Question 1

What is GOVERNBOX.ai, and who is it for?

Accepted Answer

GOVERNBOX.ai ("AI Governance in a Box") is a self-service platform that helps a nonprofit, association, public-sector body, or small-to-midsize business run a defensible governance program — with modules for AI governance, enterprise risk, IT management and data management, plus a Privacy module that comes with every plan. It produces grounded policies, a risk register, an inventory of your AI tools and vendors, and compliance crosswalks to frameworks like NIST AI RMF, ISO/IEC 42001 and 42005, SOC 2, the U.S. state AI laws (Colorado's ADMT and Chatbot Safety Acts among them), U.S. federal law, the EU AI Act, HIPAA, GDPR, and CCPA, and Canadian, European and global AI law and guidance by plan — without hiring a consultant or buying an enterprise platform built for a dedicated AI risk team.

Question 2

How is this different from hiring a compliance consultant, or buying an enterprise platform?

Accepted Answer

Enterprise AI governance platforms typically cost tens to hundreds of thousands of dollars a year and assume a dedicated risk team. Consultants are effective but expensive and slow to engage. GOVERNBOX.ai serves the underserved middle: a guided, affordable, sector-aware product for organizations that need a real, defensible program now — with the option to bring in expert consulting for anything that genuinely needs a human.

Question 3

How long does it take to get a usable AI governance package?

Accepted Answer

Most organizations can complete the free Readiness Scorecard, sign up, complete their organization profile, and generate a first grounded, tailored policy document in well under an hour.

Question 4

Do I need AI or compliance expertise to use this?

Accepted Answer

No. The product is built for the "accidental AI owner" — someone handed AI governance responsibility without specialist training. Every generated document uses plain language, not jargon, and is written for a board or funder audience, not data scientists.

Question 5

What's the free AI Readiness Scorecard, and is it really free?

Accepted Answer

Yes — genuinely free, no credit card and no account needed. It's a 15-question assessment scored out of 30 that reads your organization's current AI governance maturity, names your strongest area and your biggest exposure, and shows which module of the platform closes each gap. Your answers are saved in your browser as you go, so you can finish it later. You see your score before anything is asked of you; a business email sends you the full written briefing.

Question 6

Does the AI ever invent compliance controls or citations?

Accepted Answer

No. Every generated clause is required to cite a specific control from our proprietary, human-authored control library — the model tailors and phrases retrieved controls to your organization, it never introduces a requirement that isn't in the library. If no relevant control is found for a given topic, the system says so rather than fabricating language.

Question 7

Who actually writes the underlying control library — is it AI-generated?

Accepted Answer

No. The control library is authored and reviewed by our founder, a subject-matter expert in NIST-based governance frameworks. The AI model's job is to format, tailor, and cross-check against that library — never to author governance requirements itself.

Question 8

Do the generated documents count as legal advice?

Accepted Answer

No. Generated documents are drafting aids grounded in our control library, not a substitute for legal review. Every document requires human review and explicit approval inside your organization before it's relied on, published, or shared.

Question 9

How current is the control library as laws change?

Accepted Answer

The library and every document generated from it are framework-version-stamped, so you always know which version of a regulation a given document was built against. We update the library as frameworks change — for example, when Colorado repealed its 2024 AI Act in 2026 and replaced it with the ADMT Act (SB 26-189), the library and every dependent crosswalk were rebuilt against the new statutory text.

Question 10

Which laws and frameworks does the platform cover?

