---
title: 10.04 The AI Extra Overview
description: The Artificial Intelligence Extra integrates Claude (Anthropic), GPT (OpenAI), Gemini (Google), Mistral, Grok (xAI), and local Ollama models into…
---
[Skip to content](https://support.simplerisk.com/kb/10-04-the-ai-extra-overview#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en)
3. [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
# 10.04 The AI Extra Overview
## The Artificial Intelligence Extra integrates Claude (Anthropic), GPT (OpenAI), Gemini (Google), Mistral, Grok (xAI), and local Ollama models into SimpleRisk for FAIR analysis, control-to-document matching, document customization, template installation, and an in-context chat assistant. Pick a provider, configure the API key, enable the capabilities you want in the catalog, let the AI suggest content for operators to review.
> **Requires:** *AI Extra*
>
> AI provider configuration and one capability, GRC Framework Recommendations, ship free with Core. The AI Extra unlocks the rest of SimpleRisk's AI-assisted workflows: FAIR quantification, document and control assistance, control test generation, and the in-context chat assistant.
## Why this matters
GRC programs spend significant operator time on activities that benefit from language-model assistance: estimating impact and likelihood for FAIR analysis, mapping controls to evidence in policy documents, summarizing long policies into specific control statements, drafting initial policy text. None of these are tasks where AI is the authority (operators always review and accept or reject the AI's output), but as a *suggestion* layer, AI accelerates work that would otherwise be slow and tedious.
The AI Extra brings this assistance into SimpleRisk. The Extra integrates with the major commercial AI providers (Anthropic Claude, OpenAI GPT, Google Gemini, Mistral, xAI Grok) and with local-inference Ollama for fully-private deployments. Per-capability toggles in the Capabilities catalog control which AI assists with which workflows; per-provider configuration controls the API key, model, and budget.
The honest scope to know up front: **AI is a suggestion tool, not an authority**. Every AI output goes through operator review before becoming canonical SimpleRisk data. The Extra is built around a "AI suggests, operator approves/edits/rejects" pattern, not "AI runs the program." This is the right shape (risk and compliance decisions need human accountability), but it means AI doesn't reduce headcount; it speeds up the headcount you have.
The other thing worth knowing: **data leaves your environment when commercial providers are configured**. Calling Claude or GPT means sending the prompt (which contains the relevant SimpleRisk data: risk descriptions, document text, control names) to Anthropic's or OpenAI's API. The Extra doesn't anonymize or scrub the data before sending. For programs handling regulated content (PHI, PII, classified material), commercial providers may not be appropriate; the Ollama local-inference option keeps data fully within your environment.
The third thing: **provider responses are processed asynchronously via the cron queue worker**. AI calls can be slow (10–60 seconds is typical for substantive prompts); doing them synchronously would freeze the user's browser. The Extra queues AI jobs and processes them in the background; the UI shows "processing" status and updates when results arrive.
## How frameworks describe this
AI in GRC is a recent development; framework guidance is still evolving. NIST AI RMF (NIST AI 100-1) is the most comprehensive guidance on managing AI risk, including data privacy considerations for AI-using applications. ISO/IEC 42001 (AI management systems) provides a management-system framework for AI deployment. For programs adopting AI features in SimpleRisk, both documents are worth reviewing — the AI Extra's privacy implications, model governance, and decision accountability all map to AI RMF concerns.
## How SimpleRisk implements this
### Supported providers
SimpleRisk supports seven providers:
- **Anthropic Claude** — default. Models: `claude-sonnet-5` (the default), `claude-opus-4-8`, `claude-fable-5`, `claude-haiku-4-5-20251001`. API: native Anthropic Messages API.
- **OpenAI GPT** — models: `gpt-5.6-terra`, `gpt-5.6-sol`, `gpt-5.6-luna`, `o3`, `gpt-4.1-mini`. API: OpenAI Chat Completions API.
- **Google Gemini** — models: `gemini-3.5-flash`, `gemini-3.1-pro-preview`, `gemini-3.1-flash-lite`, `gemini-flash-latest`. API: Gemini.
