Serve customers in many countries

This guide is for teams that build compliance software with their own AI assistant and sell in more than one country. The problem it solves: your assistant knows one country's law well, a customer signs in a second country, and loading the second law into a shared knowledge base would change the answers every existing customer gets.

With the ISMS Copilot API you choose the framework modules per request. A request for a Dutch customer carries the Dutch NIS 2 module, a request for an Italian customer carries the Italian one, and nothing is shared between requests. There is no account-wide knowledge to pollute.

1. Map each customer to catalog ids

Your backend already knows where each customer operates and which frameworks they are under. Map that to catalog ids from the public catalog:

curl https://api.ismscopilot.com/v1/frameworks

No key needed. Each entry has an id, a region, the version it tracks and a last_verified date. For NIS 2 there is one module per EU member state, named NIS_2_<country code>:

Where a member state has not adopted its law yet, its module says so in version and tracks the draft. Read the live catalog rather than a hard-coded list.

2. Pin the modules on each request

Send the ids in the ismscopilot.frameworks extension, up to 8 per request. Pinned modules are injected regardless of what the message mentions.

import os
from openai import OpenAI

client = OpenAI(base_url="https://api.ismscopilot.com/v1", api_key=os.environ["ISMS_API_KEY"])

NIS2_BY_COUNTRY = {"BE": "NIS_2_BE", "IT": "NIS_2_IT", "NL": "NIS_2_NL"}

def ask(tenant, messages):
    frameworks = [NIS2_BY_COUNTRY[tenant.country], *tenant.frameworks]  # at most 8
    return client.chat.completions.with_raw_response.create(
        model="isms-fast",
        messages=messages,
        extra_body={"ismscopilot": {"frameworks": frameworks}},
    )

The same request with curl:

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "Which NIS 2 incident reports do we owe, and to whom?"}
    ],
    "ismscopilot": { "frameworks": ["NIS_2_NL"] }
  }'

An unknown id, a duplicate, an empty array or more than 8 ids returns a 400, so a typo in your mapping fails loudly instead of silently answering without the module.

To compare two countries for one customer (a group with entities in the Netherlands and Belgium), pin both: ["NIS_2_NL", "NIS_2_BE"].

3. Log what ran

Every successful response names the injected modules:

• Header x-isms-frameworks, for example NIS_2_NL
• Body ismscopilot.frameworks, plus knowledge_characters

Store the module ids next to the answer in your own records. When support or your compliance team asks which law an answer stood on, you have it. On our side, which modules were injected is not stored (see Zero Data Retention), so your log is the record.

4. Keep your assistant's voice

By default the server adds the ISMS Copilot persona to your system prompt. Set ismscopilot.system to "none" to drop it: your system prompt stays in charge, and the pinned framework knowledge is still injected.

{
  "model": "isms-fast",
  "messages": [
    { "role": "system", "content": "You are the assistant inside our compliance platform." },
    { "role": "user", "content": "Do we have to register, and by when?" }
  ],
  "ismscopilot": { "system": "none", "frameworks": ["NIS_2_NL"] }
}

The full persona text and every control are in The API system prompt, in full.

5. Know when a law changed

Knowledge changes since the 2026-08-25 baseline are listed in a public changelog:

curl https://api.ismscopilot.com/v1/frameworks/changelog

No key needed. Each event has a type (for example version_changed, content_corrected, verification_refreshed, framework_added), a date, the framework_ids it touches, a note, and usually an evidence_url pointing at the official source. Responses carry an ETag and Cache-Control: public, max-age=3600, so a daily poll with If-None-Match costs a 304 when nothing changed. Filter on the ids your customers use and alert your team, or re-run the questions that matter for those customers.

The catalog and the changelog change when a release reaches production.

6. Split usage by customer

There are no per-customer sub-accounts. If you need usage and spend per customer, give each customer its own key: one user can hold up to 20 active keys, each with an optional spend cap per hour, day, week or month. All of a user's keys draw on that user's prepaid credits. See Credits and limits.

What the modules are, and are not

• How they stay current. Each module is checked against its official publisher (for example the Dutch Staatsblad or Italy's Gazzetta Ufficiale). An update is verified against the primary source and reviewed by two independent AI models before it merges, with an evidence record, and reaches production with a release. last_verified says when a module's edition was last checked against the publisher; it is not a guarantee that every sentence is correct.
• What they do not do. The API improves your assistant's answers. It does not add a country to your product: your controls, templates and implementation steps stay yours.
• Limits. Text only: no tool calling, no JSON mode, n of 1. See Framework knowledge for how detection and pinning work.

Related

• Framework knowledge
• Get an API key and first completion
• Credits and limits
• Zero Data Retention
• Product page for compliance platforms: ismscopilot.com/for/compliance-platforms