GUARD GRC

View saved version →

---
name: guard-ai-inventory
description: Builds and maintains an organisation's AI system inventory in GUARD through the GUARD connector, and explains GUARD's classification of each system. Use when the person asks which AI systems they have in GUARD, wants to add or update one (a chatbot, a credit model, an HR screening tool, AI inside a vendor product), wants help finding all the AI the organisation uses, or asks how GUARD classifies a system or to re-classify it after its details changed.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: B - Build my AI system inventory
---

# Build my AI system inventory

The inventory lists every AI system the organisation builds, buys or uses. Each system can then be assessed, classified, covered by policies and signed off.

## When to use
- "Which AI systems do we have in GUARD?"
- "Add our customer chatbot; we also use Copilot and an HR screening tool."
- "Help me find all the AI we use."
- "How does GUARD classify our credit model? Re-classify it, the details changed."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list. Owners, editors and consultants can add and change systems; viewers can only read.

## Questions to ask
- To add a system, its `name` is the only required detail. Then ask in one message for the vendor, the type, the version, the lifecycle stage, where it is deployed or whose users it affects, and what it does: who it affects, which data it uses and how much a person checks its output. Allowed values are in [references/fields.md](references/fields.md).
- To find systems, ask about AI in use one area at a time:
  - customer service (chatbots, email drafting);
  - HR (CV screening, interview tools);
  - finance (credit, fraud);
  - marketing (content, targeting);
  - IT (coding assistants);
  - AI built into vendor products;
  - staff using AI tools without approval ("shadow AI").

## Steps
1. **List.** Call `GUARD:list_ai_systems` (`include_retired`, `part`); retired systems are left out unless `include_retired` is true, and long inventories come in parts. Show a short table: `name`, `vendor`, `risk_class`, `lifecycle_state`, `signoff_state`. A system with no `last_assessed` date is waiting for its assessment, so GUARD has not classified it yet.
2. **Add.** Check the list for a system with the same name first, to avoid duplicates. Show the details you will save and wait for the person's OK. Call `GUARD:add_ai_system` (`name`, `vendor`, `type`, `version`, `description`, `deployment_footprint`, `lifecycle_state`) once per system; every call creates a new system. Show its `name` and its `link`.
3. **Read one.** Call `GUARD:get_ai_system` (`id`) with the `id` from the list. It returns the `system` details, GUARD's `classification` with its reasoning per field, the `regimes`, the `signoff_state`, and the linked `assessments` and `policies`.
4. **Update.** Call `GUARD:update_ai_system` (`id`) with only the fields that change. An empty text clears `vendor`, `type`, `version` or `descrip

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-business-setup
description: Sets up or updates an organisation's business profile in GUARD through the GUARD connector, covering company details, jurisdictions, company PDFs and GUARD's profile summary, saving each detail to GUARD as soon as the person confirms it. Use when the person asks to set up their business in GUARD, describe or correct their company details, add where they operate, add company documents (PDF), or refresh the GUARD profile summary that GUARD's assessments, policies and regulator documents read. A guided setup asked one question at a time (onboarding) is GUARD's own guided company setup, which saves each answer in GUARD.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: A - Set up my business in GUARD
---

# Set up my business in GUARD

GUARD reads the business profile when it writes assessments, policies and regulator documents. A complete profile gives better results everywhere else.

## When to use
- "Set up my company in GUARD."
- "We now also operate in Saudi Arabia, update GUARD."
- "Add our privacy policy PDF to GUARD."
- "Refresh GUARD's summary of our business."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list. Owners, editors and consultants can change the profile; viewers can only read it.

## Questions to ask
If the person asks for GUARD's guided setup, onboarding, or to go one question at a time, follow step 2 (the questions are GUARD's). Otherwise read the profile first and ask only for what is missing or what the person wants to change:
- company name, website, sector and main regulator;
- where the company operates or serves users (jurisdictions). Map their words to GUARD's codes in [references/profile-fields.md](references/profile-fields.md) and read the mapped list back before saving;
- what the company does and how it uses or builds AI, in their own words.