- **Mistral** — Mistral models via Mistral's API.
- **xAI Grok** — Grok models via xAI's API.
- **Ollama** — local inference. Models: whatever you've loaded into your local Ollama instance (Llama, Mistral, etc.). API: local endpoint, no cloud calls.
- **Custom** — user-supplied OpenAI-compatible endpoint (for organizations running their own LLM behind an OpenAI-API-compatible proxy).
The model lists above are suggestions offered in the UI — an admin can type any model name the chosen provider supports.
The provider is selected per-install via the `ai_provider` setting; only one provider is active at a time.
### AI use cases
The Extra's AI assistance is organized into nine capabilities across five domains: Recommendations, Risk, Documents, Controls, and Assistant.
- **GRC Framework Recommendations** (Recommendations, free with Core): framework fit recommendations and an executive summary, tuned to the organization's context.
- **Risk Recommendations** (Risk): per-risk detail and mitigation suggestions.
- **FAIR Quantitative Analysis** (Risk): the AI estimates Beta-PERT loss parameters (threat capability, vulnerability, loss magnitude) from a risk's description and the program's FAIR context; SimpleRisk runs a 10,000-iteration Monte Carlo simulation on top of those estimates. This used to ride along with risk recommendations — it's now its own toggle, so a program can turn on mitigation suggestions without also turning on quantitative FAIR output.
- **Document Customization** (Documents): fills placeholders and cleans up policy document text.
- **Document ↔ Control Matching** (Documents): maps controls to policy documents with a confidence score and reasoning, useful for compliance evidence collection.
- **Document Template Library** (Documents): installs policy, guideline, and procedure templates from the SimpleRisk library.
- **Control Reference Enhancement** (Controls): researches verbatim control text via web search.
- **Control Test Generation** (Controls): drafts candidate control tests for operator review — grounded in the control's framework mapping, existing tests, and self-assessment results — and surfaces them on the Compliance **Define Tests** grid. Nothing is created until an operator approves it.
- **Chat Assistant** (Assistant): an in-context GRC assistant. Today it's available on the Risk Management pages — **Submit Risk**, **Plan Mitigation**, **Perform Reviews**, **Review Regularly**, and a risk's **Risk Details** view; bringing it to Compliance, Governance, and the other modules is on the roadmap but not yet scheduled.
Every capability except GRC Framework Recommendations requires the AI Extra. Programs enable some and leave others off; see [Configuring AI Providers](https://support.simplerisk.com/kb/10-05-configuring-ai-providers?hsLang=en) for how to search, filter, and toggle capabilities in the Capabilities catalog.
### The AI context
For FAIR-style risk analysis, the AI needs the program's organizational context (typical loss magnitudes, threat assumptions, vulnerability levels). The Extra exposes a one-time questionnaire (`extra_ai_context_*` settings) that captures this context. Subsequent FAIR analyses use this context to ground their estimates in your program's reality.
The context is stored in your instance settings. Update it via the Extra's questionnaire when the organization's risk profile shifts (mergers, business model changes, regulatory changes).
### Job-based processing
AI requests run as queued jobs:
- **`ai_risk_fair_analyze`** — performs FAIR analysis for a single risk.
- **`ai_control_to_document_process`** — matches one control to documents.
- **`ai_document_to_control_chunker`** — extracts control statements from a document.
The cron worker (`cron_queue_worker.php`) picks up queued AI jobs and dispatches to the configured provider. Job status flows from `pending` → `in_progress` → `completed`/`failed`, and a run that is superseded before it finishes is marked `canceled`. The UI polls the job status and updates when complete.
For installs with high AI volume, the cron worker can backlog. Monitor queue depth; consider scaling worker instances or batching prompts.
### Data privacy
When using a commercial provider:
- **The prompt is sent to the provider's API.** The prompt typically includes the relevant SimpleRisk data (risk subject, description, FAIR context; or control name, document text, etc.). When a user asks for a risk analysis, the prompt also carries that risk's connected records — the assets attached to it and their valuations, the controls behind its mitigations with their maturity, and any exceptions, incidents and test results linked to it — limited to what the person who asked is allowed to see. Analyses the system runs on its own, without anyone asking, send the risk's own fields only.
