Question 1

What is GOVERNBOX.ai, and who is it for?

Accepted Answer

GOVERNBOX.ai ("AI Governance in a Box") is a self-service platform that helps a nonprofit, association, public-sector body, or small-to-midsize business produce a defensible AI governance package — an AI use policy, an acceptable-use standard, a risk register, and compliance crosswalks to frameworks like NIST AI RMF, ISO/IEC 42001, the Colorado AI Act, the EU AI Act, HIPAA, GDPR, and CCPA — without hiring a consultant or buying an enterprise platform built for a dedicated AI risk team.

Question 2

How is this different from hiring a compliance consultant, or buying an enterprise platform?

Accepted Answer

Enterprise AI governance platforms typically cost tens to hundreds of thousands of dollars a year and assume a dedicated risk team. Consultants are effective but expensive and slow to engage. GOVERNBOX.ai serves the underserved middle: a guided, affordable, sector-aware product for organizations that need a real, defensible program now — with the option to bring in expert consulting for anything that genuinely needs a human.

Question 3

How long does it take to get a usable AI governance package?

Accepted Answer

Most organizations can complete the free Readiness Scorecard, sign up, complete their organization profile, and generate a first grounded, tailored policy document in well under an hour.

Question 4

Do I need AI or compliance expertise to use this?

Accepted Answer

No. The product is built for the "accidental AI owner" — someone handed AI governance responsibility without specialist training. Every generated document uses plain language, not jargon, and is written for a board or funder audience, not data scientists.

Question 5

What's the free AI Readiness Scorecard, and is it really free?

Accepted Answer

Yes — genuinely free, no sign-up required. It's a 15-question assessment across five sections that scores your organization's current AI governance maturity, flags your top gaps, and shows which module of the platform closes each one.

Question 6

Does the AI ever invent compliance controls or citations?

Accepted Answer

No. Every generated clause is required to cite a specific control from our proprietary, human-authored control library — the model tailors and phrases retrieved controls to your organization, it never introduces a requirement that isn't in the library. If no relevant control is found for a given topic, the system says so rather than fabricating language.

Question 7

Who actually writes the underlying control library — is it AI-generated?

Accepted Answer

No. The control library is authored and reviewed by our founder, a subject-matter expert with federal CIO/CAIO experience in NIST-based governance frameworks. The AI model's job is to format, tailor, and cross-check against that library — never to author governance requirements itself.

Question 8

Do the generated documents count as legal advice?

Accepted Answer

No. Generated documents are drafting aids grounded in our control library, not a substitute for legal review. Every document requires human review and explicit approval inside your organization before it's relied on, published, or shared.

Question 9

How current is the control library as laws change?

Accepted Answer

The library and every document generated from it are framework-version-stamped, so you always know which version of a regulation a given document was built against. We update the library as frameworks change — for example, when Colorado's AI Act was amended in 2026, the library and every dependent crosswalk were rebuilt against the new statutory text.

Question 10

Which laws and frameworks does the platform cover?

Accepted Answer

NIST AI RMF, ISO/IEC 42001, the EU AI Act, the Colorado AI Act (SB 26-189 / HB 26-1263), HIPAA, GDPR, and CCPA — each with its own dedicated compliance crosswalk showing exactly which requirement is covered by which policy clause, and which are still gaps.

Question 11

Does the Colorado AI Act apply to my organization?

Accepted Answer

It applies based on what your organization does with AI — specifically, whether you develop or deploy a "covered" automated decision system that materially influences a consequential decision about a consumer (hiring, lending, housing, and similar) — not on your headcount or revenue. There's no blanket small-organization exemption. It takes effect January 1, 2027.

Question 12

Does the EU AI Act apply if my organization isn't based in the EU?

Accepted Answer

Often yes. The EU AI Act applies extraterritorially to any provider or deployer whose AI system's output is used in the EU, including a US organization serving EU-based clients, donors, or program participants — it doesn't turn on where you're incorporated.

Question 13

What if more than one framework applies to us at once?

Accepted Answer

That's the common case, not the exception. The right approach is one AI governance program — inventory, risk register, policies, training, incident log — with a crosswalk mapping it to whichever specific frameworks actually apply to you, rather than a separate, disconnected effort per law.

Question 14

Which frameworks are included at each plan tier?

