Say yes to the customer in the next country.

The case every growing compliance platform meets

A compliance platform builds its controls and its assistant on one country's NIS 2 law. Then a customer from another member state signs, asks about their own obligations, and gets answers from the first country's law. That country transposed the same directive into its own statute, with its own entity categories, reporting chain and registration deadline. Loading the new law into the assistant's shared knowledge changes answers for every existing customer. Leaving it out leaves the new customer with a law that is not theirs. Every platform that sells into a second country meets a version of this: NIS 2 is transposed separately by each member state, each with its own statute or pending bill.

How it fits in your product

1. 01

   Route by customer

   Your backend already knows where each customer operates. Map that to catalog ids: NIS_2_IT for Italy, NIS_2_NL for the Netherlands, plus whatever else the customer is under, such as GDPR, ISO_27001 or DORA.

2. 02

   Pin the modules on each request

   Send them in ismscopilot.frameworks, up to 8 per request. Only that request gets those modules. The next customer's request carries its own, so nothing leaks between them.

   import os
   from openai import OpenAI
   
   client = OpenAI(base_url="https://api.ismscopilot.com/v1", api_key=os.environ["ISMS_API_KEY"])
   
   # Your backend already knows where each customer operates.
   NIS2_BY_COUNTRY = {"BE": "NIS_2_BE", "IT": "NIS_2_IT", "NL": "NIS_2_NL"}
   
   def ask(tenant, messages):
       frameworks = [NIS2_BY_COUNTRY[tenant.country], *tenant.frameworks]  # at most 8
       return client.chat.completions.with_raw_response.create(
           model="isms-fast",
           messages=messages,
           extra_body={"ismscopilot": {"frameworks": frameworks}},
       )
   
   # Log response.headers["x-isms-frameworks"] with the answer.

   Copy
3. 03

   Log what ran

   Every response names the injected modules in the x-isms-frameworks header and the ismscopilot object. Store it next to the answer, so support and your compliance team can see which law an answer stood on.

4. 04

   Keep your assistant's voice

   Set ismscopilot.system to "none" and our persona steps aside: your system prompt stays in charge, and the framework knowledge is still injected.

5. 05

   Know when a law changed

   Poll GET /v1/frameworks/changelog, public and cacheable with an ETag, and filter on the ids your customers use. Each event says what changed and when.

One shared knowledge base, or modules per request

What is in the catalog

130+ modules. GET /v1/frameworks lists them live, with each module's version and last-verified date, and needs no key.

NIS 2

A module for each of the 27 member states, tracking its national law, plus the directive and Implementing Regulation (EU) 2024/2690. Where a country has not adopted its law yet, the module says so and tracks the draft.

Data protection

GDPR plus national laws such as Germany's BDSG, the Dutch UAVG, UK GDPR and Switzerland's FADP

Financial sector

DORA and its technical standards, Swiss FINMA circulars

Standards

ISO 27001, ISO 27701, ISO 42001, SOC 2, TISAX, HDS and more, as original reference notes, never the copyrighted text

Beyond Europe

China, Japan, India, Australia, Canada, Singapore and others

How the knowledge stays current

Each module is checked against its official publisher: the Dutch Staatsblad, Italy's Gazzetta Ufficiale, the EU Official Journal. An update is verified against the primary source and reviewed by two independent AI models before it merges, with an evidence record of the source it was read from, and reaches production with a release. The catalog's last_verified date says when a module's edition was last checked; it is not a promise that every sentence is right. Your compliance experts still decide what your product tells customers. The API takes the legwork of keeping the law library current.

What it does not do

• It is not the full statute text. Modules are curated reference notes with section numbers. For a word-by-word comparison, pass the official text in the request.
• It does not add a country to your platform. Your controls, templates and implementation steps stay yours to build.
• No per-customer sub-accounts yet. To split usage by customer, give each one its own key: up to 20 active keys per user, each with its own spend cap, all drawing on that user's prepaid credits.
• No webhook for knowledge changes. Poll the changelog.
• Text only: no tool calling, no JSON mode.

Where to go next

• Serve customers in many countries

  The docs guide: routing, pinning, logging, the changelog

• The ISMS Copilot API

  Models, rates, limits, Zero Data Retention

• NIS 2 transposition tracker

  Where each member state stands

• Netherlands: NIS 2

  The module pinned in the example request

• Build vs buy compliance AI for a GRC product

  The wider decision

• No assistant of your own yet?

  Embed ours in your product instead

Frequently Asked Questions