Compliance and the Audit Assistant
The Compliance tab of My Organization shows how your organization’s AI safeguards stand against the laws, professional codes and standards that apply to you, worked out from your own settings and activity. It covers laws from Canada, the United States, the European Union, the United Kingdom and other countries, codes for lawyers and other professions, and standards such as ISO/IEC 27001 and SOC 2.
The tab has two states:
- Before you save a compliance profile: the tab shows one card, Set up compliance, with a few questions. Your answers decide which laws and frameworks are covered. The Audit Assistant and the report options appear once you save.
- Once you save a profile, even one with no answers, the tab shows, from
top to bottom:
- A profile line: your compliance profile in one line, with Edit profile.
- The Audit Assistant: where you stand, law by law, and the fixes that help the most.
- The Reports card: the AI Safeguards Report, a PDF for your privacy officer, auditors or board, and Email the report, the same PDF sent every month or every quarter.
- One line that says what the results are based on, and that they’re not a certificate of compliance or legal advice.
Fill in your compliance profile
Your profile decides which laws and frameworks the Audit Assistant and the report cover. PIPEDA, the federal law, is always included. Your answers bring in the others.
Until you save a profile, the Compliance tab shows only the Set up compliance card. To set up your profile:
- On My Organization, open the Compliance tab.
- In Set up compliance, answer the questions in each step: Where you operate, What you do and Who’s in charge. To move on, click the Next button, such as Next: What you do. To go back, click Back.
- On the Review step, add any standards you follow, and check Your answers.
- Check the list under Your report will cover. See Your report will cover.
- Click Save and see where you stand.
The tab then shows the profile line, the Audit Assistant and the reports.
To stop partway, click Save and finish later on any of the first three steps. Your answers so far are saved, and the tab shows where you stand with them. To finish, click Edit profile.
You can also click a step’s name, in the row at the top, to go straight to it. If the person in charge’s work email isn’t valid, you can’t save until you correct it.
To change your answers later, see Change your profile.
Where you operate
- Which provinces and territories do you operate in? Type part of a name in the box, and pick it from the list. Each one you pick shows as a chip. To remove one, click the × on its chip. Click All of Canada to pick them all, or Clear to remove them all. Quebec, Alberta and British Columbia bring in their private-sector privacy acts. PIPEDA, the federal law, is always included.
- Do you operate in other countries, or offer services to people there? Choose Yes if you operate in another country, or offer services to or monitor people who live there. Yes shows ten countries: pick each one that applies. Choosing No removes the countries you picked.
- Which US states’ residents’ information do you handle? Appears once you pick United States. Type part of a state’s name, and pick it from the list. California brings in the CCPA. The other states, apart from New York, bring in US state privacy laws. New York’s cybersecurity regulation follows a sector instead: see below.
Each country brings in its own laws:
| Country | Brings in |
|---|---|
| United States | FTC Act s. 5, and the state laws above |
| European Union | GDPR and the EU AI Act |
| United Kingdom | UK GDPR |
| Switzerland | Swiss FADP |
| Brazil | LGPD |
| Australia | Australia Privacy Act |
| Singapore | Singapore PDPA |
| Japan | APPI (Japan) |
| India | DPDP Act (India) |
| South Africa | POPIA |
Picking a place also shows the areas and descriptions that apply there.
What your organization does
The What you do step asks Which areas does your organization work in?
- Pick each area that applies: Health, Public sector, Education and children, Finance and securities, Legal, Other professions, Defence and export controls or Essential services. If none applies, pick None of these. Many organizations do.
- For each area you pick, a list asks which descriptions fit, such as Health: which of these describe you? Tick each description that fits. Under a description, a line says what it brings in, such as Brings in PHIPA. To read more about a description, click the info button beside it.
An organization can fit several descriptions, such as a health network with clinics in Ontario and Quebec. Unpicking an area clears the descriptions you ticked in it. Picking None of these clears every area and description.
