Boundsmap

Using AI in your product?

Here’s what’s worth checking, and what to do.

Your AI features rely on other companies, from the AI lab whose model you use to the tools your app is built on. Your customers, and the people your AI affects, rely on you. Boundsmap maps that chain for your product, then shows good practice at each handover: what’s yours to do, and what to hand your customers.

Map your own product

Your first map is free, no signup required. See the plans

An illustrationAn AI supply chain, and what needs to be done

  1. You rely on them

    Source Materials

  2. Boundary 1

    ?

  3. Capability BuildersYou

  4. Boundary 2 · Internal

  5. IntegratorsYou

  6. Boundary 3

    ●?

  7. They rely on you

    Operators

  8. Boundary 4

    ●◐

  9. They rely on you

    Affected Parties

Whole system●○

Yours · Put it in the contract

Agree in writing how you handle your customers' data

  1. Check your terms with business customers include a processing agreement, and that it covers the AI feature too.
  2. Check it says what you do with their data, how you keep it safe, who else gets it, and what happens when they leave.

Why: UK and EU GDPR Art. 28 · More Boundary 3 ↑

A typical chain · Who you rely on, and who relies on youSee the full example

Covers the EU AI Act, GDPR and the NIST AI RMF. Self-assessed from your own description.

How it works

Boundsmap places everyone involved in an AI system on five layers, from what it’s built from to the people it affects. Responsibility changes hands at the four boundaries between them, and that’s where there’s work to be done.

From an example mapTallowby follow-up email drafting

  1. 1

    Describe

    Say what your product does, as you would to someone joining the company. Or have your AI assistant or coding agent write it, from one of our prompts.

    1 · Describe

    Tallowby is a CRM for small wholesale and distribution businesses: contacts, orders, price lists, and a record of every call and email with each trade customer. We are based in Nottingham. Our newest feature drafts follow-up emails, and it is the only AI in the product. After a sales rep logs a call, they can press a button, and we send the call notes, the customer's recent orders and the rep's previous emails to a model made by Mistral AI, the French company, through its API. It writes a draft email for the rep. We pay for the API on a company account and have not trained anything ourselves; we wrote the instructions and built the button and the editing screen. The rep reads the draft, changes what they like, and sends it from their own mailbox or throws it away. Nothing is sent automatically, and the feature does not score, rank or decide anything about anyone. We sell Tallowby directly to the wholesalers, and their sales reps use it every day. The people on the receiving end are the wholesalers' trade customers, mostly buyers at shops and restaurants. We and most of our customers are in the UK. A handful are in Ireland and the Netherlands, and they sell into other EU countries too.

    Read the full description

  2. 2

    Roles

    Claude, Anthropic’s AI model, reads your description and places everyone involved on the five layers. You confirm or correct each one, and mark the ones that are you.

    2 · Roles

    1. Source Materials

      Mistral AI model (accessed via API) from Mistral AI

    2. Boundary 1

    3. Capability BuildersYou

      Tallowby's own engineering team

    4. Boundary 2 · Internal

    5. IntegratorsYou

      Tallowby's own engineering team

    6. Boundary 3

    7. Operators

      Wholesale and distribution businesses' sales reps

    8. Boundary 4

    9. Affected Parties

      The wholesalers' trade customers

  3. 3

    What to check

    Fixed rules, not the AI, find what’s worth checking at each boundary, and whose job it is. Each item has a few plain steps, and the law behind it if you want it. Where it needs a fact only you know, it asks you first.

    3 · What to check

    Help the staff who use it understand the AI

    Run it continuously
    1. This one sits with whoever uses it at work: you, if your own staff use it, or your customers, if theirs do.
    2. Write a short guide for the people who use it, contractors included: what it does, where it goes wrong, and when to check it.
    3. Put it where they'll see it, such as in the product or in onboarding.
    Why: AI Act Art. 4 (deployers) · More Whole system

    AI literacy, for the organisations using this system: they have to take measures so that the staff who use it understand enough about AI to use it well. The obligation is theirs, not the provider's, though what the provider tells them about the system is most of what they work from.

  4. 4

    Share

    Where you stand, on one screen: who gets what data, what you’ve marked as done, and what’s still open. And a detailed version for a customer’s compliance team, as a PDF or as Markdown.

    4 · Share

    Where you stand

    What the AI does

    Makes no decisions about people · Handles personal data · Makes new content, such as text or images · Answers the people who run it

    Who gets what data

    Mistral AI model (accessed via API)

    Gets personal data
    Yes, while it runs
    How you reach it
    Not answered yet
    Where it's processed
    Not answered yet
    Sensitive details
    No

    Still open

    The detailed version, for a compliance team →

Why not just ask AI?

Ask AI the same question twice and the answer can change. In Boundsmap, our AI only reads your description. Fixed rules, written and tested by us, decide what’s on your list, so the same facts give the same list and the same steps. Each item names the law it comes from, and where the answer depends on something only you know, it asks you instead of guessing.

More questions and answers

What Boundsmap is, and is not

Self-assessed
It works from your description and your answers. The steps are suggestions to help you get started, not what to do in every case. It isn't an audit, a certification, or legal advice.
What it covers
Boundsmap covers the EU AI Act and UK and EU GDPR. If a customer requires the NIST AI Risk Management Framework (NIST AI RMF), from NIST, the US standards body, Boundsmap also places its four functions on your map. That is not law, and Boundsmap does not assess you against it. A country Boundsmap has no rules for is marked “Not covered”.
The AI reads; fixed rules decide
Your description goes to Claude, Anthropic's AI model, which works out who is involved. Fixed rules that Boundsmap writes and tests, not the AI, then decide what's on your list and the law behind each item.
Checkable
Every item names the law it comes from, under “Why”, so you or your adviser can read it for yourselves. Take legal advice before you rely on the map.

How Boundsmap handles your data

Map your first AI product free

  • Explorer

    Free

    • Map 1 AI product
    • 5 AI scans a month
    • Everything worth checking, and every open question

  • Pro

    £10 a month

    Launch price

    • Map as many AI products as you need
    • 30 AI scans a month
    • Everything worth checking, and every open question

  • Team

    £39 a month

    Launch price

    • Everything in Pro
    • Up to 5 seats
    • 60 AI scans a month

Mapping an AI product, or refreshing after changing the description, uses one AI scan. Answering questions is free.

Choose a plan

See what’s worth checking in your own product.

Map your own productSee an example map

Explorer is free: map one AI product.

EU AI Act and UK GDPR: what to check in your AI product