Boundsmap

Using AI in your product comes with obligations. Do you know yours?

Most AI features pass through several hands, from the company whose model you build on to the people it affects. Each handover brings obligations under law and regulation. Boundsmap shows who needs to do what, so you can answer your customers’ questions with confidence.

Does your product use AI? Boundsmap is for you.

Map your own productSee an example map

Your first map is free. See the plans

  • Covers the EU AI Act, GDPR and the NIST AI RMF.
  • Self-assessed from your own description. Not an audit, a certification, or legal advice.

An illustrationYour AI supply chain

  1. Source Materials

    A foundation model, from an AI lab

  2. Boundary 1

    What the model maker says about data

    🇪🇺 European Union · Art. 10(6)

  3. Capability BuildersYou

    Your AI team, writing the logic and prompts that turn it into your feature

  4. Boundary 2 · Internal

  5. IntegratorsYou

    Your developers, building it into your product

  6. Boundary 3

    Instructions for use

    🇪🇺 European Union · Art. 13

  7. Operators

    The people at your customers who use it

  8. Boundary 4

    Notice that AI was used

    🇪🇺 European Union · Art. 26(11)

  9. Affected Parties

    The people it makes decisions about

A typical chain · What crosses, and the law behind it, from the Cairnhire example

Here is one drawn from a real description: Cairnhire CV matching

Same handover, different businesses

Cairnhire makes the software. But under the EU AI Act, it is the agencies and employers using it who must tell applicants that a high-risk AI system was used on them. In your own product, could you say which obligations are yours, and what you need to tell your customers?

A card from an example map: who has to act, what is asked of them in plain words, and which article of the law it comes from.

From an example mapCairnhire CV matching, Boundary 4

RequiredCarried by Operators: Customer recruiters at recruitment agencies and in-house hiring teams
Put it in the contractEuropean Union·Art. 26(11)

Whoever deploys this must tell the people it makes or helps make decisions about that they are subject to a high-risk AI system. This is owed to them whether or not they ever interact with it.

What crosses: Notice to the people it decides about that a high-risk AI system was used on them

See this boundary in the example map

How it works

Boundsmap places everyone involved in an AI system into five layers. Responsibility changes hands at the four boundaries between them. This is Boundsmap’s Roles & Boundaries Framework, and the map follows it.

  1. 1

    Describe

    Say what your product does, as you would to someone joining the company. Or have your own AI assistant write it, from one of our prompts.

  2. 2

    Roles

    Claude, Anthropic’s AI model, reads your description and places everyone involved on the five layers. You confirm or correct each one.

  3. 3

    Boundaries

    Fixed rules, not the AI, work out what the law asks at each boundary, and who has to act.

  4. 4

    Answer and share

    Where the map needs a fact only you know, it says “Needs an answer”. Where the law has not decided, it says “Not settled”. Then save a summary to share, as a PDF or as Markdown.

From an example mapCairnhire CV matching

Cairnhire is applicant tracking software, made by a company of twelve people in Leeds. Recruitment agencies and in-house hiring teams use it to post jobs, collect applications and move candidates through interviews. Last year we added CV matching, which is the AI part: when someone applies, we send their CV and the job description to Claude, Anthropic's model, and it gives the CV a score from 1 to 5 with two sentences on why. We use Claude through its API, on a company account we pay for. We have not trained or fine-tuned anything; our AI team wrote the instructions it follows, and our web developers built the screen that shows the results. We sell Cairnhire directly, on a monthly subscription. Our customers are the agencies and employers, and their recruiters use it every day: they see every applicant sorted by score and decide who to call. They can open any CV, but on a busy role most read from the top of the list. Applicants never use Cairnhire or see the matching: they apply through the employer's or agency's own job page, and only recruiters see the scores. Cairnhire is a UK company. Our customers are in the UK and Ireland, and so are most applicants, although Irish roles draw applications from elsewhere in the EU too.