A description appears only where it can apply, so pick where you operate first. For example, An Ontario health information custodian appears once you pick Ontario. An area appears only when one of its descriptions can apply: Health, Education and children and Essential services need one of the places in the table below. While some choices are hidden, the step says More choices appear as you pick where you operate. A description you ticked stays on show even if you later remove its place.
| Area | Description | Appears when you pick | Brings in |
|---|---|---|---|
| Health | An Ontario health information custodian | Ontario | PHIPA |
| An Ontario physician or medical practice | Ontario | CPSO policies | |
| A Quebec health and social services body | Quebec | R-22.1 | |
| An Alberta health information custodian | Alberta | HIA | |
| A Manitoba health information trustee | Manitoba | Manitoba PHIA | |
| A Saskatchewan health information trustee | Saskatchewan | Saskatchewan HIPA | |
| A Nova Scotia health information custodian | Nova Scotia | Nova Scotia PHIA | |
| A New Brunswick health information custodian | New Brunswick | NB PHIPAA | |
| A Newfoundland and Labrador health information custodian | Newfoundland and Labrador | NL PHIA | |
| A HIPAA covered entity or business associate | United States | HIPAA and HITECH | |
| A US substance use disorder program (42 CFR Part 2) | United States | 42 CFR Part 2 | |
| Public sector | A federal government institution | Always shown | Privacy Act, TBS ADM Directive and TBS GenAI Guide |
| An Ontario ministry or provincial agency | Ontario | FIPPA and the Ontario AI Directive | |
| Another Ontario FIPPA institution | Ontario | FIPPA and EDSTA | |
| An Ontario municipal institution | Ontario | MFIPPA and EDSTA | |
| A Quebec public body | Quebec | A-2.1 | |
| An Alberta public body | Alberta | Alberta POPA | |
| A BC public body | British Columbia | BC FIPPA | |
| Another public body | Always shown | Nothing yet. Its own access and privacy act isn’t covered, and the report says so. | |
| Education and children | A US school, school district, college or university | United States | FERPA |
| An online service for children under 13 | United States | COPPA | |
| Finance and securities | A federally regulated financial institution | Always shown | OSFI B-10, B-13 and E-23 |
| A US financial institution | United States | GLBA | |
| Licensed or chartered by New York’s DFS | United States | NYDFS Part 500 | |
| Registered with the SEC | United States | Reg S-P | |
| A company that reports to the SEC | United States | SEC cyber disclosure | |
| An EU financial entity | European Union | DORA | |
| Legal | A law firm or legal department | Always shown | The code where your lawyers practise: see below |
| Other professions | An accounting firm or CPA practice | Always shown | CPA codes in Canada, and the FTC Safeguards Rule in the United States |
| Members of a Quebec professional order | Quebec | Professional Code (Que.) | |
| Defence and export controls | A defence contractor or supplier | Always shown | CPCSC in Canada, and CMMC in the United States |
| Handles ITAR-controlled items or technical data | Always shown | ITAR | |
| Handles EAR-controlled items or technology | Always shown | EAR | |
| Essential services | An essential or important entity in the EU | European Union | NIS2 |
Lawyers and CPAs who practise in Quebec also bring in Quebec’s Professional Code.
For A law firm or legal department, the code follows the places you pick:
- Ontario: the LSO Rules.
- Quebec: the Barreau Code.
- British Columbia, Alberta, Saskatchewan, Manitoba and Nova Scotia: that province’s law society code, such as the LSBC Code.
- Any other province or territory, or no place at all: the FLSC Model Code, which the other provinces’ codes are built on.
- United States: the ABA Model Rules, ABA Formal Opinion 512, on generative AI tools, and state bar AI guidance.
Who is in charge of personal information
The Who’s in charge step asks for the person in charge of personal information. Every field is optional.
- Person in charge of personal information: the person accountable for protecting personal information. Their name and title appear on the report.
- Their title: for example, Privacy Officer.
- Their work email: used only to send them scheduled reports. It isn’t printed on the report.
If no one is named, your profile line shows No person in charge named, and Fix these first in the Audit Assistant lists it as a gap. Its Name them button opens your profile at this step.
Standards and frameworks you follow
The Review step starts with Anything else you follow? It adds what your answers don’t bring in: standards you follow or are certified against, a proposed law to preview, or another law.
-
Up to three suggestions based on your answers appear as pills, such as CyberSecure Canada for a Canadian organization. Nothing is added until you click one.
-
Click Browse all standards and laws to see everything you can add. The Standards and laws dialog has:
- Search laws and frameworks: type part of a name, in English or French.
- Suggested for you: every suggestion based on your answers.
