AI Risk & Policy Simulator
Compliance and risk teams use the Simulator to screen an AI deployment for possible exposure under the EU AI Act, GDPR, and relevant U.S. sector rules before a single line is built.
Start with a first-pass risk classification instead of a blank manual assessment. See which questions need answers before sign-off.
No credit card required for the free tier. How simulation data is handled
Not for organizations that need continuous AI monitoring or legal sign-off. Use this report to prepare questions for legal and compliance.
The four wizard steps
Step 1
Organization type
Choose Healthcare, Financial, Real Estate, Education, Manufacturing, or Other.
Step 2
Location
Select the country, with an optional state or region.
Step 3
Business area
Choose the department or business area affected.
Step 4
AI implementation
Describe the tool, data used, and intended outcome.
After these inputs, the simulator drafts a risk and policy report. See the report format and sample. Human legal or compliance review is still needed.
Describe the use case—not confidential, personal, or regulated data.
Coverage
A first-pass review of regulatory exposure
Review a planned use case—or shadow AI you have already identified—for possible audit exposure. Get a risk classification, possible mitigations, and a checklist to discuss with legal and compliance before a pilot. The simulator reviews the use case you describe; it does not discover AI usage or approve a deployment.
The rules referenced depend on your industry, country, and use case. EU AI Act considerations can help you review whether a use case may involve a high-risk AI system; confirm the classification with counsel. NIST AI RMF may appear as a resource, but this is not a formal NIST AI RMF or ISO 42001 assessment.
What you get
A structured report for your internal review
Prepare for sign-off with the use-case summary, risk classification, issues to resolve, and questions for counsel. After checking the findings, keep the report with your own audit trail so auditors can see what was reviewed. A generated report is not a verified audit record, legal advice, or compliance approval.
Risk classification
A suggested overall risk tier, with reported risks to check before sign-off.
Risks and mitigations
Issues connected to the industry, business area, and proposed system.
Pre-deployment checklist
Actions, responsible roles, and priorities for follow-up.
Review questions and resources
Questions for counsel, regulatory references, and a DPIA assessment.
The Free plan is listed as a basic risk report. Pro lists detailed compliance reports, comparison, PDF export, and draft saving. Compare current plans.
Read a sample report
See an actual simulator report for a healthcare AI transcription scenario, including risk classification, regulatory themes, mitigations, review questions, and a compliance checklist.
Accessible HTML transcript available · Original PDF: 4 pages · Image-based · Approximately 1.1 MB. This AI-generated sample illustrates the report format; it is not legal advice or a compliance certification. Findings require qualified human review.
Run your first screen free
Start with your planned AI use case. The free tier includes 3 simulations per account per month. No credit card required.
Run a free simulationCustomer stories
Customer feedback on the AI Risk & Policy Simulator.
“Denise has always provided my company with the latest assistance in technology and most recently beginning to implement AI governance as well. The AI Simulator allows anyone in our company to screen an AI governance issue and receive instantaneous feedback on what the Top Risks & Mitigations are for any country in the world!”
“This AI Risk & Policy Simulator has literally changed the way I now provide consulting to my customers. With each customer being entirely different, I now can provide the top risk & policy issues we need to work on to make the useage of AI in the C-Suite world fast, effective and doable.”
Henry’s and Chris’s comments describe their experiences using the simulator. These are individual experiences, not guarantees of results or compliance.
Frequently asked questions
What compliance teams ask before a review
Which AI regulations and frameworks does the simulator cover?
The analysis can discuss the EU AI Act, GDPR, and U.S. rules relevant to the organization type, such as HIPAA, GLBA, FERPA, FCRA, ECOA, the Fair Housing Act, and OSHA. The rules named in a report depend on the use case and location. This is a first-pass review, not a compliance certification.
Which locations can I use?
You can select a country and, where relevant, a state or region. The simulator is designed for the United States, EU countries, the United Kingdom, Canada, Australia, and several other countries. The depth of analysis varies by jurisdiction.
Are my simulation inputs shared with a third party?
Yes. Report generation sends the following information to OpenAI's gpt-4o-mini through the configured Replit AI Integrations connection:
- Your organization type
- Location
- Business area
- AI description
The app stores inputs and reports, including anonymous runs linked to a browser session; designated administrators can review stored simulations.
The app's API request logger now records only method, route template, status, and duration, not request or response bodies. Historical server logs may still contain inputs, reports, or PDF data from earlier versions and have not been deleted by this change.
Provider and platform retention remain unconfirmed. Do not enter confidential, personal, or regulated information. See the Data handling page for details.
Are my inputs used to train AI models?
OpenAI's published API policy says data is not used for training unless sharing is explicitly enabled. Its default abuse-monitoring logs may contain prompts and responses for up to 30 days, with exceptions allowing longer retention. The owner has not confirmed training/data-sharing settings, special retention controls, or Replit proxy retention terms for this managed connection. We cannot promise no training or zero retention for this product. See the Data handling page for sources and limits.
How long are reports stored, and can I delete them?
Simulation inputs, reports, and saved PDFs have no automatic expiry, including anonymous simulations. Signing out or closing the browser does not delete them. There is no self-service report or account deletion control. Draft deletion removes only that draft from the app database, not reports generated from it. Log and backup retention periods are unconfirmed, and no deletion deadline is promised.
Who can I contact about privacy?
Email denise@welchconsulting.ai for privacy questions or requests. The owner has confirmed this inbox is monitored for privacy requests. No response-time or deletion completion guarantee is published. Do not include confidential information, sensitive personal data, or a full scenario in your email. The Data handling and Contact pages provide the email link.
Is the output a black box?
A report shows a suggested risk classification and a brief explanation of why that tier was assigned. It can also include a use-case summary, regulatory themes, policy impacts, named risks and possible mitigations, a compliance checklist, questions for legal counsel, resource links, and a DPIA assessment. These sections give you findings and references to check, rather than only a risk label. The model's internal reasoning is not shown, and the findings still need human verification. The output is general information, not legal advice or compliance approval.
Can I cancel a paid plan?
Paid plans can be managed from the billing portal linked on the pricing page for signed-in customers. Review the plan and billing terms shown during checkout before subscribing.