Accepted Answer

Starter includes NIST AI RMF, ISO/IEC 42001, and the Colorado AI Act. Pro and Agency add the EU AI Act, HIPAA, GDPR, and CCPA. Free previews NIST AI RMF only. See the full comparison table for the complete breakdown by feature.

Question 15

Is my organization's data shared with, or visible to, other customers?

Accepted Answer

No. Every organization's data is logically isolated by organization ID, enforced in application code and at the database level. No organization can query or view another organization's records.

Question 16

Is my data used to train the AI model?

Accepted Answer

No. We never train or fine-tune on customer content, and never log tenant content beyond what's needed to operate the product.

Question 17

Is my data encrypted, and how is access controlled?

Accepted Answer

Data is encrypted in transit and at rest, and access is governed by your organization's own role-based permissions (Owner, Admin, Editor, Viewer) plus platform-level authentication with multi-factor authentication required for every account.

Question 18

Where is my data stored, and can I request deletion?

Accepted Answer

Data is hosted with reputable infrastructure providers in the United States. You can request account and data deletion at any time — see our Data Usage Policy for details, or contact us directly.

Question 19

What subscription tiers are available, and what does each include?

Accepted Answer

Free (preview only), Starter ($3,500/yr — equates to $291.66 per month), Pro ($12,000/yr — equates to $1,000 per month), and Agency ($25,000/yr) — all billed annually — each unlocking progressively more frameworks, deeper feature versions, and more seats. See the full pricing and comparison table on our homepage or /plans page.

Question 20

Do you offer a nonprofit discount?

Accepted Answer

Yes — verified nonprofits save 20% on Starter and Pro annual plans.

Question 21

Can I change plans or cancel at any time?

Accepted Answer

Yes. Billing is handled through our billing provider's own self-service tools, accessible from your Admin Console — upgrade, downgrade, or cancel whenever you need to.

Question 22

Is pricing per seat, or flat per organization?

Accepted Answer

Each tier includes a set number of seats (Starter 3, Pro 5, Agency 10), with the option to add more as needed. The core price itself is a flat, per-organization annual (or, for Starter, monthly) subscription — not metered by usage.

Question 23

Is there a free trial, or just the free Scorecard and preview?

Accepted Answer

The Free tier itself has no time limit — it includes the Readiness Scorecard and a preview of a generated AI Use Policy indefinitely, with no credit card required. Upgrade whenever you're ready to generate real, exportable documents.

Question 24

What types of documents can I generate?

Accepted Answer

AI Use Policy, AI Acceptable Use Standard, Data Management Policy (Data module), Privacy Policy, AI Incident Response Plan, Vendor AI Risk Assessment, AI Strategic Plan, AI Committee Charter, CAIO Position Description, and (Agency tier) an OMB AI Compliance Plan — all grounded in the control library and tailored to your organization.

Question 25

Can I edit a generated document before approving it?

Accepted Answer

Yes. Every document section is click-to-edit, and you can also export a draft as a Word document to mark up externally before pasting edits back in — the built-in review workflow is designed around exactly that pre-approval editing step.

Question 26

What formats can I export to?

Accepted Answer

PDF and Word. Approved, paid-tier documents export cleanly with your organization's branding; Free-tier previews carry a watermark.

Question 27

Does a document need to be approved before we can rely on it?

Accepted Answer

Yes — every generated document goes through an explicit human review and approval step inside the product before it's considered your organization's official policy. This is by design: generated documents are drafting aids, not automatically-binding output.

Question 28

Besides policies, what else does the platform track?

Accepted Answer

An AI use case inventory, a risk register (likelihood × impact scoring), impact assessments, a training plan, an incident log, a project board for AI initiatives, an AI agents inventory with a zero-trust checklist (Pro/Agency), and a quarterly board report built around the five questions every board should be able to answer.

Question 29

How do I ask a question or report a bug?

Accepted Answer

Use the Contact page — general questions are open to everyone, no account required, and subscribed organizations get a dedicated system-issue reporting channel.

Question 30

Can I talk to a real person, not just get AI-generated documents?

Accepted Answer

Yes — book an advisory consulting session directly with our founder, a 2x Federal CIO with real NIST and governance-board experience, from the Contact page or the Advisory prompts throughout the dashboard.

Frequently Asked Questions

About the product

Trust & accuracy

Frameworks & compliance coverage

Security, privacy & multi-tenancy

Pricing & billing

Documents & features

Getting help