AI for laws, regulations and standards
Ask a question about laws, regulations or standards in plain language. Quonai answers and shows the article it comes from, so anyone can check it on the spot. For software companies and teams in compliance, legal and cybersecurity: inside your own product, under your own brand or from Claude, Cursor and VS Code.
What Quonai does
Quonai knows over a hundred laws, regulations and standards, finds the provisions that matter for each question and explains them in plain language. You choose which ones count.
Ask a question the way you would ask a colleague. Quonai answers in plain language and names the provisions the answer rests on, with their code, title and the start of their text. Every source is a provision that really exists, never an invented article.
Search with your own words. Quonai searches on meaning and on the literal text at the same time, and puts the best provisions on top. You get the provisions themselves back, not a summary.
Describe your organisation or product in a few sentences. Quonai lists the laws and standards that are most relevant, each with a short explanation of why.
We put internal standards, handbooks or a client's framework beside the law. Quonai searches and answers from them as it does from the law, and only your organisation sees them.
Through the API in your app, portal or platform. In the sandbox the first question works within an afternoon.
Your customers see your product, with Quonai's answers and sources inside it.
Through the MCP connection your team asks Quonai from the AI assistant it already uses.
Examples
Six questions Quonai gets, and what comes back. Every answer with the provision it comes from.
QuestionWithin how many hours must a significant incident be reported under NIS2?
Without undue delay, with an early warning within 24 hours and the incident notification within 72. With Article 23(4) of NIS2 attached, in your platform and under your own brand.
QuestionHow soon must a personal data breach be reported to the supervisory authority?
Without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of people. Under Article 33(1) of the GDPR.
QuestionWho does a bank report a major ICT-related incident to?
To the relevant competent authority, under Article 19(1) of DORA. Quonai also knows MiFID II, Solvency II and the EU anti-money laundering rules.
QuestionWhat is the standard VAT rate in the Netherlands?
21 percent, under Article 9(1) of the Dutch VAT Act 1968. Dutch tax law down to the paragraph, for software that works with rates.
QuestionHow long must a Dutch business keep its records?
Seven years, under Article 52(4) of the Dutch General State Taxes Act, unless a tax law provides otherwise.
QuestionMay you hold your phone while driving in the Netherlands?
No. Anyone in charge of a vehicle may not hold a mobile device while moving, such as a phone or a tablet. Under Article 61a of the Dutch traffic rules, the RVV 1990.
Live demo
Pick an example question or type your own. You see the answer and the provisions it rests on.
Quonai engineHow soon must a significant incident be reported under NIS2?
Without undue delay and in any event within 24 hours of becoming aware of the incident, the entity sends an early warning to the CSIRT or, where applicable, the competent authority. (Provision 1) The incident notification follows without undue delay and in any event within 72 hours. (Provision 1) A final report is due no later than one month after that notification. (Provision 1)
Provisions 1
NIS2.ChIV.23.4Reporting obligations, paragraph 4
Member States shall ensure that, for the purpose of notification under paragraph 1, the entities concerned submit to the CSIRT or, where applicable, the competent authority: (a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact; (b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, … (d) a final report not later than one month after the submission of the incident notification under point (b), …
Directive (EU) 2022/2555, EUR-Lex
Example questions
Example answers. The provisions are the text in the corpus, checked against the official source on 2 October 2026.
What Quonai knows
From cybersecurity and privacy to tax and traffic rules. Every law and standard is in it per provision, with its source. Missing a law you need? Then we add it.
101laws, regulations and standards
40,982provisions
Counted on 2 October 2026, without customers' own rules.
Standards such as ISO 27001 and NEN 7510 are in the corpus per control, in our own words. Their literal text belongs to the publisher.
Everything Quonai knowsBuilt for developers
For your developers: one API, an MCP server and documentation where they can try everything straight away. Within an afternoon they ask the first question from your own software.
Contact
Send us your hardest question. In a first conversation of half an hour you see the answer, with the provision attached.
Rather email us directly?
info@quonai.com