Two Paths to Agentic Compliance: Run Agents Inside CertHub or Connect Your Own
Compliance teams want to work with agents in the tools they already use. We've made that possible two ways, one keeps your data inside the EU, the other lets you bring ChatGPT, Copilot, or Claude to your workspace in about a minute. Here's how to choose.
Most compliance software was built on a quiet assumption: that you'd come to it. Open the platform, navigate the dashboard, find the right module, work the way the tool wants you to work. That's been the implicit contract with GRC and QMS systems for the better part of two decades.
That contract is breaking. A lot of compliance work now starts somewhere else entirely, in a chat window. Drafting a control narrative, comparing a new BSI C5 criterion against last year's version, summarising a clinical evaluation, mapping ISO 27001 controls to NIS2 obligations. The first draft happens in Claude or ChatGPT or Copilot. The polished, audit-ready version eventually has to land in a regulated system. And in between sits a pile of context-switching that nobody enjoys and nobody bills for.
We think that gap is the most important thing for compliance tooling to solve right now. So today we're announcing two ways to close it, and the choice between them is the most interesting part.
Agents need to be where the work and the data already live
This isn't a small shift. Agents in isolation are productivity demos. Agents with access to your real compliance documentation, your control evidence, your risk registers, your supplier records: that's a different category of tool. It's the difference between a model that guesses about your QMS and one that retrieves the exact text that's already there.
For our customers (cloud providers preparing for BSI C5, MedTech teams under MDR, organisations chasing ISO 27001 or EUCS), that distinction is everything. The right answer to "what's our incident response procedure?" isn't a paraphrase. It's the procedure as currently written, version-controlled, attributable, and audit-defensible.
So we built two ways for agents to reach that data. The interesting part is that they sit on opposite ends of a spectrum, and the right choice depends on something that has nothing to do with capability and everything to do with where you sit on the regulatory map.
The tradeoff at the heart of it
Every compliance team we talk to is making the same calculation, whether they realise it or not.
On one side: convenience and choice. Your team already has ChatGPT seats. Engineering already lives in Copilot. Your CISO uses Claude. You don't want to introduce a new AI tool. You want the AI tools you already use to actually know about your compliance environment.
On the other side: control. Some regulated workloads simply can't have data leaving the EU. Some auditors will have follow-up questions you don't want to be answering. Some sectors (health, public, critical infrastructure) operate under data residency expectations that take "we use US-hosted AI" off the table entirely.
This isn't a debate we can resolve for you. So we're not trying to. We're giving you both options.
Path 1: CertHub Brain, agents that run inside the platform
The first path is CertHub Brain. Agents that live inside CertHub itself, operating on your workspace data without that data ever leaving our environment.
Brain is built for the cases where security, control, and data residency aren't preferences. They're requirements. The infrastructure, the model inference, the retrieval, the logs: all of it stays within the EU. There's no round-trip through a US-hosted assistant. There's no question to answer about which jurisdiction touched which document.
That matters for the obvious reasons (BSI C5 customers operating under cloud sovereignty expectations, MDR-bound MedTech teams handling clinical data, public-sector and critical-infrastructure customers under NIS2). And it matters for less obvious ones too. Sub-processor lists get shorter. DPIAs get simpler. Conversations with internal security stop turning into a project.
Inside Brain, the agents have direct access to your CertHub workspace: your control library, your evidence, your assessment templates, your supplier and asset inventory, your audit history. You ask, the agent retrieves, drafts, or routes, without leaving the regulated boundary. For the customers we've been piloting it with, that's not a feature. It's the only configuration their compliance posture allows.
If your team's posture is "we'd love to use AI but everything has to stay in the EU", Brain is the answer.
Path 2: CertHub MCP server, bring your own AI
The second path is for everyone else. And in practice, that's a lot of teams.
If your organisation is comfortable with data being processed outside the EU (because you've already accepted ChatGPT or Copilot in your stack, or because the workload doesn't carry that constraint), you don't need to switch tools. Connect the CertHub MCP server to whatever AI you already use. Claude Desktop, ChatGPT, Microsoft Copilot, Cursor, or anything else that speaks the Model Context Protocol.
A quick refresher for anyone who hasn't met MCP yet: the Model Context Protocol is an open standard, originally proposed by Anthropic, that defines how AI assistants connect to external tools and data sources. Think of it as the integration layer that lets a model go beyond its training data and actually interact with live systems: read documents, call APIs, return structured results. The ecosystem has exploded over the last year. Databases, version control, productivity suites, cloud platforms, all wired up to AI clients through MCP servers.
