ISMS Copilot in Claude and ChatGPT, and when to call it

Claude and ChatGPT are good at the legwork of compliance: reading your records, comparing them, drafting, restructuring. They are weakest exactly where an auditor looks hardest: which edition of a standard is current, how a directive was transposed in one country, which control ID a requirement maps to, what changed in the last amendment. Their training data has a cut-off date and no edition stamps.

ISMS Copilot is a GRC specialist you connect to your own AI. It works from maintained framework modules, each with the edition it follows and the date it was last verified. Your AI keeps doing the work; when a step needs framework knowledge, it asks ISMS Copilot, asks for the source and its date when the answer will be cited, and keeps them. You decide and sign.

This page covers the connection (part 1) and, more importantly, when your AI should call it (part 2).

Part 1: connect

Everything runs through one address, the ISMS Copilot account MCP server:

https://account.ismscopilot.com/v1/account/mcp

You sign in to your ISMS Copilot account and click Approve. There is no key to copy. Usage counts against your ISMS Copilot plan, the same as the web app.

claude.ai and Claude Desktop

1. In Claude, open Customize → Connectors, click + Add, then Add custom connector.
2. Name it ISMS Copilot and paste the address above as the remote MCP server URL. Leave the advanced settings empty.
3. Click Add, then Connect. Sign in to ISMS Copilot and click Approve.

Claude Desktop uses the connectors of your Claude account, so it is connected too. On a Claude Team or Enterprise plan, an Owner adds the connector once for the organisation, and each member connects with their own ISMS Copilot account. Anthropic's current steps: custom connectors in Claude.

Claude Code

claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp

Then run /mcp in a session, pick ismscopilot, sign in and click Approve. --scope user makes it available in every folder. Or paste the one setup prompt from Set up with your agent and let Claude Code do the setup, the smoke test and the routing rule.

ChatGPT

ChatGPT connects today as a custom app (OpenAI also calls it a connector) with sign-in:

1. In ChatGPT's settings, turn on developer mode. On Business and Enterprise workspaces an admin may need to allow custom apps first.
2. Create a custom app named ISMS Copilot, paste the address above as the MCP server URL, and choose OAuth with the default settings.
3. Connect: sign in to ISMS Copilot and click Approve.

Check it works

Ask your AI: "List my ISMS Copilot workspaces." Then ask one real question, for example the one in the worked example below. If the tools do not appear, restart the app or start a new chat, and check you clicked Approve. More clients and troubleshooting: Connect any MCP client.

Part 2: when your AI should call ISMS Copilot

The rule of thumb: your AI does the work in your files; ISMS Copilot answers what the frameworks require. When the answer will end up in a document, have your AI ask for the source and its date, as in the worked example below.

Call it for these

Keep these in your AI

Code, git, the shell, spreadsheets, formatting, summarising your own documents, general questions. Calling a specialist for those costs time and usage for nothing.

A worked example

Asked from Claude Code on 3 November 2026: "Which national law transposes NIS 2 in Germany, is it in force, and from what date? Give the official name, the date it entered into force, and when your source was last verified."

ISMS Copilot answered, in short: the BSI-Gesetz (BSIG) of 2 December 2025, published in BGBl. 2025 I Nr. 301, in force since 6 December 2025, with the date its source module was last verified and the latest amendment it tracks.

That is the shape you want: the official name, the gazette reference, the in-force date, and how fresh the source is. We checked the name, the gazette reference and the in-force date against public sources before writing this page. The law has been amended since, so an audit citation also has to pin the version it relies on. Do the same check for any citation an audit will depend on.

The routing rule

Connecting the server is half the job. The other half is telling your AI when to use it, so it does not answer framework questions from memory or call the specialist for trivia.

In Claude Code, Codex and Cursor, that is a short block in your instructions file (CLAUDE.md, AGENTS.md or a Cursor rule). The setup prompt writes it for you on your yes; the full text is in the official setup instructions. What it says, in plain words:

1. You do the work, ISMS Copilot judges, the human decides. The agent reads the files and writes the deliverable.
2. Three moments to call it: when it needs to know what a framework requires, while doing the work when it needs compliance judgement, and before it finalises.
3. Send the question, not the standard. No pasting framework text: ISMS Copilot brings it.
4. Check before final, in Think mode. Send the full draft, with secrets removed and personal data the check does not need removed. Ask for errors, outdated references, what an auditor would challenge and what is missing. If only part was sent, say which parts were not checked.
5. One conversation per deliverable, so follow-ups keep their context.
6. Verify what an audit depends on. Keep ISMS Copilot's specifics, check citations an audit will rely on against the official text, and record what was verified in a short "Verified" note.

In claude.ai, Claude Desktop and ChatGPT there is no instructions file to edit, and you do not need one: the connector tells the model what ISMS Copilot is for. To be explicit, start with "Ask ISMS Copilot" or put a line in your project instructions: "For framework and regulatory questions, ask ISMS Copilot, ask it for the source and its date, and keep them."

What to send, and what never to send

• Send: the question in your own words, the draft to check, the context it needs (sector, size, country, which frameworks).
• Never send: passwords, API keys, tokens, payment card numbers, health records, government ID numbers.
• Strip first: personal data the question does not need. Roles instead of names.
• Ask first: customer or supplier confidential information (names, contract terms, details from their security questionnaires) only goes in if the contract allows you to share it.

What you send becomes a conversation in your ISMS Copilot account, under your account's retention and data protection settings. You can find it in the web app like any other conversation. Disconnect your AI any time in Settings → Connected apps, under Connected agents.

Modes and plans

• Fast is the default: quick answers.
• Think is for checks and multi-step analysis. Paid plans; on the free plan it answers as Fast.
• Beyond runs a multi-step plan, draft and verify, for a final check right before an audit or long research-grade drafting. Paid plans, with a daily cap.

Say "think carefully" or "use Beyond" and your AI passes the mode. Usage shares the same 4-hour window as the web app. When you reach your plan's limit, the reply says when it resets; you can upgrade in the web app at any time. Details: Connect Claude Code: modes and limits.

Start

1. Create a free ISMS Copilot account, or sign in.
2. Connect it to Claude or ChatGPT with the steps above.
3. Ask one question your AI would otherwise answer from memory: a national rule, a control ID, the current edition of a standard.

Eligible free accounts can start a 7-day Plus trial in the app, with no card: Think, Beyond and higher limits for the week.

To build a full ISMS workspace around this in Claude Code, with a CLAUDE.md, path rules, skills, memory and a hook: Run your ISMS with Claude.