Luis
Give Luis the regulation. Get an organisation that follows it.
Luis turns a law, a standard or your own policy into Controls, processes, forms, training and contract requirements – connected to each other and traced to every requirement. He builds it all as drafts. Nothing goes live until you approve.
Information security policy.pdf31 Controls drafted. 2 gaps need you.
Real plans from Luis
See what Luis plans from a regulation or a policy.
These are Luis's own plans, unedited, made in Paragraf on our demo company. Each part says why it is there and which requirements it meets. Luis reuses what the company already has before making anything new.
“Set up how we meet NIS2 articles 20, 21 and 23 in this workspace: management approval and training, the risk-management measures, incident handling with the 24-hour, 72-hour and one-month reporting deadlines, and supplier security reviews.”
- Requirements found
- 8
- Parts in the plan
- 8
- Not covered
- 0
NIS2 Articles 20, 21 and 23 setup
-
Register rows
NIS2 Directive (EU 2022/2555) and the national cybersecurity actKeep NIS2 visible as a legal requirement whose applicability and implementation must be assessed.- Track NIS2 applicability and the relevant national implementing requirements.
-
Form
NIS2 Risk-management Measures ReviewCollect consistent risk assessments and evidence across all Article 21 measures.- Assess all Article 21 risk-management measure areas with supporting evidence.
-
Process
NIS2 Risk-management Review and RemediationTurn Article 21 assessments into owned actions, verification and management decisions.- Assign remediation owners, deadlines, effectiveness checks and residual-risk approval.
-
Form
NIS2 Management Approval and Training RecordPreserve evidence of management approval, oversight and cybersecurity training.- Record management training, competence assessment and employee training follow-up.
-
Process
NIS2 Management Oversight and TrainingGive management a repeatable approval and oversight cycle with documented training.- Document management approval and oversight of cybersecurity measures under Article 20.
-
Process change
Security Incident Triage & Response ProcessAdd Article 23 significance assessment, reporting clocks and evidence to the existing incident response.- Extend existing incident handling with significance assessment and 24-hour, 72-hour and one-month reporting deadlines, including ongoing incidents.
-
Form change
Supplier Security & Compliance AssessmentCapture the supplier-specific evidence needed for Article 21 supply-chain security decisions.- Collect supplier security evidence covering vulnerabilities, secure development and operational safeguards.
-
Process change
Supplier Review & Approval ProcessMake supplier security reviews risk-based, evidence-led and subject to a clear acceptance decision.- Extend existing supplier reviews with risk-based security assessment, approval and monitoring.
Every requirement Luis found is met by a part of the plan.
“Set up our incident handling exactly as this policy says.”
Information Security Incident Policy.txt · Read it- Requirements found
- 14
- Parts in the plan
- 9
- Not covered
- 0
Incident handling aligned with the Information Security Incident Policy
-
Properties
Event noticed at, Report received at, Incident awareness at, Incident severity, Incident assessment, Incident action log, Root cause and lessons learned, Evidence retention instructionCapture the timestamps and decisions needed to demonstrate compliance with the policy. -
Record type
Information Security Incident ReportKeep incident reports consistently identifiable across public reporting and response. -
Record type
External Incident NotificationScope CISO approval specifically to external incident notifications. -
Form change
Incident reportMake the existing report form collect the facts needed for rapid triage.- Employees and contractors report immediately, within one hour of noticing, even if unsure.
-
Workflow
Public Security Event ReportingProvide the public reporting entry point required by the policy.- Anyone, including external people, can report through a public reporting page.
-
Policy
CISO approval of external incident notificationsRequire CISO approval before any external incident notification is sent.- The CISO approves every external notification before submission.
-
Workflow
External Incident Notification ApprovalKeep notification wording, approval and submission evidence together. -
Process change
Security Incident Triage & Response ProcessMake triage, response, notification and closure follow the policy's deadlines.- The Security Officer assesses every report within four hours.
- Classify event versus incident, severity, NIS2 significance and GDPR breach status.
