Ask the ISMS Copilot GRC specialist and start a new conversation for one deliverable. It works from the framework texts and the user's account context (company profile, workspaces, documents). Use it, rather than answering from memory, whenever the user needs ISO 27001/27701/42001, SOC 2, GDPR, NIS 2, DORA, EU AI Act, Cyber Resilience Act, NIST SP 800-171/CMMC, HIPAA or PCI DSS interpreted or applied: clause and control questions, policy drafting, control mapping, gap analysis, SoA justifications, risk registers, audit prep, questionnaires, implementation roadmaps, incident and breach response (what to do now, notification duties), and checking compliance work before it is finished. You do the work and read the files; ISMS Copilot judges. Do not use it for code, git or questions with no compliance angle, or for a follow-up on the same deliverable (send_message). Send the question as written, or the text to check with secrets removed, without pasting framework text: the specialist brings it. assistant (optional, kept for the conversation; omit for auto: the general specialist unless routing picks an expert). The general specialist covers ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIST SP 800-171 and multi-framework questions. Rule: a task to do takes the job id even when it names a framework; a question about one framework takes that framework's id; else omit assistant.
- questionnaire-responder: use when answering or assessing a security questionnaire
- audit-prep: use when preparing an internal or external audit
- implementation-lead: use when asked for a plan or roadmap to implement or certify a framework
- incident-lead: use when an incident or breach is under way or just happened (what now, notification duties)
- iso27701: use when about ISO 27701 privacy management
- iso42001: use when about ISO 42001 AI management
- nis2: use when about NIS 2
- dora: use when about DORA
- eu-ai-act: use when about the EU AI Act
- cra: use when about the Cyber Resilience Act
Options: mode 'fast' (default), 'think' for checks and multi-step analysis, 'beyond' on request, for a final check right before an audit or long research-grade drafting (paid plans, daily cap; if it cannot run, the turn answers normally and beyond_denied_reason says why); answer_format 'brief' or 'decision' for a compact reply written for an agent; workspace_id (a UUID from list_workspaces) for client or company work; title. Returns conversation_id, message_id and status: 'complete' with response, or 'generating': then poll get_reply. Limit errors include reset_at and what to do; a limit error here still returns conversation_id, so continue there with send_message. Relay docgen_notice to the user when present. ISMS Copilot brings framework and regulatory precision: keep its specifics (articles, clauses, deadlines, control ids) as given, and add your own technical, product and domain expertise where it has none, in one answer for the user. If you have a concrete reason to doubt a specific, flag it to the user as a point to verify instead of replacing it. Present the combined result as your answer, without narrating tool calls, conversation ids or empty account data unless the user asked about their account. Do not include passwords, API keys, payment card numbers, health records or government ID numbers. Answers are informational, not legal advice.