Accepted Answer

NIST AI RMF, ISO/IEC 42001 and ISO/IEC 42005; SOC 2 (the Trust Services Criteria); every dedicated U.S. state AI law, added as they pass (Colorado ADMT Act (SB 26-189); Colorado Chatbot Safety (HB 26-1263); Connecticut SB 5 (PA 26-15); Texas TRAIGA; California ADMT Regulations; Hawaii AI Acts (247 / 248); Alabama AI laws; Arizona AI laws; California AI laws (other statutes); Colorado AI laws (other statutes); Connecticut AI laws (other statutes); Delaware AI laws; Florida AI laws; Georgia AI laws; Idaho AI laws; Illinois AI law & guidance; Indiana AI laws; Iowa AI laws; Kansas AI laws; Kentucky AI laws; Louisiana AI laws; Maine AI laws; Maryland AI laws; Minnesota AI laws; Montana AI laws; Nebraska AI laws; Nevada AI laws; New Hampshire AI laws; New Jersey AI laws; New York AI laws; North Dakota AI laws; Oklahoma AI laws; Oregon AI laws; Rhode Island AI laws; South Carolina AI laws; Tennessee AI laws; Texas AI laws (other statutes); Utah AI laws; Vermont AI laws; Virginia AI laws; Washington AI laws; Wisconsin AI laws; Wyoming AI laws); the EU AI Act, HIPAA, GDPR and CCPA; and five enable-as-one-unit jurisdictions — U.S. National (federal law and the state landscape), Canada, an AI frameworks, standards and healthcare-guidelines pack, Europe (EU regulation beyond the Act, Italy, the UK, Switzerland and Norway) and Global (twenty further countries plus the international instruments). In the United States the NAIC AI Model Bulletin for insurers is included from Starter. Every framework has a compliance crosswalk — shelved as Frameworks, United States, EU, Canada and Global — showing exactly which requirement is covered by which policy clause, and which are still gaps.

Question 11

Does Colorado's ADMT Act (SB 26-189) apply to my organization?

Accepted Answer

It applies based on what your organization does with AI — specifically, whether you develop or deploy automated decision-making technology that influences a consequential decision about a consumer (hiring, lending, housing, and similar) — not on your headcount or revenue. There's no blanket small-organization exemption. It takes effect January 1, 2027, alongside Colorado's separate Chatbot Safety Act (HB 26-1263) for consumer-facing chatbots. Both are covered from the Starter plan.

Question 12

Does the EU AI Act apply if my organization isn't based in the EU?

Accepted Answer

Often yes. The EU AI Act applies extraterritorially to any provider or deployer whose AI system's output is used in the EU, including a US organization serving EU-based clients, donors, or program participants — it doesn't turn on where you're incorporated.

Question 13

What if more than one framework applies to us at once?

Accepted Answer

That's the common case, not the exception. The right approach is one AI governance program — inventory, risk register, policies, training, incident log — with a crosswalk mapping it to whichever specific frameworks actually apply to you, rather than a separate, disconnected effort per law.

Question 14

Which frameworks are included at each plan tier?

Accepted Answer

Starter includes NIST AI RMF, ISO/IEC 42001, every dedicated U.S. state AI law (Colorado ADMT Act (SB 26-189); Colorado Chatbot Safety (HB 26-1263); Connecticut SB 5 (PA 26-15); Texas TRAIGA; California ADMT Regulations; Hawaii AI Acts (247 / 248); Alabama AI laws; Arizona AI laws; California AI laws (other statutes); Colorado AI laws (other statutes); Connecticut AI laws (other statutes); Delaware AI laws; Florida AI laws; Georgia AI laws; Idaho AI laws; Illinois AI law & guidance; Indiana AI laws; Iowa AI laws; Kansas AI laws; Kentucky AI laws; Louisiana AI laws; Maine AI laws; Maryland AI laws; Minnesota AI laws; Montana AI laws; Nebraska AI laws; Nevada AI laws; New Hampshire AI laws; New Jersey AI laws; New York AI laws; North Dakota AI laws; Oklahoma AI laws; Oregon AI laws; Rhode Island AI laws; South Carolina AI laws; Tennessee AI laws; Texas AI laws (other statutes); Utah AI laws; Vermont AI laws; Virginia AI laws; Washington AI laws; Wisconsin AI laws; Wyoming AI laws) and the U.S. National jurisdiction (federal law and the state landscape). Pro adds ISO/IEC 42005; CCPA; U.S. state privacy laws; SOC 2 (Trust Services Criteria); New York DFS cybersecurity regulation (23 NYCRR 500); NAIC AI model bulletin (insurance); NAIC Insurance Data Security Model Law (#668); NIST SP 800-53 Rev. 5; NIST Cybersecurity Framework (CSF) 2.0; Canada; AI frameworks, standards & healthcare guidelines. Agency adds EU AI Act; HIPAA; GDPR; Global privacy laws; Europe — EU regulation, Italy, UK, Switzerland, Norway; Global — Americas, Middle East, Asia-Pacific, Central Asia & international. Free previews NIST AI RMF only. The EU AI Act, HIPAA and GDPR are Agency-only — they are not included on Pro. See the full comparison table for the complete breakdown by feature.