- Security standards: ISO 27001, SOC 2, NIST CSF 2.0, NIST 800-53, NIST 800-171, CIS Controls, PCI DSS, HITRUST CSF and CyberSecure Canada.
- Privacy and AI standards: ISO/IEC 27701, ISO/IEC 42001, NIST AI RMF, NIST Privacy Framework, OWASP LLM Top 10 and AI Voluntary Code.
- Proposed laws: Bill C-36, the federal bill meant to replace PIPEDA’s private-sector rules.
- Add a law your answers didn’t bring in: shows Other laws, so you can add a law yourself.
The dialog counts what you added, such as 2 added by you. Click Done to close it.
A law your answers bring in is already ticked, and you can’t untick it here. To remove it, change the answer that brings it in.
Adding a standard doesn’t mean you’re certified against it. In the report, a standard’s section says that only an accredited auditor or certification body, or the program’s own assessor, can attest to it or certify against it, and that the section maps the report’s evidence to the standard’s controls. It isn’t an audit.
Below, Your answers recaps each step: where you operate, what you do and who’s in charge. To change an answer, click Change beside it. This takes you back to that step.
Your report will cover
Beside the questions, Your report will cover shows how many laws and frameworks your profile brings in, and lists them by family: Canada: federal, Canada: provincial, Legal profession, Other professions, United States, EU and UK, Other countries, and Standards and frameworks. Under each one, it says why it’s there: the place or description you picked, Always included for PIPEDA, or You added it. In a narrow window, the list appears below the questions.
A badge marks a Proposed law, or one that’s Phasing in, with duties that start on later dates.
The list also marks what changed:
- During setup, New marks what the current step added.
- In the Compliance profile sheet, Adds marks what saving would add, and Removes: lists what saving would remove.
Change your profile
Once a profile is saved, the profile line at the top of the tab sums it up:
- The number of laws and frameworks your profile brings in.
- Where you operate, such as Ontario, Quebec · United States (California), All of Canada or Canada, federal law only.
- What your organization does, by short name, such as Ontario health custodian.
- The standards and laws you added yourself.
- The person in charge, as In charge: followed by their name, or No person in charge named, in amber.
To change your profile:
- On the profile line, click Edit profile. The Compliance profile sheet opens on Where you operate.
- Click any step to go to it, and change your answers. The questions are the same as in setup: see Fill in your compliance profile.
- Check Your report will cover. Adds marks what saving would add, and Removes: lists what saving would remove.
- Click Save profile. To close the sheet without saving, click Cancel.
While you have unsaved changes, the sheet shows Save the profile to use these in the Audit Assistant and your report. The Audit Assistant and the report use the profile you saved.
Read the Audit Assistant
The Audit Assistant comes after your profile line. For each law and framework in your profile, it shows where each duty stands, and which fixes help the most. To change the period, use the Period list at the top of the card: Last 30 days, Last 90 days or Last 12 months. It opens on Last 90 days.
What the statuses mean
Each duty has one of three statuses, and sometimes a Gap flag. The PDF uses the same words.
| Status | What it means |
|---|---|
| Supported | Sanitized AI performs a safeguard of this kind, and your data shows it working in the period. For example, guardrails that keep sensitive data out of AI tools. The duty is still your organization’s, and other measures may be needed to meet it. |
| Evidence provided | The duty is yours. The report gives facts you need for it, such as your settings, your counts for the period and the AI tools in use. Training staff and recording breaches are examples. |
| Your responsibility | Outside what software can do, such as naming someone accountable, or signing contracts with your service providers. The report says so rather than claim it. |
| Gap | A flag next to the status. Something found for the period weakens this duty, such as a guardrail set below Block. Fix these first names the problem, and where to fix it. |
Supported depends on enforcement. If your organization only monitors, if no AI tool is enforcing, or if protection was lowered during the period, a duty that would be Supported shows Evidence provided with a Gap flag instead. The same happens when a duty needs a type of guardrail set to Block, such as health guardrails, and it isn’t.
Where your duties stand
At the top of the card, a bar shows every duty in your laws and frameworks, such as 212 duties across your 9 laws and frameworks. The bar is split by status, with a count for each: Supported, Evidence provided and Your responsibility. Beside it, a pill counts the duties with a Gap flag, such as 7 duties flagged. The pill is red when there’s at least one, and says No duties flagged when there’s none.
