States. You can request account and data deletion at any time — see our Data Usage Policy for details, or contact us directly.

Question 19

What subscription tiers are available, and what does each include?

Accepted Answer

Free (preview only), Starter ($3,500/yr — equates to $291.66 per month), Pro ($12,000/yr — equates to $1,000 per month), and Agency / Enterprise (starting at $25,000/yr — the fixed plan is bought online; custom setups with extra seats, several workspaces, SSO rollout or invoiced billing are quoted in writing at governbox.ai/enterprise) — all billed annually — each unlocking progressively more frameworks, deeper feature versions, and more seats. See the full pricing and comparison table on our homepage or /plans page.

Question 20

Do you offer a nonprofit discount?

Accepted Answer

Yes — nonprofits save 20% on every plan (Starter, Pro and Agency / Enterprise). The nonprofit price is printed on each pricing card, so you never have to work it out. The rate is public and selectable at checkout.

Question 21

Can I change plans or cancel at any time?

Accepted Answer

Yes. Billing is handled through our billing provider's own self-service tools, accessible from your Admin Console — upgrade, downgrade, or cancel whenever you need to.

Question 22

Is pricing per seat, or flat per organization?

Accepted Answer

Each tier includes a set number of admin seats (Starter 10, Pro 15, Agency 20); staff who report AI tools, sign policies and complete training need no seat and are unlimited on every paid plan. The core price itself is a flat, per-organization annual (or, for Starter, monthly) subscription — not metered by usage.

Question 23

Is there a free trial, or just the free Scorecard and preview?

Accepted Answer

There's a 15-day Free Trial — all five modules (AI Governance, Enterprise Risk, IT Management, Data Management and Privacy), with the four record-keeping modules capped at 2 records each and the policy generators in preview. The trial takes no credit card and there is nothing to cancel — on day 15 your workspace becomes read-only until you pick a plan, and nothing is deleted. One trial per organization. The Readiness Scorecard remains free with no card and no account.

Question 24

What types of documents can I generate?

Accepted Answer

AI Use Policy, AI Acceptable Use Standard, Data Management Policy (Data module), Privacy Policy, AI Incident Response Plan, Vendor AI Risk Assessment, AI Strategic Plan, AI Committee Charter, CAIO Position Description, and (Agency tier) an OMB AI Compliance Plan — all grounded in the control library and tailored to your organization.

Question 25

Can I edit a generated document before approving it?

Accepted Answer

Yes. Every document section is click-to-edit, and you can also export a draft as a Word document to mark up externally before pasting edits back in — the built-in review workflow is designed around exactly that pre-approval editing step.

Question 26

What formats can I export to?

Accepted Answer

PDF and Word. Approved, paid-tier documents export cleanly with your organization's branding; Free-tier previews carry a watermark.

Question 27

Does a document need to be approved before we can rely on it?

Accepted Answer

Yes — every generated document goes through an explicit human review and approval step inside the product before it's considered your organization's official policy. This is by design: generated documents are drafting aids, not automatically-binding output.

Question 28

Besides policies, what else does the platform track?

Accepted Answer

An AI use case inventory, a risk register (likelihood × impact scoring), impact assessments, a training plan, an incident log, a project board for AI initiatives, an AI agents inventory with a zero-trust checklist (Agency), and a quarterly board report built around the five questions every board should be able to answer.

Question 29

How do I ask a question or report a bug?

Accepted Answer

Use the Contact page — general questions are open to everyone, no account required, and subscribed organizations get a dedicated system-issue reporting channel.

Question 30

Can I talk to a real person, not just get AI-generated documents?

Accepted Answer

Yes. GOVERNBOX.ai Advisory Services is a separately-priced engagement line delivered by the people who built the platform: Executive Strategy Session, Half-Day Training, Agentic Oversight Setup, Guided Launch, Custom Governance Integration — plus an ongoing monthly retainer for organizations that want a standing cadence. Every engagement has a fixed scope and a fee published on the page, so you never need a discovery call to learn a number. See governbox.ai/advisory. The Agency plan includes one advisory session; everything else can be bought on its own, on any plan, with or without a subscription.

Question 31

Do we need the advisory engagements to get value out of the platform?

Accepted Answer

No — and we would rather you start without them. The platform is built to be run by a non-specialist: the free Scorecard shows where you stand, the 15-day trial gets a real program in place, and most organizations need nothing beyond a subscription. Advisory exists for the cases where that genuinely isn't enough — no one internally owns AI yet, a board or funder deadline is closer than the learning curve, or an existing GRC and audit estate has to be reconciled rather than replaced. If you have someone who owns AI, a few months of runway, and the willingness to work through the platform, buy a subscription and skip us.

Question 32

We already work with a consultant or MSP on governance. Should we still talk to you?

Accepted Answer

Talk to them first. If a GOVERNBOX partner already runs governance for you, they lead the engagement and we support them rather than competing for the work — that is the whole point of the Partner Program. If they would rather you work with us directly, or you have no partner of record, we are glad to engage.

Frequently Asked Questions

About the product

Trust & accuracy

Frameworks & compliance coverage

Security, privacy & multi-tenancy

Pricing & billing

Documents & features

Getting help