Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How does compliance chat use AI?
Last verifiedCompliance chat is a READ-ONLY generative Anthropic path: answerComplianceQuestion in src/lib/compliance/chat.server.ts loads your org readiness view, grounds Claude on it, and returns prose — no tools, no DB writes, no path from the model to a verdict.
Compliance chat, last verified 11 September 2026 against src/lib/compliance/chat.server.ts and src/lib/ai/org-ai.server.ts. Not legal advice.
Audience
Audience: an org admin or compliance lead using the in-app compliance Q&A. This page describes shipped server behavior — not legal advice and not a substitute for counsel.
What the code does
src/lib/compliance/chat.server.ts implements answerComplianceQuestion. It loads the org readiness view (loadReadinessView), drift, evidence integrity, policies, and calendar, builds a grounding context, and calls Anthropic through createOrgAiClient from src/lib/ai/org-ai.server.ts.
The model call is plain text — max_tokens: 1024, no tools. The file header states READ-ONLY: no DB writes, no tools, no path from the model to a verdict. Usage is recorded under feature compliance_chat via src/lib/ai/usage.server.ts. The model is resolved by resolveFeatureModel in src/lib/compliance/sox/ai-provenance.server.ts.
| Claim | True in code? | Module |
|---|---|---|
| Generative (calls Anthropic) | Yes | src/lib/compliance/chat.server.ts |
| Grounded on org readiness view | Yes | loadReadinessView in chat.server.ts |
| Can issue a compliance verdict | No — no verdict path | chat.server.ts header |
| Org can disable all LLM paths | Yes — isOrgAiDisabled | src/lib/ai/org-ai.server.ts |
| Globally flag-gated | Yes — isComplianceChatEnabled | src/lib/env |
| Deterministic score | No — this is generative, not a grader | N/A |
What you need to do now
If your security review asks whether AI auto-grades compliance: say no — scores are deterministic graders (see /docs/how-we-use-ai/measured-ai); compliance chat only explains your readiness view in natural language.
To block all third-party LLM calls for your tenant, enable Disable third-party AI in Organization settings — enforced server-side by createOrgAiClient before any Anthropic construction.
Checklist
Verify these items before enabling or citing compliance chat in a review.
- Confirm isComplianceChatEnabled is on for your deploy before expecting the UI.
- Confirm your org has not set aiDisabled in organization settings.
- Treat answers as explanatory — not legal advice, not a certification, not a verdict.
- Review what readiness data is included in grounding (frameworks, gaps, policies, calendar).