## Steps
1. **Read the profile.** Call `GUARD:get_company_profile`. Show what is filled in, what is empty, and the date of GUARD's profile summary if there is one. On Foundation it returns only the name and GUARD's summary, ending "The rest of the business profile is not part of this organisation's GUARD plan.": show those two and say the other fields are not shown on this plan, never that they are empty.
2. **Guided setup (one question at a time).** Run GUARD's own company setup, never a questionnaire kept in the chat. First call `GUARD:list_assessments`: the person's own setup in progress is in `company_setup`; continue it with `GUARD:get_assessment_question` (`conversation_id`) and tell the person where they stopped (`progress`, the `current` question). Only when none is in progress, call `GUARD:start_assessment` (`kind`) with `kind` `company_setup`. Ask GUARD's `current` question in plain words and send each answer as soon as it is given with `GUARD:answer_assessment_question` (`conversation_id`, `question_id`) and `answer_text` (or `skip` true for an optional field); the result's first line says whether GUARD saved it an

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-close-gaps
description: Closes an organisation's assessment gaps in GUARD through the GUARD connector by having GUARD write a policy for chosen gaps, then working its implementation plan (action items, owners, deadlines, status) to completion. Use when the person asks to close gaps, write a policy for some gaps, see what is left on a policy's plan, add, assign or finish an action item, comment on a policy, or complete a plan; also for the action plans of regulator documents such as a DPIA.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: E + F - Close my gaps
---

# Close my gaps

A finished GUARD assessment lists gaps. GUARD writes a policy that closes the gaps the person chooses, with an implementation plan of action items. The plan is worked through, then completed (and approved when it has an approver).

## When to use
- "Close our high-risk gaps."
- "Write a policy for the data-access gaps."
- "What's left on the plan for our AI use policy? Mark the training action done and assign the audit to Sara."
- "Complete the plan."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list: owners, editors and consultants generate policies and manage plans; the person an action item is assigned to may change its status; viewers can read and comment.

## Questions to ask
- **Which assessment?** Call `GUARD:list_assessments` and let the person pick one with a report (`has_report`), unless they named it.
- **Which gaps?** Suggest one policy per theme, for example all Unauthorized Data Access gaps. Up to 50 gaps per policy, all from the same assessment, and only gaps whose remediation is a policy (operational gaps are worked outside a policy).
- **What is the policy for?** The whole company or one AI system. The default is the assessment's own subject.

## Steps
1. **See the gaps.** Call `GUARD:list_gaps` (`session_id`), optionally one `category`. Each gap says whether a policy already `covered` it. Call `GUARD:list_policies` (`scope`, `ai_system_id`) to show what exists, so nothing is written twice.
2. **Generate the policy (ask first).** It uses part of the organisation's AI allowance and takes 1–3 minutes. Confirm the chosen gaps and the subject, then call `GUARD:generate_policy` (`session_id`, `gap_ids`, `scope`, `ai_system_id`), with `scope` and `ai_system_id` only when the person overrides the subject. Keep the `job_id`. First tell the person in one short line that GUARD is working on it and it usually takes 1–3 minutes; only then call `GUARD:get_guard_job` (`job_id`) about every 20 seconds until `status` is `done` or `failed`; its `result` names the new policy. The policy and its plan start as a draft.
3. **Read the policy.** Call `GUARD:get_policy` (`policy_id`). Long policies come in parts; ask for more with `part` only when needed.
4. **Open the plan.** Call `GUARD:get_implementation_plan` (`policy_id`). It returns the `actions` (each with `id`, `action`, `owner`, `deadline`, `status`, `assignee`), the `progress`, whether the 

Preview of the first 4,000 characters. Read full instructions →

View saved version →

---
name: guard-guided-assessment
description: Runs a guided GUARD assessment through the GUARD connector, one question at a time, for the whole company or for one AI system, and GUARD's own guided company setup (the business profile by questions), with GUARD saving each answer as it is given, then reads GUARD's report, gaps and duty coverage. Use when the person asks to assess their company or an AI system in GUARD, for GUARD's guided company setup or onboarding (the business profile one question at a time), to continue an assessment or setup they started or to know where they stopped, or to see an assessment's report, its gaps, or how much of a regulation such as the EU AI Act it covers.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: C + D - Run a guided assessment
---