- The incident lead coordinates containment and recovery and logs every action with time and owner.
- Send significant-incident early warning within 24 hours, notification within 72 hours and final report within one month.
- Notify the data protection authority within 72 hours for personal data breaches likely to result in risk.
- Every incident has root cause and lessons learned within ten working days.
- Track corrective actions until closed.
- Keep all reports, assessments, notifications and lessons learned for five years.
- Reuse the existing incident process and report form rather than create duplicates.
-
Process
Incident Reporting Training and Incident Lead ExerciseTrack onboarding training, annual refresher training and annual incident-lead exercises.- All employees complete incident reporting training at onboarding and every year.
- Incident leads take a yearly exercise.
Every requirement Luis found is met by a part of the plan.
“Set up onboarding and offboarding of employees as this policy says.”
Employee Onboarding and Offboarding Policy.txt · Read it- Requirements found
- 15
- Parts in the plan
- 10
- Not covered
- 0
Employee onboarding and offboarding
-
Properties
Employment start date, Last employment day, Probation end date, Employee team, Employee role, Employee equipment serial numbers, Employee record disposal review dateKeep the employee dates, access decisions and equipment identifiers available as structured information. -
Record type
Employment agreementIdentify employment agreements consistently for signing and archiving. -
Record type
Employee confidentiality agreementKeep signed employee confidentiality commitments identifiable. -
Policy
HR review of employment agreements, HR review of employee confidentiality agreementsHave HR verify employee agreements before they are sent for signature. -
Workflow
Employment agreement signingAllow onboarding to obtain a signed employment agreement before the first day.- The employment agreement is signed before the first day.
-
Workflow
Employee confidentiality signingObtain the employee's confidentiality commitment before their first day.- The confidentiality agreement is signed before the first day.
-
Form
Employee first-week confirmationsCollect policy acknowledgements and evidence of the required security test.- The employee acknowledges the information security policy, code of conduct and privacy policy in the first week.
-
Process change
Employee Onboarding & Access ProvisioningMake onboarding follow the policy's approvals, signing and first-week deadlines.- HR registers the employee's start date, manager, team and role before the first day.
- The manager approves requested access before IT grants it.
- Access to systems with personal data also requires data-owner approval.
- The employee passes the security awareness test with at least 80% in the first week.
- IT issues a laptop and phone and records their serial numbers against the employee.
- The manager conducts a review before the six-month probation period ends.
- Reuse the existing onboarding, offboarding and access review Process Configurations.
-
Process change
Employee Offboarding & Access RevocationCoordinate last-day revocation, equipment return and post-employment record retention.- The manager starts offboarding at least five working days before the last day.
- IT removes all access on the last employment day.
- The employee returns all equipment and HR confirms continuing confidentiality obligations.
- Onboarding and offboarding records are retained for employment plus two years.
-
Process change
Access Review & RecertificationEnsure each manager reviews their team's access every year.- Each manager reviews their team's access annually.
Every requirement Luis found is met by a part of the plan.
“Set up how we handle GDPR in this workspace: data subject requests answered within one month, personal data breaches assessed and reported to the authority within 72 hours when required, and the record of processing activities kept up to date and reviewed yearly.”
- Requirements found
- 5
- Parts in the plan
- 4
- Not covered
- 0
GDPR handling and processing-activity reviews
-
Process change
Data Subject Request HandlingSo requests are verified, tracked and answered within the applicable GDPR deadline.- Answer data subject requests within one calendar month, with only permitted GDPR extensions.
-
Process change
Personal Data Breach HandlingSo breach decisions and required notifications are made within the 72-hour window.- Assess personal data breaches and notify the competent authority within 72 hours of awareness when required.
- Document non-notification decisions and assess whether affected individuals must be informed.
-
Form
Record of Processing ActivitiesSo each processing activity has a consistent, reviewable Article 30 record.- Capture the Article 30 record of processing activities in a structured format.
-
Process
Processing Activity Maintenance & Annual ReviewSo processing records are updated when activities change and reviewed at least annually.- Keep processing-activity records up to date and review each activity yearly.