Read the full description

  1. Source Materials

    Claude (Anthropic) from Anthropic

  2. Boundary 1

  3. Capability Builders

    Cairnhire's own AI team

  4. Boundary 2 · Internal

  5. Integrators

    Cairnhire's own web developers

  6. Boundary 3

  7. Operators

    Customer recruiters at recruitment agencies and in-house hiring teams

  8. Boundary 4

  9. Affected Parties

    Job applicants

Roles & Boundaries Framework · United Kingdom + European Union · Self-assessed 17 October 2026
Needs an answer

While it runs, might it handle details of anyone's health, ethnicity, beliefs, disability, criminal record or biometrics?

Boundsmap’s own map

The same rules, run on a description of Boundsmap itself, open questions and all. Here the people Boundsmap’s output affects are its own users: the founders and managers who map their products.

See how Boundsmap maps itself

Example mapBoundsmap, described by the company that makes it

  1. Source Materials

    Claude from Anthropic

  2. Boundary 1

  3. Capability Builders

    Boundsmap's UK software business

  4. Boundary 2 · Internal

  5. Integrators

    Boundsmap's UK software business

  6. Boundary 3 · Internal

  7. Operators

    Boundsmap's UK software business

  8. Boundary 4

  9. Affected Parties

    Founders, operations leads and product managers at small companies who sign up and use it

Roles & Boundaries Framework · United Kingdom + European Union · Self-assessed 17 October 2026

Each line is something the law requires where responsibility passes from one layer to the next, with the provision it rests on.

Boundary 1

Not yet answered: how the product reaches the model; where the model’s supplier processes the organisation’s data

Boundary 4

The lawful basis for the personal data this system handles in operation, per purpose, and the balancing test behind it where legitimate interests is relied on (🇬🇧 UK GDPR Art. 6 · 🇪🇺 EU GDPR Art. 6)

A privacy notice reaching the people this system processes, saying an AI system is involved and what it does (🇬🇧 UK GDPR Art. 13 · 🇪🇺 EU GDPR Art. 13)

Not yet answered: whether it handles sensitive personal details

Boundary 2 and Boundary 3: nothing required, nothing open.

Why not just ask AI?

Ask AI the same question twice and the answer can change. In Boundsmap, our AI only reads your description. Fixed rules, written and tested by us, decide what the law asks, so the same facts give the same answer. Each obligation names its article, and where the answer depends on something only you know, it says “Needs an answer” instead of guessing.

More questions and answers

What Boundsmap is, and is not

Self-assessed
It works from your description and your answers. It is not an audit, a certification, or legal advice.
UK and EU law and NIST AI RMF
Boundsmap covers UK and EU law. If a customer requires the NIST AI Risk Management Framework (NIST AI RMF), from NIST, the US standards body, Boundsmap also places its four functions on your map. That is not law, and Boundsmap does not assess you against it. A country Boundsmap has no rules for is marked “Not covered”.
The AI reads; fixed rules decide
Your description goes to Claude, Anthropic's AI model, which works out who is involved. Fixed rules that Boundsmap writes and tests, not the AI, then decide what the law requires.
Checkable
Every obligation names the article of the law it comes from, so you or your adviser can read the law itself. Take legal advice before you rely on the map.

How Boundsmap handles your data

Map your first AI product free

  • Explorer

    Free

    • Map 1 AI product
    • 5 AI scans a month
    • Every finding and every open question

  • Pro

    £10 a month

    Launch price

    • Map as many AI products as you need
    • 30 AI scans a month
    • Every finding and every open question

  • Team

    £39 a month

    Launch price

    • Everything in Pro
    • Up to 5 seats
    • 60 AI scans a month

Mapping an AI product, or refreshing after changing the description, uses one AI scan. Answering questions is free.

Choose a plan

Ready to map your own product?

Map your own productSee an example map

Explorer is free: map one AI product.

EU AI Act and UK GDPR: who is responsible for what in your AI product