Question 15

Is my organization's data shared with, or visible to, other customers?

Accepted Answer

No. Every organization's data is logically isolated by organization ID, enforced in application code and at the database level. No organization can query or view another organization's records. If you work with a GOVERNBOX.ai partner firm, you can let them work in your workspace; everything they do appears in your Audit Log under their firm's name.

Question 16

Is my data used to train the AI model?

Accepted Answer

No. We never train or fine-tune on customer content, and never log tenant content beyond what's needed to operate the product.

Question 17

Is my data encrypted, and how is access controlled?

Accepted Answer

Data is encrypted in transit and at rest, and access is governed by your organization's own role-based permissions (Owner, Admin, Member) plus platform-level authentication. Two-step sign-in is available on every account, and your organization can require it.

Question 18

Where is my data stored, and can I request deletion?

Accepted Answer

Data is hosted with reputable infrastructure providers in the United States. You can request account and data deletion at any time — see our Data Usage Policy for details, or contact us directly.

Question 19

What subscription tiers are available, and what does each include?

Accepted Answer

Starter ($3,500/yr, or $339/mo billed monthly), Pro ($12,000/yr, billed annually), and Agency / Enterprise (starting at $25,000/yr, billed annually — the fixed plan is bought online; custom setups with extra seats, several workspaces, SSO rollout or invoiced billing are quoted in writing at governbox.ai/enterprise) — each unlocking progressively more frameworks, deeper feature versions, and more seats. Starter and Pro prices are for one module. There is no free plan: the Readiness Scorecard is free. See the full pricing and comparison table on our homepage or /plans page.

Question 20

Do you offer a nonprofit discount?

Accepted Answer

Yes — nonprofits save 20% on every plan (Starter, Pro and Agency / Enterprise). The nonprofit price is printed on each pricing card, so you never have to work it out. The rate is public and selectable at checkout.

Question 21

Can I change plans or cancel at any time?

Accepted Answer

Yes. Billing is handled through our billing provider's own self-service tools, accessible from your Admin Console — upgrade, downgrade, or cancel whenever you need to. Every paid plan can also be paid by U.S. bank transfer (ACH).

Question 22

Is pricing per seat, or flat per organization?

Accepted Answer

Each tier includes a set number of admin seats (Starter 10, Pro 15, Agency 20); staff who report AI tools, sign policies and complete training need no seat and are unlimited on every paid plan. The core price itself is a flat, per-organization annual (or, for Starter, monthly) subscription — not metered by usage.

Question 23

Can I see it before I buy?

Accepted Answer

Yes. The Readiness Scorecard is free with no card and no account, and the demo library walks through each module. If you want to talk it through first, Talk to Sales is one click away.

Question 24

What types of documents can I generate?

Accepted Answer

AI Use Policy, AI Acceptable Use Standard, Privacy Policy (from Starter), Privacy Notice and Individual Rights Request Procedure (Pro), Notice of Privacy Practices (with HIPAA), AI Incident Response Plan, Vendor AI Risk Assessment, AI Strategic Plan, AI Committee Charter, CAIO Position Description, an AI Systems Program for insurers (with the NAIC bulletin), the policies that come with the Enterprise Risk, IT and Data modules — the Data Management Policy among them — and (Agency tier) an OMB AI Compliance Plan. All are grounded in the control library and tailored to your organization. You can also upload a policy you already have (Word or PDF); it is kept as written and clearly marked Imported, so it is never presented as grounded.

Question 25

Can I edit a generated document before approving it?

Accepted Answer

Yes. Every document section is click-to-edit, and you can also export a draft as a Word document to mark up externally before pasting edits back in — the built-in review workflow is designed around exactly that pre-approval editing step.

Question 26

What formats can I export to?

Accepted Answer

PDF and Word. Approved, paid-tier documents export cleanly with your organization's branding; Free-tier previews carry a watermark.

