AI Assistant
Ask questions about your own register data and draft records with the assistant.
9 min read8 sectionsAll roles
The AI assistant answers questions about your organisation's own risk and compliance records, and drafts text for new records and updates. Use it to find and count records, check what is linked to what, or get a first draft you then review and submit as a proposal.
The assistant, headed ShelfGRC AI on most pages, sits at the foot of the main pages and beside the forms where you create and change records.
Dashboard, registers and workflow pages
At the bottom of the Dashboard, each register (Risks, Controls, Obligations, Incidents, Policies, Evidence, Treatment Plans), Proposals, Reports and Settings. On Uploads the same assistant appears as a card titled Upload Assistant.
Create and update forms
An AI Assistant panel beside the form when you click New or Propose Update. This is where Fill Form works.
Executive Overview
At the bottom of the overview, for owners and admins. A request for a summary or report is answered with a structured summary built from your registers.
Reporting Canvas
In a side panel of the canvas editor on wide screens, for owners and admins.
- 1
Type your question
Or click one of the suggested prompts under the box to place it there for editing.
- 2
Press Enter to send
Use Shift+Enter for a new line. The answer streams in as it is written.
- 3
Ask a follow-up
The assistant remembers the conversation while you stay on the page. Leaving the page starts a new one.
Answers are built from your organisation's records and ShelfGRC's reference material, limited to what you can see.
- Your records
Searches your risks, controls, incidents, evidence, policies and treatment plans for the records most relevant to your question.
- Counts and breakdowns
Counts records exactly, including by category, for risks, controls, policies, obligations, evidence, treatment plans and incidents.
- Linked records
Counts what a record is linked to, naming each linked record by key and title (with a control's effectiveness rating), when you name it by its register key (or several), ask from that record's form, or point at the records the assistant just listed ("what controls do these risks have?"). It also answers for a category, such as "which controls are linked to our cyber security risks?", covering the first 12 records in it and saying how many there are.
- Your taxonomy
Reads your organisation's own category trees, so it can suggest a primary and secondary category from your real list.
- Frameworks and product help
Framework reference material and guidance on how ShelfGRC works.
Sensitive records are kept out of every AI feature, whoever is asking.
The assistant only ever reads records that are Public and Non-privileged. It never sees Confidential, Privileged or Highly sensitive records, for any user, including owners and people who hold Confidential or Privileged access. The same applies to the AI Narrative block on the Reporting Canvas.
The assistant does not give legal or regulatory guidance and never cites legislation.
If you ask for regulatory, legislative or legal guidance, the assistant replies with this sentence instead of an answer:
I am unable to provide regulatory or legislative guidance. Every business, sector and country has specific legal and regulatory requirements. You should consult an internal or external legal or compliance specialist.
- [legislative reference withheld]
Replaces the name of a law, regulation or section wherever it would appear in an answer or its sources, including when it is the title of one of your own records. Refer to such records by their register key.
- Answer withdrawn
If an answer turns into a discussion of the law, it is removed while it is being written and replaced with the sentence above.
Each answer shows where it came from and tells you when it is incomplete.
- Sources
Listed under the answer. Each source is labelled Your Data (your organisation's records) or General Knowledge (reference material), with its register key, title, record type and a relevance percentage. A definition or general-knowledge question may still cite Your Data sources, using real records from your register as worked examples. Check a key against the register before relying on it.
- Cut-off notice
"This answer was cut off before it finished." The answer hit its length limit. Ask for a shorter version, or for the rest of it.
- No relevant information
"I don't have specific information about this topic in my current knowledge base." Nothing relevant was found, so the assistant does not guess. Rephrase, or name the record by its key.
- AI-generated note
Answers end with a reminder that it is AI-generated, may be incorrect or incomplete, and is not professional, legal or compliance advice.
- Copy and Regenerate
Icons under each answer copy it to your clipboard or ask again for a new answer.
In a create or update form, the assistant can write the text fields for you; the record still goes through approval.
- 1
Open the form
Click New in the top bar, or Propose Update on a record. The AI Assistant panel sits beside the form, or below it on a narrow screen.
- 2
Ask for a draft with labelled sections
For example: "Draft a title, risk statement, causes and consequences for losing a key supplier."
- 3
Click Fill Form
The button appears under an answer that has labelled sections such as Title and Description. Filled fields show an AI filled badge for a few seconds.
- 4
Review and complete the form
Edit the drafted text, then set every other field yourself.
- 5
Submit
Click Submit (propose) or Submit Update (propose). The record becomes a proposal and changes nothing until an owner or admin approves it. See the Proposals guide.
Fields Fill Form can write
- Risk
Title, Risk Statement, Causes, Consequences.
- Treatment plan
Title and Mitigating Actions, plus Description when you are proposing an update.
- Control, policy, obligation, incident, evidence
Title and description.
Specific questions about your own records get the best answers.
- How many risks do we have in each category?
- Which risks have no treatment plan?
- How many controls is RSK-004 linked to? (use one of your own register keys)
- Which controls are linked to our cyber security risks? (use one of your own categories)
- Summarise overdue treatment plans by owner.
- Suggest a primary and secondary category for a risk that a key supplier fails to deliver.
- What is the difference between inherent and residual risk?
- How does the proposal approval workflow work?
- In a new control form: Draft a title and description for a control that reviews user access every quarter.
What leaves your screen when you ask a question, and who can read it afterwards.
- What you type is sent to the AI model, together with a short summary of the page you are on, such as the counts and filters on the Risks page, or the title of the record you are editing.
- The sensitivity restriction above controls what the assistant retrieves, not what you type. Do not paste Confidential, Privileged or Highly sensitive content into it.
- Your conversations are saved to your own account. Other users in your organisation, including owners, cannot open them.
- There is a limit on how many questions one person can ask in a short period, and your organisation may have a monthly AI usage limit.