# Run a guided assessment

GUARD asks a fixed set of questions, pre-filling some from what it already knows, then writes a report. The assessment or company setup lives in GUARD: each answer is saved there as it is sent, so the person can stop at any time and continue later, in any chat or on the GUARD website. The report lists gaps, grouped by the five GUARD pillars, and shows how the organisation covers each regulation's duties. For an AI system, the report also classifies the system.

## When to use
- "Assess our company in GUARD."
- "Run an assessment for our HR screening tool."
- "Continue the assessment I started."
- "Run GUARD's guided company setup with me, one question at a time."
- "Where did I stop in the company setup?"
- "Show me the report, the gaps, and how much of the EU AI Act we cover."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list. Owners, editors and consultants can run assessments; viewers can read reports, gaps and coverage.

## Questions to ask
- **What is being assessed?** The whole company (`company_assessment`), one AI system (`ai_system_assessment`), or the business profile by questions (`company_setup`: GUARD's guided company setup, also called onboarding). The kinds are explained in [references/assessment-kinds.md](references/assessment-kinds.md).
- **For an AI system, which one?** Call `GUARD:list_ai_systems` and let the person pick. If it is missing, offer to add it first with `GUARD:add_ai_system` (`name`); its name is enough.
- **A title**, only if the person wants one.

## Steps
1. **Look for an unfinished one first**, also when the person asks where they stopped. Call `GUARD:list_assessments` (`scope`, `ai_system_id`); for a company setup, call it without an AI-system filter. The person's company setup in progress is in `company_setup`; an unfinished assessment has a `conversation_id`, and it is the person's own only when `started_by_you` is true. Continue the person's own with `GUARD:get_assessment_question` (`conversation_id`): say where they stopped (the `progress` and the `current` question) and ask that question. Another member's unfinished one is never the person's progress: mention it only as started by someone else in t

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-my-todos
description: Shows what is waiting on the person in GUARD through the GUARD connector (sign-offs to approve or review, action items assigned to them, regulatory updates to acknowledge), requests or withdraws sign-offs, and prepares an approval or rejection that the person confirms on a GUARD page with a fresh authenticator code. Use when the person asks what is waiting for them in GUARD, whether there is anything to approve, to approve or reject an item, to send an item to someone for approval, to withdraw a request, or to mark an assigned action done.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: I - My GUARD to-dos
---

# My GUARD to-dos

In GUARD, anything that needs approval goes through a sign-off: assessments, policies, AI systems, implementation plans and regulator documents. The assistant can show what is waiting, request a sign-off and prepare a decision. The decision itself is always confirmed on a GUARD page, with a fresh code from the person's authenticator app.

## When to use
- "What's waiting for me in GUARD? Anything to approve?"
- "Approve the AI use policy." / "Reject the DPIA, the retention section is wrong."
- "Send the policy to Omar for approval." / "Withdraw that request."
- "Mark my training action done."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list: owners, editors and consultants request and withdraw sign-offs; only the named approver (or the reviewer, at the review step) can decide; every role can comment.

## Questions to ask
- **Approving or rejecting:** which item, and the decision. A rejection needs a reason; ask for it.
- **Requesting a sign-off:** which item, and who approves; in a dual-approval organisation also who reviews; optionally the approver's title. Pick the people from the `members` that `GUARD:get_signoff` lists.