Question 27

Does a document need to be approved before we can rely on it?

Accepted Answer

Yes — every generated document goes through an explicit human review and approval step inside the product before it's considered your organization's official policy. This is by design: generated documents are drafting aids, not automatically-binding output.

Question 28

Besides policies, what else does the platform track?

Accepted Answer

An AI use case inventory, vendors and the AI systems behind them, Shadow AI Discovery (which AI tools staff actually use), a risk register (likelihood × impact scoring) with suggested risks for each use case, impact assessments, a training plan, an incident log, governance meeting minutes, a project board for AI initiatives, a Program Map of how it all connects, an AI agents inventory (with a zero-trust checklist on Agency), a Control Evidence Ledger on Pro, and a quarterly board report built around the five questions every board should be able to answer.

Question 29

How do we manage the risk from AI vendors?

Accepted Answer

Every plan has a vendor register: each vendor is approved, restricted or retired by an Admin, and a use case cannot go live on a restricted vendor. On Pro you can send a vendor a plain-language AI due-diligence questionnaire that they answer on a private link, with no account to create, and track their data-processing and business associate agreements. See governbox.ai/vendor-risk-assessment.

Question 30

Can you show us which AI tools staff are actually using?

Accepted Answer

Yes. Shadow AI Discovery, a browser extension your IT team deploys, shows which AI tools are used and how often, from Starter, without reading what anyone types, pastes or uploads. On Pro, Shadow AI Discovery+ also brings in the app lists from Okta, Google Workspace, Microsoft Entra, Netskope, Zscaler or Cloudflare One. Everything it finds waits for your review.

Question 31

How do we show an auditor that our controls actually work?

Accepted Answer

On Pro, the Control Evidence Ledger checks each control against your own records — owners, attestations, training, incidents, vendors, meetings — shows the records behind every verdict, and builds an Audit Packet in one click. SOC 2 (Pro) has its own crosswalk.

Question 32

Can GOVERNBOX.ai connect to our other systems?

Accepted Answer

Yes. A REST API lets your own scripts read records from Starter and create or update them from Pro; signed webhooks (Pro) tell your systems when something changes; Zapier, Jira and ServiceNow can send AI-tool requests into your review queue (Pro); and an MCP server lets your own AI agents read your inventory and file items for human review. Step-by-step setup is at governbox.ai/integrations.

Question 33

How do I ask a question or report a bug?

Accepted Answer

Use the Contact page — general questions are open to everyone, no account required, and subscribed organizations get a dedicated system-issue reporting channel.

Question 34

Can I talk to a real person, not just get AI-generated documents?

Accepted Answer

Yes. GOVERNBOX.ai Advisory Services is a separately-priced engagement line delivered by the people who built the platform: Executive Strategy Session, Half-Day Training, Agentic Oversight Setup, Guided Launch, Custom Governance Integration — plus an ongoing monthly retainer for organizations that want a standing cadence. Every engagement has a fixed scope and a fee published on the page, so you never need a discovery call to learn a number. See governbox.ai/advisory. The Agency plan includes one advisory session; everything else can be bought on its own, on any plan, with or without a subscription.

Question 35

Do we need the advisory engagements to get value out of the platform?

Accepted Answer

No — and we would rather you start without them. The platform is built to be run by a non-specialist: the free Scorecard shows where you stand, a plan gets a real program in place, and most organizations need nothing beyond a subscription. Advisory exists for the cases where that genuinely isn't enough — no one internally owns AI yet, a board or funder deadline is closer than the learning curve, or an existing GRC and audit estate has to be reconciled rather than replaced. If you have someone who owns AI, a few months of runway, and the willingness to work through the platform, buy a subscription and skip us.

Question 36

We already work with a consultant or MSP on governance. Should we still talk to you?

Accepted Answer

Talk to them first. If a GOVERNBOX partner already runs governance for you, they lead the engagement and we support them rather than competing for the work — that is the whole point of the Partner Program. If they would rather you work with us directly, or you have no partner of record, we are glad to engage.

Frequently Asked Questions

About the product

Trust & accuracy

Frameworks & compliance coverage

Security, privacy & multi-tenancy

Pricing & billing

Documents & features

Getting help