Every requirement Luis found is met by a part of the plan.
Made by Luis on 2 November 2026 on the Acme AB demo data. Plans only – nothing was built, published or activated.
How a build goes
From a text to a running organisation – with you deciding at every step.
Describe what you need or attach what you have: a regulation, a policy, a contract or a spreadsheet. Luis reuses what already exists before he makes anything new.
- Every requirement listedLuis reads the request and every attached file and lists each thing they require – a step, a role, a deadline, a retention period, who decides.
- A plan you can checkEach part of the plan says which requirements it meets. Requirements no part meets are shown before anything is built.
- Built in the backgroundControls, processes, forms, Workflows, Policies, Teams, clauses and Playbooks – as drafts, often several at once, while you keep working.
- Checked against the planLuis compares what he built with the plan and your files, and marks what is still missing or needs your answer.
- You approve and publishA checklist keeps every part. Review, publish or undo – the whole build or one part at a time.
Everything connected
One promise in a contract. Everything it touches, linked.
A customer contract promises incident reports within 24 hours. Luis finds the promise and links it to the right Control. When your routine says 48 hours, the gap shows – and you decide what happens next. The same Control holds the training, the evidence and the supplier review.
- Customer contract · Nordbank§ 9.2 Report incidents within 24 hours
- ControlIncident handling · Owner: Security Officer
- RoutineReport within 48 hours
- GapThe contract asks for more than the routine Change the routineRenegotiateAccept the risk
- TrainingIncident response · test passed by 18 of 20
- EvidenceContinuity exercise · valid until Mar 2027
- SupplierCloudOps AB · review current
Safe by design
What Luis does. And what he never does.
The question is not what an AI can do, but what it is allowed to decide. Luis prepares the work. People decide.
Luis does
- Builds drafts of everything a requirement needs
- Finds clauses and values, with the exact words as the source
- Answers only from what the person asking may see
- Checks every part of an answer against its source
Luis never
- Publishes or activatesWorkflows, processes, forms, clauses and Playbooks stay drafts until you publish them.
- Changes who may do whatA new Permission set waits in the checklist until you press Apply. He never gives more access or removes anyone.
- Concedes outside your mandateIn a negotiation, your Playbook decides what is accepted – not the AI.
- Guesses what only you knowFacts like who is responsible for personal data are left out and listed for you to fill in.
Luis at work, every day
He builds. He also reviews, teaches, answers and reports.
Reviews and negotiates
Contract review against your Playbook, concessions only within your mandate, every round remembered – and Improvements that make Legal better every week.
Teaches
Turns a policy or a legal requirement into a lesson and a test, checks every question against the source, and answers what people wonder about the material.
Answers with the source
Ask in text or by voice, from any page. Every answer lists its sources, and a part that cannot be verified is left out instead of guessed.
Builds reports
Say what you need to know and he builds the whole report – charts, filters and calculations – counted with your access. He never shares or sends it: you do.
MCP and API
Bring your own AI tools. Under the same rules.
Connect AI tools such as Claude and Cursor to Paragraf through MCP, and your systems through the API. Every connection works as the person who made it – never with more access.
- Within your permissionsAn MCP connection is locked to one Workspace and follows the person's Permission set, data access and sensitive Properties.
- Three levels to choose fromRead & Analyze, Onboarding & Drafts, or Full Automation – where deleting or sending needs a two-step confirmation.
- Governed at three levelsThe organisation sets the ceiling, each Workspace can be stricter, and members need their own permission to connect.
- Short-lived by defaultPersonal connections last at most 90 days and switch off after 30 days without use. Admins see and revoke every connection.
- API for your systemsConnect CRM, ERP and the systems you already have, so a company keeps one history.
Superintelligence that asks before it acts.
Luis prepares the work. The people who answer for it make the decisions.
Luis works inside the house – within its permissions.
Your own processesLuisContracts · Compliance · Processes · FormsThe foundation Explore the foundation →Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.