## Steps
1. **To-dos.** Call `GUARD:list_my_todos`. It returns the `signoffs` waiting for the person (`waiting_for` approval or review), the `assigned` action items, and the `regulatory` updates they have not acknowledged, with `totals`.
2. **Before a decision, inform it.** Call `GUARD:get_signoff` (`subject_type`, `subject_id`) for its `state`, people and `history`, and what the person can do now (`you_can`, or why it is `blocked`). Then summarise the item with its read tool: `GUARD:get_policy` (`policy_id`), `GUARD:get_assessment_report` (`session_id`), `GUARD:get_ai_system` (`id`), `GUARD:get_implementation_plan` (`policy_id`) for a plan, or `GUARD:get_regulator_document` (`id`). Point out anything unusual, such as open actions or missing sections. Do not recommend approval: the decision is the person's.
3. **Prepare the decision.** Call `GUARD:prepare_signoff_decision` (`subject_type`, `subject_id`, `decision`, `comment`) with `decision` `approve` or `reject`; a rejection needs the `comment`. It returns a `url` and a `handoff_id`. Tell the person: "Open this link. You'll be signed in to GUARD as yourself. Check the summary, enter a fresh code fro

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-regulation-questions
description: Answers questions about AI and data-protection regulations from GUARD's regulation library through the GUARD connector, quoting provisions in full and checking scope exclusions before saying a law applies. Use when the person asks what a regulation such as the EU AI Act, GDPR, DIFC Regulation 10, UAE PDPL or Saudi PDPL requires, whether a law applies to their organisation, or for the exact text of an article.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: J - Ask GUARD about a regulation
---

# Ask GUARD about a regulation

GUARD holds the text of AI and data-protection regulations from many jurisdictions, stored as passages of about 1,200 characters. Answers come from those passages and cite them.

## When to use
- "What does the EU AI Act require from deployers of high-risk systems?"
- "Does UAE PDPL apply to us? We're a DIFC firm."
- "Quote Article 2 of the Saudi PDPL in full."
- "Are government entities excluded from GDPR?"

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Searching the library needs no choice of organisation. For questions about "us" or "our" business, call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in the answer.

## Questions to ask
- Usually none. Ask only when the question cannot be searched as asked, for example "which regulation do you mean, the EU AI Act or Colorado's AI Act?"
- For "does it apply to us", read the facts from GUARD first (step 3). Ask only for facts GUARD does not hold, such as the number of people affected.

## Steps
1. **Search.** Call `GUARD:search_regulations` (`query`, `limit`) with a precise `query` in the regulation's own terms, for example "deployer obligations high-risk AI system human oversight", not "what do I have to do". Set `limit` up to 20 for broad questions. Search again with other wording, or once per regulation, when the results are thin. Each result has its `document_title`, `document_id`, `chunk_index` and `content`.
2. **Read around cut passages.** Call `GUARD:get_chunk_neighbours` (`document_id`, `chunk_index`, `range`) when a passage starts or ends mid-sentence or mid-list, and always when the person asks to quote or list a provision in full. Take `document_id` and `chunk_index` from a search result; `range` is 1–5 passages on each side. The `passages` come back in document order.
3. **About "us".** Call `GUARD:get_company_profile` for the organisation's jurisdictions, sector and regulator. Use these facts in the `query` and in `entity_attributes`.
4. **Check exclusions before saying a law applies.** Call `GUARD:find_carveouts` (`regulation`, `entity_attributes`). The `regulation` is a `document_id` from a search, or a short name such as `EU_AI_ACT`, `GDPR`, `UAE_PDPL`, `DIFC_REG10` or `SAUDI_PDPL`. The `entity_attributes` are a factual description, such as "DIFC-registered financial services firm". It checks one regulation per call and uses a small part of the organisation's daily AI allowance. Each of the `exclusion_candidates` shows its `article_reference` where GUARD found one. An empty list means no exclusion was fo

Preview of the first 4,000 characters. Read full instructions →

View saved version →

---
name: guard-regulator-documents
description: Prepares regulator documents in GUARD through the GUARD connector, written by GUARD from what it already holds about the organisation and its AI systems (a DPIA, a FRIA, a DIFC Regulation 10.2.2 attestation, a privacy notice or an AI transparency statement), each versioned with its own plan and sign-off. Use when the person asks for one of these documents, whether they need one, a new version of one, or which regulator documents they have and whether they are approved.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: G - Prepare regulator documents
---

# Prepare regulator documents

GUARD writes regulator documents from what it already holds: the business profile, the AI system's classification and its assessments. Each document is versioned, has its own action plan, and can be signed off.