- **The response is returned to SimpleRisk.** SimpleRisk stores the AI's output for operator review; no storage at the provider beyond their standard API logs.
- **The provider's privacy policy applies.** Commercial providers (Anthropic, OpenAI, Google) have specific data-handling commitments for API calls — generally, prompts aren't used for training and aren't retained beyond a short period. Check the provider's API privacy policy for current commitments.
- **Some commercial providers offer Zero Data Retention (ZDR) or HIPAA-eligible BAA tiers.** If your program handles regulated data, configure the appropriate provider tier.
When using Ollama:
- **The prompt and response stay within your environment.** No external API calls.
- **Inference performance depends on your local hardware.** Larger models need GPUs; smaller models run on CPUs.
- **Model quality varies.** Open-source models (Llama, Mistral) are improving rapidly but typically lag commercial offerings on substantive tasks. Test the quality against your use case.
### Cost considerations
Commercial AI providers charge per token (input + output). Substantive prompts (FAIR analysis with full context) are typically 1,000–10,000 tokens; cost ranges from fractions of a cent to a few cents per call. Budget calculator: assume $0.01–$0.10 per AI-assisted operation; multiply by expected volume.
For programs with high AI volume, the local-Ollama option eliminates per-call costs at the trade-off of upfront infrastructure investment.
## What the AI Extra doesn't do
- **Replace operator judgment.** Every AI output requires operator review. The Extra doesn't auto-commit AI suggestions to the canonical record.
- **Generate audit findings.** AI can summarize control test results; it doesn't run the tests or determine pass/fail.
- **Take administrative actions.** The AI doesn't modify users, change settings, deactivate Extras, etc.
- **Provide explainability beyond what the model offers.** Why did the model suggest "High" likelihood? The model's reasoning is internal; SimpleRisk relays the output, not the model's chain of thought.
- **Substitute for proper risk modeling.** AI-suggested FAIR estimates are starting points; the actual estimates require human judgment grounded in real program data.
## Common pitfalls
A handful of patterns recur with the AI Extra.
- **Activating AI features without operator-review discipline.** AI output going into the register without review compounds errors. Enforce review.
- **Sending sensitive content to commercial providers without considering privacy.** A risk description naming a specific customer, a policy document with PHI — these go to the provider's API. For regulated content, consider Ollama or a provider tier with appropriate guarantees.
- **Treating AI output as authoritative.** It's a suggestion. Operators review and decide.
- **Picking a model that's not appropriate for the task.** Smaller / faster models are cheaper but less accurate for substantive analysis. Match the model to the use case.
- **Not setting an AI budget alert.** Per-token billing can produce surprising bills if a misbehaving integration spams the AI. Set provider-side spending alerts.
- **Forgetting that the cron worker has to run.** AI jobs queue without it; the UI shows "processing" forever.
- **Activating all AI features at once.** Some are useful for some programs; some aren't. Activate selectively.
- **Not capturing the AI context (FAIR questionnaire) before using FAIR analysis.** The AI's estimates without context default to generic; with context they're grounded in your program's reality. Capture the context first.
- **Storing the AI provider's API key in source control.** Treat as a secret.
- **Using AI to generate the audit response that would otherwise have required real analysis.** The AI can draft; the operator must verify against actual evidence. Skipping the verification produces audit findings that don't match reality.
- **Not periodically reviewing AI suggestions for systematic biases.** Models can have systematic biases (always suggesting High severity, always missing certain control types). Sample-review periodically; recalibrate the prompts or the operator-review focus accordingly.
## Related
- [Configuring AI Providers](https://support.simplerisk.com/kb/10-05-configuring-ai-providers?hsLang=en)
- [What the Workflows Extra Does](https://support.simplerisk.com/kb/10-01-what-the-workflows-extra-does?hsLang=en)
- [The Cron Jobs](https://support.simplerisk.com/kb/02-07-the-cron-jobs?hsLang=en)
- [Installing Extras](https://support.simplerisk.com/kb/01-06-installing-extras?hsLang=en)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.