Compliance has been an obvious gap. We're closing it.
Once your team connects the CertHub MCP server, your existing AI assistant has structured access to your CertHub workspace. Your scope statements. Your control implementations. Your evidence. Your gap assessments. Your supplier list. Not as context you paste in at the start of every session, but as data the agent can retrieve precisely, on demand, every time.
Ask in Claude "what's our access control policy?" and it pulls the current text from CertHub. Ask it to draft a section of your risk treatment plan and it uses your real risk register as input. Ask it to flag where your ISO 27001 controls don't yet have evidence and it queries your workspace and tells you. The conversation stays in the AI tool you already work in. The data stays consistent with what's in CertHub.
The tradeoff is honest: the moment data flows through ChatGPT or Copilot, it's processed where that vendor processes it. For many workloads, that's fine. Your team already made that decision when you adopted those tools. For others, it's not, which is exactly why Brain exists.
How to choose
We've boiled it down to a few questions worth asking your team. The honest answer to any of them tilts the decision.
Where does your data legally need to live? If the answer is "in the EU, full stop", you want Brain. If your team is already running approved workloads on US-hosted SaaS, MCP is a reasonable fit.
Who is asking the questions? If your auditor, your DPO, or your customer is going to follow up on AI processing, Brain shortens those conversations dramatically. If nobody downstream cares which model touched the document, MCP is easier to adopt.
What's the workload? Strategic drafting, summarisation, internal Q&A on your control framework: both paths handle these well. Anything touching personal health data, classified material, or sovereignty-sensitive content: Brain.
What's the path of least resistance? If your team is already deep in ChatGPT or Copilot, MCP gets you to value in a minute. If you're starting from scratch and want a single integrated environment with the strongest residency guarantees, Brain is the faster route.
In most organisations the answer isn't either/or. It's Brain for the regulated workloads, MCP for everything else. Both pull from the same CertHub workspace, which means the underlying source of truth (your controls, your evidence, your assessments) stays consistent regardless of which path a given user takes.
Why this matters specifically for compliance work
Generic AI assistants are remarkable at writing prose. They are notably less remarkable at telling you whether your incident response plan satisfies BSI C5 BCM-01, because they have no idea what your incident response plan currently says, and only a probabilistic sense of what BCM-01 actually requires.
The combination of (a) reliable access to your real compliance content and (b) an AI environment your team is already comfortable in, is what makes agentic compliance work move from a demo to something useful on a Tuesday afternoon. That's true whether the agent is running inside CertHub or in the AI tool of your choice. The question is just which side of the EU residency line you need to land on.
For teams working across multiple compliance frameworks (C5, MDR, ISO 27001, EUCS and NIS2), "useful on a Tuesday afternoon" looks like:
- Pulling the exact wording of an existing control rather than reconstructing it
- Drafting evidence narratives that reference real artefacts in your workspace
- Spotting gaps where a new requirement isn't yet covered
- Routing a document to the right reviewer without leaving the chat
- Comparing a draft against the framework's actual text, not a paraphrase
None of that works without the connection between the AI and your compliance workspace. Brain and MCP are two ways to make that connection. The rest is preference.
Getting started
If you want CertHub Brain, talk to us. Brain is rolling out for customers with the residency, security, and operational profile that needs it. We onboard each team carefully, because the whole point of running agents in-platform is that the deployment itself meets the bar your auditor will eventually hold it to.
If you want the CertHub MCP server, the setup is intentionally simple. Under a minute for most clients:
- Open your AI client (Claude Desktop, ChatGPT with MCP support, Microsoft Copilot, Cursor, or any MCP-compatible tool) and go to its connector or integration settings.
- Add the CertHub MCP server endpoint your workspace administrator provides.
- Authenticate via OAuth. Click connect, sign in to CertHub, done.
- Restart the client if it asks you to.
That's it. Your AI assistant now has structured access to your CertHub workspace and can retrieve, draft, and act on your real compliance data, without you ever leaving the chat.
The point
Agents shouldn't operate in isolation, and compliance teams shouldn't have to choose between modern tooling and the regulatory constraints that define how they work. With CertHub Brain, agents come to your data inside an EU-only, controlled environment. With the CertHub MCP server, your data comes to the agents your team already trusts. Same workspace, same source of truth. Different sides of the residency line.
If you're not sure which path fits, that's exactly the conversation we want to have. Book a demo and we'll walk you through both paths, see your data shape, and figure out together where the EU residency line should sit for your team.