AI for privacy compliance and AI governance
Ultramarine Work drafts DPIAs and RoPAs, handles access requests, reviews vendor DPAs and assesses AI systems. It starts from the folder that already holds your data maps, contracts and request exports.
Payroll-breach-assessment.docxExampleBreach Notification Assessment: Misdirected Payroll Register
What happened
On October 1, 2026, a payroll analyst emailed the September payroll register to an outside benefits broker instead of the internal benefits team. The file held names, Social Security numbers and direct deposit account numbers for 312 employees in six states. The broker opened the file before confirming its deletion in writing on October 5.
Notification analysis
A name with a Social Security number is personal information under the breach statutes of all six states, so notice to the 312 employees is required unless a state’s risk-of-harm exception applies. Texas requires notice to its residents within 60 days of the determination, but its attorney general notice applies only at 250 Texans, and we have 41.
CheckedState counts tie to the HRIS export: 141 CA, 88 WA, 41 TX, 22 OR, 12 CO, 8 NY.
How it works
- 1
Point it at the program folder
Drop in the RoPA and data flow maps, the privacy notice, vendor DPAs and security exhibits, request exports, the AI inventory, past assessments and the current policy set.
- 2
Ask for the deliverable
You get a DPIA draft with risks and mitigations, a RoPA rebuild, a DSAR response with exemptions marked, a DPA markup, a state comparison or an impact assessment for an AI system.
- 3
Review the judgment calls
The draft cites the file behind each claim and flags anything the tool could not find or reconcile, so the review can start at the risk rating, the exemptions and the decision.
Ask it for
“Build the Article 30 record of processing from the data flow maps, vendor contracts and engineering docs, one row per processing activity.”
RoPA-draft-2026.xlsx“Access request DSAR-0041 is due May 30 under the CCPA 45-day rule. Draft the response and flag records that fall under the GLBA or HIPAA exemptions.”
DSAR-0041-response.docx“Compare how CA, CO, CT, OR, TX and VA treat sensitive data, appeal rights and universal opt-out signals, with a citation for each cell.”
Sensitive-data-by-state.xlsx“Review the Brightwell DPA against our processor template and list every missing term, starting with deletion on termination and audit rights.”
Brightwell-DPA-markup.pdf“Classify the resume screening tool under the EU AI Act and Colorado’s ADMT law, then write its impact assessment in our template.”
Resume-tool-impact-assessment.docx“A payroll report with the SSNs and salaries of 312 employees went to the wrong recipients in 6 states, so run the breach analysis and draft the notice plan.”
Payroll-breach-assessment.docx
Inside the Privacy & AI Governance mode
Regulatory and compliance analysis
Drafts DPIAs, records of processing and breach assessments. Anything it cannot prove from the folder is listed as an open item rather than filled in.
Data subject request handling
Takes a DSAR from identity verification through scoping and exemptions to the draft response letter, with the GLBA and HIPAA-exempt records marked.
Privacy notices and state law comparison
Checks the notice against your actual data flows and puts CO, CT, TX and VA side by side, each row cited to the state law.
Data processing agreement review
Reads vendor DPAs, BAAs and security exhibits against your template and lists each missing controller, processor or service provider term.
AI governance and impact assessments
Classifies an AI system under the EU AI Act risk tiers or Colorado’s ADMT law and drafts the impact assessment, mapped to NIST AI RMF where a law credits it.
Records retention and disposition
Maps the retention schedule to legal citations and the NARA GRS, builds the disposition log and pulls records under legal hold out of the purge list.
Regulatory applicability and change
Works out whether an enacted law or final rule reaches your organization, and lists thresholds, compliance dates, exemptions and gaps against current practice.
Compliance policies and procedures
Writes the required policies, from HIPAA privacy procedures to a breach response plan, and traces each element to the provision that imposes it.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
Who it’s for
Privacy analysts, officers and counsel, data protection officers, privacy program managers and AI governance leads, in companies and agencies.
Questions
Where does the personal data in our files go?
Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page.
Does it decide whether processing is high risk?
No, it drafts the assessment with risks, mitigations and citations, and you rate the residual risk and make the call. GDPR Article 35 and the CPPA risk assessment rules put accountability on the organization. The tool builds the record and the person signs it.
Can I trust the citations in the documents it drafts?
No, not without a person checking them. Its skills tell it to cite the source file for the statements it uses and to note what it could not find or reconcile instead of guessing. Each claim traces back to a file in the folder. What it cannot tell you is whether a citation is still good law, and that check falls to the reviewer. Federal courts have fined attorneys $1,000 to $6,000 for AI-invented citations, and regulators and auditors read your DPIAs and RoPAs.
Should we assess this tool like any other AI vendor?
Yes, run your own vendor review before it touches personal data. Content is processed on Paper Instruments’ servers, and you review every file it touches. We do not name any certifications. Send your reviewer to the compliance page, and expect the tool to land in your AI inventory and RoPA like any other system.
Do you train on our program’s data?
We make no claim either way. Do not read a yes or a no into it. The compliance page carries our security and compliance details, and Paper Instruments can answer the question contractually before you sign anything.
Can we run PHI or HIPAA data through it?
The decision belongs to your compliance team. We do not claim HIPAA compliance and take no position on a BAA. Treat it as you treat any service that would receive PHI until your own review says otherwise. The compliance page is where that review starts.