Fix these first
Fix these first lists the gaps you can fix, found in your settings and your activity for the period. They’re ranked by how many duties each one weakens across your laws and frameworks. The first three are shown. To see the rest, click the link below them, such as Show all 7 gaps. To hide them again, click Show fewer.
Each gap shows its name, a line that says what was found, and which duties it weakens, such as Weakens 9 duties in 5 frameworks, with the frameworks named. If the line is cut short, point to it to read all of it. The full text is also in Gaps and recommendations in the report. A gap that doesn’t weaken any duty in your profile says Not tied to a specific duty. When there’s nothing for you to fix, the list says Nothing for you to fix in this period.
Each gap has a button that names where you fix it. Click it to go there:
| Gap | Button |
|---|---|
| Protection not enforced | Fix in Protection, Fix in Guarded Sites or Fix in Guardrails, depending on the cause. Protection is a tab of My Organization. |
| Some AI tools only monitored | Fix in Guarded Sites |
| Health guardrails below Block | Fix in Guardrails |
| Financial data guardrails below Block | Fix in Guardrails |
| Secrets not checked | Fix in Guardrails |
| AI tools not covered | Fix in Guarded Sites |
| People without protection | Fix in Users |
| Exceptions with no end date | Fix in Exceptions |
| Protection changes not fully checked | Review the change log, which opens Change log |
| Protection lowered | Review the change log, which opens Change log |
| No AI policy link | Fix in Protection, a tab of My Organization |
| No person in charge named | Name them, which opens the Compliance profile sheet at Who’s in charge |
Some gaps appear only where they matter. Health guardrails below Block appears for a health organization. Financial data guardrails below Block and Secrets not checked appear only when a law or framework in your profile asks for those safeguards.
Gaps that only Sanitized AI can act on aren’t in the list. They appear in a line below it, after Also found:, each with who can act on it:
- Retention of our records, with On Sanitized AI’s roadmap. Sanitized AI’s event records have no automatic deletion period yet.
- Usage not counted, with Ask Sanitized AI support.
- Protection not enforced, with Ask Sanitized AI support, when Block isn’t available to your organization.
By framework
Below Fix these first, switch between By framework and By safeguard. The legend beside the switch shows the colour of each status, and the red ring that marks a gap.
By framework is a table with one row for each law and framework, grouped by family. Each row shows:
- Law or framework: its short name, and its kind: Law, Guideline, Professional code or Standard. A Proposed or Phasing in badge appears when it applies. To see the full name, point to the short name.
- Duties: a bar and counts for its duties, such as 12 supported · 30 evidence · 5 yours.
- Gaps: how many of its duties have a gap, in red when there’s at least one.
- View duties: opens a window that says what the law or framework is about, and lists each duty with its section, its status and any Gap flag, what the duty asks, and what Sanitized AI did, with your numbers for the period. A law that’s proposed or phasing in also has a note that explains it.
- PDF: downloads a report for that law or framework alone, for the same period, in the dashboard’s language. For another period or language, use the AI Safeguards Report.
By safeguard
By safeguard shows a table of safeguards against your laws and frameworks. One setting often answers duties in many laws at once, so a row shows where one fix helps across your profile.
The rows are the safeguards that duties rest on: Person in charge, Policies and governance, Staff awareness and training, Keeping sensitive data out of AI tools, Security safeguards and coverage, AI tools and service providers, Incidents and breaches, Records and audit trail, Retention and disposal, Risk and impact assessments, Agreements with providers, Notice and transparency, and AI risk and human oversight. Only the rows that your laws and frameworks use are shown.
Each dot is one duty, coloured by its status. A red ring marks a gap. Pick a cell to see the duties behind it, and click Close to hide them.
What the results are based on
The Audit Assistant reads your settings as they are today, and your activity in the period you choose:
- Settings: such as your guardrails and their actions, your guarded sites, your exceptions, your AI policy link and your compliance profile.
- Activity: such as the prompts checked, the sensitive items found, and the warnings shown during the period.
A setting you change today counts for the whole period, so the Audit Assistant shows where you stand now, not where you stood on a past date. If protection was lowered during the period, the duties that rest on it can’t show Supported, and Protection lowered appears in Fix these first. The Audit Assistant updates when you save your profile or change the period. After you change a setting on another page, come back to the tab to see the result. If the Audit Assistant can’t load, it says Couldn’t load the Audit Assistant. Click Try again.
