Quick answer
An admin enables the copilot under Settings > AI. It's available on the Professional and Enterprise plans, is off by default, and activation shows you the processing terms first: inference runs on EU-hosted models, your data is not used to train anyone's models, and every answer cites its sources. Once enabled, the copilot appears throughout the workspace.
What the copilot does
- Answers questions with citations: "Does NIS2 apply to our subsidiary?", "What's missing for ISO 27001 certification?" Answers are grounded in legal texts, MSB regulations, and your own workspace data through retrieval-augmented generation.
- Drafts policies adapted to your actual environment, using facts from your integrations rather than generic boilerplate.
- Drafts questionnaire answers. Feed it a customer's security questionnaire and it proposes answers from your live control data; see can AI answer security questionnaires.
- Summarizes for audiences: an incident timeline into a management summary, or a quarter of findings into a board paragraph.
Everything it produces is a draft pending human review. Nothing the copilot writes auto-publishes, signs, or submits.
The governance answers your DPO will ask for
Enabling an AI feature in a compliance tool rightly triggers scrutiny, so the answers are documented in the activation flow:
- Hosting: EU-hosted LLMs; prompts and retrieved context don't leave the EU.
- Training: your data is never used for model training.
- Scope control: admins can restrict which data the copilot may retrieve from (for example, excluding incident records).
- Logging: copilot usage is logged like any other workspace activity.
Add the copilot to your own AI system inventory if you maintain one under the AI Act workflow; it's a limited-risk transparency case, and the platform pre-fills the entry.
If you leave it disabled
Everything else works without it. The copilot accelerates drafting and Q&A, but scoping, monitoring, evidence collection, and reporting are deterministic platform features, not AI features. Enable it when your governance review is done, not before.

Get a personalized walkthrough of automated compliance for your team. No commitment required.