## When to use
- "We need a DPIA for the credit model."
- "Do we need a FRIA? Prepare our DIFC 10.2.2 attestation."
- "Write our privacy notice and an AI transparency statement."
- "Which regulator documents do we have, and are they approved?"

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list. Owners, editors and consultants can prepare documents; viewers can read them.

## Questions to ask
- **Which document?** If the person is unsure, explain the five types in one line each; they and their conditions are in [references/document-types.md](references/document-types.md).
- **For a DPIA, FRIA or DIFC 10.2.2: which AI system?** Call `GUARD:list_ai_systems` and let the person pick (not a retired one).
- **New, or a new version of an existing one?** Step 1 answers it.

## Steps
1. **See what exists.** Call `GUARD:list_regulator_documents` (`type`, `ai_system_id`). If a `current` version exists, show it with its `signoff_state` and ask whether a new version is wanted.
2. **Check the conditions** (listed in "Regulator document types (GUARD)" in this skill's references).
   - **System documents:** call `GUARD:get_ai_system` (`id`) and compare its classification with the conditions, for example "a DPIA needs a data-protection regime classified and at least one personal-data category".
   - **Company documents:** call `GUARD:get_company_profile`; a company name and at least one jurisdiction are needed.
   - If a condition is not met, say what is missing and how to fix it in GUARD (run the AI-system assessment, update the system, add jurisdictions to the business profile). Stop there.
3. **Choose the grounding.** For a system document, call `GUARD:list_assessments` (`ai_system_id`) and offer the latest finished one as `source_assessment_id`; by default GUARD uses the latest completed one.
4. **Prepare it (ask first).** It uses part of the organisation's AI allowance and takes 1–3 minutes. Call `GUARD:generate_regulator_document` (`type`, `ai_system_id`, `source_assessment_id`, `parent_artefact_id`): `ai_system_id` for the per-system types; `parent_artefact_id`, the `id` of the current version, once one exists. 

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-regulator-pack
description: Prepares an organisation for a regulator request in GUARD through the GUARD connector by checking readiness, building a regulator response pack (one PDF of the register, approved policies, assessments, regulator documents, accountability and a 12-month audit trail) from one of six templates, reading what a pack contains, or reading the AI governance register as data. Use when a regulator (DFSA, DIFC Commissioner, a GDPR authority, the UAE Data Office, the CBUAE, an EU AI Act authority) has sent or may send an information request, or the person asks what they could hand a regulator today or for their AI register.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: H - Prepare for a regulator
---

# Prepare for a regulator

GUARD builds a regulator response pack from what the organisation already holds in GUARD: the AI register, approved policies, finished assessments, regulator documents, the approval structure and a 12-month governance audit trail. The pack lists, item by item, what a regulator typically asks for with the evidence GUARD holds, and names what the organisation must supply itself.

## When to use
- "The DFSA has sent us an information request."
- "Prepare for a GDPR authority inquiry; build a pack for the CBUAE."
- "What could we hand a regulator today?"
- "Give me our AI register."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer.
3. Note the person's role from that list. Owners, editors and consultants can build packs; every member, viewers included, can read packs and the register.

## Questions to ask
- **What could we hand a regulator today?** Answer that before asking anything: check readiness (steps 1 and 2) and lead with what is ready now (approved items), what is thin, and the template you would use (by its `use_for`; the general regulator request when no regulator is named). Only then ask for the regulator's letter or request, and only if it would change that answer.
- **Which regulator, and what kind of request?** Map the answer to one of the six templates by its `use_for` (also in [references/pack-templates.md](references/pack-templates.md)) and name the template you would use. A DFSA request uses the DIFC Information Request (`difc_information_request`), the same template as for the DIFC Commissioner of Data Protection: its cover line names both, and there is no separate DFSA template. GUARD also suggests a template from the business profile; when its suggestion differs from the one that fits the regulator, say both and why. If nothing fits, use the general regulator request.
- **Leave any items out, or list things the organisation will provide itself?** All items are in by default.
- **An executive summary?** It is on by default and is the one part GUARD's AI writes.