The line at the bottom of the tab sums up these points: Read from your settings today and your activity in the period. Not a certificate of compliance, and not legal advice.
Sanitized AI sees only the prompts and files sent to the AI tools it covers, from browsers, and desktop apps if your organization uses them, where its software is installed and signed in. It doesn’t see personal devices, phones, browsers without Sanitized AI, AI built into other applications, or AI tools it doesn’t cover. The report says so in its appendix on method and limits.
Download the AI Safeguards Report
The AI Safeguards Report is a PDF for your privacy officer, auditors or board. For each law and framework, it shows what Sanitized AI did and your organization’s own numbers for the period. You download it from the Reports card, below the Audit Assistant.
The AI Safeguards Report row says what the PDF will hold, such as Everything in your profile (9) · Last quarter, July 1, 2026 to September 30, 2026 · English. It starts with everything in your profile, the last quarter and the dashboard’s language. To download that report, click Download report.
To change what the PDF holds:
- In the AI Safeguards Report row, click Change.
- Under What to include, select Everything in your profile. Or select Choose, and then pick one or more laws or frameworks, for example for one auditor or client.
- Under Period, choose Last quarter, Last month, This quarter so far or Choose dates. For Choose dates, enter a Start date and an End date. A report covers at most 400 days.
- Under Report language, choose English or French. It doesn’t have to match the dashboard’s language.
- Check the sentence in the row, which follows your choices, and then click Download report.
To close the choices, click Hide options.
The report uses the profile you saved. Choose only narrows what the PDF shows. On Data Insights, the AI Safeguards Report button opens this tab.
What’s in the report
- The cover: your organization, the period, the laws and frameworks covered, the person in charge, who produced the report and when, its report ID, and the version of its law content, with the date of counsel’s last review, or pending.
- Headline numbers: the people protected, the prompts checked, the sensitive items found, and how many reached an AI tool.
- What happened to sensitive information during the period.
- A section for each law or framework: each duty, what it asks, what Sanitized AI did, and its status. See What the statuses mean. A standard’s section says it isn’t an audit, and a professional code’s section says it isn’t ethics advice.
- Gaps and recommendations, found in your data for the period.
- Appendices: your protection settings on the day the report was produced, changes to protection, the AI tools used, activity by department, and the method and limits.
Each download is recorded with its report ID, which is printed on the report. This includes the one-framework PDFs from the Audit Assistant. The report names people, such as whoever produced it and the people who changed settings, so share it with care.
Email the report
Email the report, the second row of the Reports card, sends the AI Safeguards Report as a PDF every month or every quarter, for the period just ended. The row describes what’s saved:
- When the emails are off, it says Off. The report can go out every month or every quarter, for the period just ended.
- When they’re on, it says what’s sent, to whom and in which language, such as Every quarter, to all admins and the person in charge, in English. A second line says when the next email goes out, and for which period, such as Shortly after January 1, 2027, for October 1, 2026 to December 31, 2026.
To set up or change the emails:
- In the Email the report row, click Set up, or Edit if the emails are on.
- Under How often, choose Every month, sent early on the 1st for the month just ended, or Every quarter, sent early after each quarter for the quarter just ended. Choose Off to stop the emails. When you change it, First email: says when the first one goes out, and for which period.
- Under Report language, choose English or French.
- Under Who receives it, choose one:
- All admins and the person in charge: every active admin, and the person in charge when their email is in the compliance profile.
- Only the people I choose: search for people in your organization by name, email or role, and tick up to 100 of them. To include the person in charge, tick The person in charge of personal information. Their email must be in the compliance profile. A count below the list says how many people will receive it.
- Click Save. To close the choices without saving, click Cancel.
Report language, Who receives it and the note on personal information appear only when How often isn’t Off.
Turning the emails on doesn’t send one right away: the first one goes out after the current month or quarter ends. If an email for a period that ended hasn’t gone out yet, the row says it’s due and goes out within the hour.
The report goes only to people in your organization and the person in charge: you can’t type in an outside address. Only active accounts receive it. If someone you chose is later disabled or removed, they stop receiving it.
Scheduled emails always cover everything in your profile. To give one auditor a single framework, download the report instead.
The PDF contains personal information, such as the email addresses of people who changed settings, and it stays in each recipient’s mailbox.