Twenty tools
The real number is almost always larger than the list you keep. Capabilities a vendor added to software you already licensed count. So does the tool a department adopted without telling anyone.
Regulatory Intelligence for AI Deployments
Every AI deployment is a separate legal question.
Twenty tools, two use cases each, three jurisdictions. That is a hundred and twenty determinations — every one a real question of law, and none of them made faster by the hundred and nineteen before it. Expertise is not the constraint. Hours are.
The determination
Tool × use case × jurisdiction × industry × data type
The proof
Every finding cited to primary statutory source
The engine
Patent-pending Meridian™ Engine
The arithmetic
The problem was never that the law is unknowable.
It is that the work scales with your tool inventory, and your team does not. Every new tool multiplies against every use case and every place a person sits.
Two use cases each
The same model screening candidates and answering billing questions is two different objects under the law. Regulatory weight follows the decision, not the software.
Three jurisdictions
Obligations attach by where the person is, not where you are. One tool used across twelve states is twelve separate applicability questions.
The gap
120 determinations.
One person to make them.
You are not uninformed. You are outnumbered. Every hour spent establishing which rules apply is an hour not spent on the judgment only you can supply — whether what you found is acceptable, and what to do about it.
Five axes, one answer
Change one axis. Watch the law change with it.
This is the whole company in one object. Name the deployment along five axes and the applicable corpus resolves — including what was assessed and found not to apply.
Determination · Tool × use case × jurisdiction × industry × data
Illustrative
Use case
Jurisdictions
Industry
Data types
0
Instruments that attach
A demonstration of the shape of a determination, not a determination. Four toggles is the teaching version; the real intake also asks what these axes turn on — human review and how consistent it is, solely-automated decisions, vulnerable populations, entity thresholds — and which controls you already have. A real LegisGate Compass™ Report is built from that, evaluated against the full corpus, and every finding is cited to primary statutory source, including the instruments assessed and found not to attach.
The credential chain
Four links. Break any one and the document is worthless.
Most tools can tell you a law exists. The value is in the unbroken line from a sentence in your report back to a sentence in a statute.
Link 01
Primary source
Every provision in the LegisGate Meridian™ is opened at its official text and pinned to a resolvable URL. No nicknames, no plausible neighbours, no citation that only looks statute-shaped.
Link 02
Determination
Your intake is evaluated against that corpus by the patent-pending Meridian™ Engine — deterministic code, not a model asked to guess which laws feel relevant.
Link 03
The document
Findings carry the citation they were determined from. Where the corpus cannot support a claim, the document says so rather than filling the space.
Link 04
Your counsel
They open the cite, read the provision, and see that it says what we said it says. Sufficiency is their call. It was always going to be.
What we will not do. We do not certify compliance, and no document we produce satisfies a legal obligation on its own. We identify, map, document and prepare. Your counsel decides whether what we found is enough.
One determination, three deliveries
The same intelligence, shaped to the moment you are in.
Compass answers what applies. Dynamic Assessments fill the regulatory half of the documents those laws require. Govern keeps the record true after the day you filed it.
01 · Determine
LegisGate Compass™
Name the tool, the use, the jurisdictions, the industry and the data. Receive a cited report of what attaches — and what does not.
The report →
02 · Prepare
LegisGate Dynamic Assessments™
DPIA, FRIA, PRA and DPA scaffolds arriving pre-populated with the regulatory half, in the official format where an official format exists.
The documents →
03 · Maintain
LegisGate Govern™
Obligations with an owner, a date and evidence. When the corpus moves, the record tells you which of your documents just aged.
The workspace →Before the letter arrives
Five questions you should be able to answer today.
Not one of them is answered by knowing the law. All of them are answered by records that were made before anybody asked.
01
Which AI systems are actually in production?
Including capabilities a vendor added to software you already licensed, and tools a department adopted without central review. Most organizations find the real list is longer than the one they keep.
02
What decision does each one make or influence?
Regulatory weight concentrates on consequential decisions — credit, housing, employment, healthcare, education, insurance, access to essential services. A scheduling assistant and an underwriting model are not the same object under the law.
03
Whose residents does each system touch?
Obligations attach by where the person is, not where you are. One tool used across twelve states is twelve separate applicability questions.
04
Where is the assessment — or the documented decision that none was required?
Both answers are defensible. Neither is defensible undocumented. An empty file does not read as not required. It reads as not considered.
05
Who owns each obligation, by name — and when did the review begin?
An owner is a person, not a department. And the date is the one answer on this page that cannot be produced later: a record created after an inquiry arrives is evidence of reaction, not of process.
If assembling these answers would take more than a few days, that is itself the finding. An inquiry rarely allows more time than that.
Writing
The questions, before somebody makes you answer them.
Field notes for the person who will be asked whether a deployment is defensible. No product tours, no gated PDFs, no email required.
We asked a leading chatbot if a hospital's newest AI system was compliant. It said yes.
A confident answer, produced in seconds, with no citation anybody could open. We ran the same deployment through a determination and compared what each one could actually show.
Read →EU AI Act for deployers: what privacy teams need to know before December 2027
Most of the writing addresses providers. The deployer obligations are shorter, land sooner in practice, and are the ones your organisation is most likely to be holding.
Read →Does your board still have AI coverage? Maybe not.
D&O policies were written before deployers carried statutory duties of their own. What the exclusions now say, and the question to put to your broker.
Read →
Start where the exposure is
One tool. One use case. 15 minutes.
Pick the deployment that would be hardest to explain in a letter. Run it first. Fifteen minutes of intake will tell you whether the rest of the inventory is a problem.