Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How does ShipReady Metrics use AI?
Last verifiedShipReady Metrics ships eight customer-facing AI surfaces: one generative compliance chat, one extractive trust-buyer classifier, deterministic score graders, telemetry ingest, usage metering, cost lookup, provenance registry, and UI labels — documented from code, not legal advice.
How we use AI overview, last verified 11 September 2026 against the shipped modules cited on this page. Not legal advice. Does not certify your organization or determine regulatory applicability.
Audience and honesty contract
Audience: a buyer, security reviewer, or compliance lead evaluating what ShipReady Metrics actually does with AI. This cluster documents shipped behavior from code — not marketing claims, not legal advice, and not a guarantee of compliance.
Three classes matter: measured (deterministic graders, metering, Admin API cost — not LLM), generative (compliance chat calls Anthropic with org readiness context), and extractive/classifier (trust buyer chat is not a generative bot — it routes to controlled templates). Labels and ingest are neither generative nor scoring.
Customer-facing AI surfaces (from code)
Every surface below maps to a shipped module. Surfaces not listed are not claimed.
| Surface | Class | Module path | What it does |
|---|---|---|---|
| Compliance chat | generative | src/lib/compliance/chat.server.ts via createOrgAiClient (src/lib/ai/org-ai.server.ts) | READ-ONLY Anthropic chat grounded on the org readiness view; no tools; no path from the model to a verdict. Flag-gated (isComplianceChatEnabled). Org can disable all LLM paths (isOrgAiDisabled). |
| Public trust buyer chat | extractive-classifier | src/app/api/trust/chat/route.ts; src/lib/compliance/trust-buyer-faq.ts; src/lib/compliance/trust-buyer-chat.server.ts | Deterministic FAQ first; citation-gated Anthropic classifier fallback (max_tokens: 12 topic token). Grounded only on published PublicTrustCenterView. Not a generative bot. No question persisted. |
| AI-generated badges | label | src/components/compliance/ai-generated-badge.tsx | UI label for AI-generated artifacts (attested / rejected / pending / legacy). Not a generative feature. |
| AI ROI / AI Readiness / Agent Health | measured | src/lib/scoring/scores/ai-roi.ts; src/lib/scoring/scores/ai-readiness.ts; src/lib/scoring/scores/agent-health.ts | Deterministic graders, not LLM. Null dimensions omitted — never baseline-filled. |
| Agent-telemetry ingest | ingest | src/lib/agent-telemetry/ingest.ts; src/app/api/ingest/agent-telemetry/route.ts | Privacy: no prompts in telemetry — only redacted metadata and refs. |
| Anthropic Admin API cost | measured | src/lib/ai/anthropic-admin.server.ts | Real cost/usage when ANTHROPIC_ADMIN_KEY is set; otherwise null / estimates. Failure is always null, never zero. |
| Org AI usage metering | measured | src/lib/ai/usage.server.ts | Best-effort token/cost recording per feature (e.g. compliance_chat, trust_buyer_chat). |
| Feature model registry / AI provenance | measured | src/lib/compliance/sox/ai-provenance.server.ts (resolveFeatureModel) | Pins model per (org, feature) when approved+active config exists; fail-safe default ANTHROPIC_MODEL / claude-opus-4-8. |
What you need to do now
Read the surface-specific pages in this cluster before answering a security questionnaire about AI. If you disable third-party AI for your org, every LLM path — including compliance chat and the trust buyer classifier — is blocked server-side via isOrgAiDisabled.
For scores, connect the relevant data sources; AI ROI, AI Readiness, and Agent Health are deterministic graders that read Not measured when inputs are absent — not LLM — and do not invent numbers.
- Review /docs/how-we-use-ai/compliance-chat if buyers ask about in-app compliance Q&A.
- Review /docs/how-we-use-ai/trust-buyer-chat if buyers ask about the public trust-center chat widget.
- Review /docs/how-we-use-ai/measured-ai for scores, metering, cost, badges, telemetry, and provenance.
Checklist — before you cite this product in a review
Use this checklist when answering security questionnaires about ShipReady Metrics AI surfaces.
- Confirm which surfaces are enabled for your deploy (global flags and org AI-off setting).
- Distinguish measured deterministic scores from generative compliance chat and from the extractive trust-buyer classifier.
- Confirm agent telemetry ingest never stores raw prompts — only redacted metadata/refs.
- Confirm trust buyer chat answers only from the published PublicTrustCenterView — not your full tenant data.
- Note the Last-verified date on each page; re-read when upgrading ShipReady Metrics.