## Steps
1. **See earlier packs and the templates.** Call `GUARD:list_regulator_packs`. It returns the `packs` (newest first; a newer pack of the same template supersedes the older one), the six `templates` with their `items`, and the `suggeste

Preview of the first 4,000 characters. Read full instructions →

Referenced files: 1 — file references are metadata, not package contents.

View saved version →

---
name: guard-what-changed
description: Reports what changed in AI and data-protection regulation for an organisation, from the regulatory changes GUARD has reviewed and published and which of its AI systems each one affects, plus GUARD's daily AI-governance news, through the GUARD connector, and records the person's acknowledgement of a change they have read. Use when the person asks what changed for them, whether there is anything new on a regulation such as the EU AI Act, whether a consultation affects their systems, for this week's AI-governance news, or to mark an update as read.
license: Proprietary. © GUARD GRC L.L.C-FZ. All rights reserved.
compatibility: Needs the GUARD connector (https://guard.aigovernance.ae/mcp) connected, and a GUARD account with two-factor sign-in in an organisation whose plan includes the connector.
metadata:
  guard-version: "2.0.0"
  workflow: K - What changed for us
---

# What changed for us

GUARD tracks new and amended laws and consultations, and publishes each change after its own review. A change affects the organisation when an AI system it has not retired is classified under that change's regime, or the regime is a designated code in force for it. The industry news is GUARD's daily AI-governance briefing.

## When to use
- "What changed for us this month?"
- "Anything new on the EU AI Act?"
- "Does the new DIFC consultation affect our systems?"
- "Give me this week's AI-governance news." / "I've read that update, mark it acknowledged."

## Before you start
1. GUARD data comes from the GUARD connector's tools. They are named `GUARD:<tool>` here; in Claude Code they show as `mcp__claude_ai_GUARD__<tool>` (the claude.ai connector), or as `mcp__plugin_guard-grc_GUARD__<tool>` (the GUARD GRC plugin's own server). If no GUARD tools are available, tell the person to add the connector https://guard.aigovernance.ae/mcp in their assistant's connector settings, name it "GUARD", and sign in with their GUARD login. GUARD requires two-factor sign-in. Stop until it is connected.
2. Call `GUARD:list_organisations`. If there are several organisations and none is current, ask which one, then call `GUARD:switch_organisation` (`organisation`) with its name or id as listed. Name the organisation in every answer. Every role may read changes and acknowledge them.

## Questions to ask
- Usually none. Default to the changes that affect the organisation, newest first; use the period the person names.
- Ask whether they want every change, including ones that do not affect them, only when they ask about a regulation outside their exposure.

## Steps
1. **Changes.** Call `GUARD:list_regulatory_changes` (`since`, `relevant_only`, `part`). Set `since` as a date (YYYY-MM-DD) when a period is given; GUARD lists the newest 50 at most. `relevant_only` defaults to true; set it to false only when the person wants everything. Each change carries its `title`, `regime`, `jurisdiction`, `stage` (enacted, or consultation), `effective_date`, GUARD's `summary`, whether it `affects_this_organisation` and why (`matched_by`), the `affected_ai_systems`, and whether the person already `acknowledged` it.
2. **News (if asked, or as a short add-on).** Call `GUARD:list_industry_news` (`limit`) with `limit` up to 14 editions.
3. **Go deeper (if asked).** Call `GUARD:search_regulations` (`query`) with the changed instrument's name and topic to quote the relevant text, and cite the document title.
4. **Acknowledge (only on request).** After the person has read a change and asks to mark it, call `GUARD:acknowledge_regulatory_change` (`published_id`) with the change's `id`. It then no longer counts as waiting on them; a repeat answers `already_acknowledged`. Taking an acknowledgement back is done in GUARD.

## What to show
- **Changes that affect the organisation first,** newest first: the title, jurisdiction, enacted or consultation, and effective date; 2–3 lines on what changed; 1–2 lines on why it matters here, naming the affected AI sys

Preview of the first 4,000 characters. Read full instructions →