Why this matters, by audience
For Lawyers & Law Firms
- ABA Model Rule 1.1 (competence) now reaches GenAI proficiency — Formal Op. 512 (July 2024) makes oversight an ethical duty.
- Model Rule 1.6 (confidentiality) requires reasonable safeguards before sending client info to a third-party LLM. Encryption + tier policy + approval chain = those safeguards.
- Model Rule 5.1 / 5.3 — partners must supervise associates and non-lawyer staff using AI. The user-summary and event stream are the supervision record.
- Engagement-letter & outside-counsel-guideline (OCG) compliance: many corporate clients now contractually forbid GenAI on their matters without written consent. Approval chains produce that consent record.
- Privilege preservation: redaction-before-storage prevents the audit log from itself becoming discoverable as a waiver.
For Enterprises & Boards
- EU AI Act (in force from 2 Feb 2025 for prohibited practices, full obligations 2026): deployers of high-risk and GPAI systems need logging, human oversight, AI literacy, and risk records — every one of which is a feature here.
- SEC cybersecurity disclosure rules require material-incident reporting on Form 8-K within 4 business days; incident detection + SLA tracking provides the timeline evidence.
- Sarbanes-Oxley §404 — internal controls over financial-relevant systems now include the LLMs writing or summarizing financial content. Spend + approval logs cover this.
- Cyber insurance underwriters increasingly demand AI-usage monitoring as a condition of coverage and favorable premiums.
- Vendor & customer security reviews: a published Trust Center plus framework status answers most RFP security questionnaires before they're sent.
For Anyone Handling PII / PHI / PCI
- GDPR Art. 5 — accountability principle requires you to demonstrate compliance, not just claim it. Logs + ROPA + DPIA + attestations produce the demonstration.
- GDPR Art. 30 ROPA & Art. 35 DPIA: data-flow mapping plus tier classification fills both forms automatically.
- HIPAA Security Rule — audit controls (§164.312(b)), access management (§164.308(a)(4)), encryption (§164.312(a)(2)(iv)) all map to native features.
- PCI-DSS 4.0 — requirements 7 (least privilege), 8 (identify & authenticate), 10 (log & monitor), 12 (governance) addressed end-to-end.
- U.S. state laws (CCPA/CPRA, VCDPA, CTDPA, etc.) — risk assessments, deletion rights, and disclosure inventories all rely on knowing what data went to which AI vendor.
- DORA (financial entities, EU) — ICT third-party risk register: AI destinations + DPA-on-file status feeds straight in.
Looking for the feature map?
Features & compliance mapping moved to its own page.
Every module, what it does, who relies on it, and the law or framework it satisfies — plus the five-step operating model — now live on a dedicated Features page.
Open the feature map →Frequently asked questions
In-app Module Guide
Searchable per-module documentation, top features, and Splunk / Datadog / Elastic comparison.
Open in app →Open a support ticket
Threaded, workspace-scoped tickets with priority and category. Logged-in customers only.
Sign in →Enterprise & legal review
MSA, BAA, custom DPA, EU residency, CMK, SSO, custom retention — annual contract.
Talk to sales →Chaberista is oversight software, not legal certification. Statutes and regulations change — confirm current requirements with qualified counsel in each jurisdiction in which you operate.