Disclaimer

Educational Purpose

All content on Do GRC — including learning paths, hands-on rooms, AI scenarios, and case studies — is provided strictly for educational and informational purposes. Nothing on this platform constitutes professional legal, audit, compliance, or regulatory advice.

You should always consult qualified professionals for advice specific to your organisation's compliance obligations and regulatory requirements.

No Guarantees

While we strive to provide accurate and up-to-date content, Do GRC makes no guarantees regarding:

• Specific career outcomes, job placements, or salary expectations.
• Passing professional certifications or examinations.
• Regulatory acceptance or audit readiness of any framework implementation.
• The completeness or accuracy of content at any given time.

GRC frameworks and regulations are subject to change. We update our content regularly but cannot guarantee it reflects the very latest revisions at all times.

The Career Quiz suggests areas of GRC to explore, from a fixed scoring of your answers. It is not career advice, an aptitude test or a careers assessment, and its suggestions do not mean you would succeed in a role or be hired into one.

A team's progress view and its training-records export show what members did on Do GRC: what they completed, when, and the marks the platform gave. They are not an assessment of anyone's competence or of their work, and the marks carry the same limits as the rest of the site's AI-generated content and marking, described below.

AI-Generated Content (Unreviewed)

Every user-facing piece of content on Do GRC — including learning paths, rooms, case studies, questions, model answers, scenarios, role-play conversations, lab environments, and all of the games under /play/* — is generated by AI and has not been audited or fact-checked by a human GRC practitioner.

Because content is unreviewed, it may contain:

• Factual errors, inaccuracies, or outdated references.
• Hallucinated controls, clauses, or standards that do not actually exist.
• Misattributed framework names, control IDs, or regulatory citations.
• Oversimplifications that omit material nuance.

Treat everything on the site as a study aid only. Always verify against primary sources (NIST, ISO, the regulator's own publications, vendor documentation) before relying on any of it for real-world decisions.

Any internal automated or AI-based quality checks we perform on the content do not constitute a professional or independent audit and should not be treated as such.

AI Audit of Content

The readings, and the questions and answers, for our learning paths and case studies — together with the readings for our scenarios — have been AI-audited for accuracy, with flagged issues reviewed and corrected.

Every lab environment was also AI-audited in September and October 2026. The audit covered the whole of each one — the organisation, its evidence, the questions, the answer keys and the marking rubrics — and checked every answer key against the evidence it is marked on and against the frameworks and laws it cites. The errors it found were corrected; matters of judgement, and changes that would have meant rewriting the evidence, were recorded for a later revision instead. A lab added or changed after that audit may not have been through it.

These audits were themselves performed using AI. An AI audit is not a human or independent professional audit: it can miss errors, introduce new ones, and does not guarantee the accuracy, completeness, or currency of any content. Audited content should be treated the same way as the rest of the site — as a study aid to be verified against primary sources. An audited lab can still mark a correct answer wrong or an incorrect answer right.

Separately, the automated consistency checks run over lab content verify its internal coherence, not its correctness, and are not a review of any kind.

A full human audit of the content has been considered, but at the scale of this platform it has been found to be unfeasible and not a sound business decision on cost grounds. Having qualified GRC practitioners manually review — and then continually re-review — the entire, ever-growing library of learning paths, case studies, scenarios, question banks and lab environments would be prohibitively expensive. The AI audits described above are the proportionate alternative we have adopted in its place.

In addition, several features generate content dynamically, on the spot, at the moment you use them — including GRC Coach chat and AI-generated learning journeys, AI Check and AI Assist grading, Role Play, Exam Prep and Interview Prep, lab written-answer marking, the Resume Point Generator, Play Arcade rounds, text-to-speech, and the GRC Toolkit AI-fill helpers. This output does not exist until you request it, so by its nature it cannot be audited in advance and is not covered by any content audit.

AI-Powered Evaluation

Many features on Do GRC are powered by AI. Because an AI is grading AI-generated questions, both the question and the grading can be wrong. AI-powered features include:

• GRC Coach chat and AI-generated learning journeys.
• AI Check and AI Assist on case-study and scenario questions.
• Role Play conversational practice scenarios.
• Lab environment written-answer marking and its feedback.
• Exam Prep and Interview Prep question generation and grading.
• Resume Point Generator.
• Play Arcade AI-generated rounds and AI deep-dive explanations.
• Text-to-speech audio synthesis.
• GRC Toolkit AI-fill helpers across the risk, audit, compliance, vendor, threat, policy, business continuity, and board-reporting modules.

AI-generated feedback, scores, and model answers are provided for learning and practice purposes only. They do not constitute professional legal, audit, compliance, or risk management advice. See the Terms of Service (AI-Powered Features) for further detail on usage limits and liability, and AI Transparency for how AI output is labelled and how its provenance is recorded.

Lab Environments Are AI-Generated and Not Human-Reviewed

Everything in a lab environment is generated by AI and has not been reviewed, audited or fact-checked by a human GRC practitioner. That covers the whole of a lab, not only the parts you read:

• The organisation itself — its profile, structure, systems and staff.
• Every artefact of evidence — policies, registers, contracts, tickets, system and identity exports, org charts, diagrams and reports.
• The scenario briefs, the questions and the written prompts.
• The answer keys your structured answers are compared against, and the point values attached to them.
• The marking rubrics, and the AI marking of written answers and the feedback it returns.

Every lab has been audited by AI, as described under AI Audit of Content above. That audit looked for wrong answer keys, citations, ratings and mappings and corrected those it found, but it is not a human review and cannot guarantee that none remain. The AI marking of your written answers happens when you submit them, so no audit can check it in advance.

The consequence is that a lab can mark you wrong when you are right, and right when you are wrong. An answer key may contain a hallucinated control reference, an incorrect finding, an unsound rating or a mapping that does not hold, and the feedback on a written answer may be confidently mistaken. Nothing in a lab — including a full score — is evidence that a judgement you made is professionally correct.

Treat lab environments as practice at reading evidence, not as an authority on what the right answer is. Verify any control, clause, framework reference or regulatory citation you take from a lab against primary sources before using it anywhere real.

This applies without change to the answer key available on the Pro membership. The answers it shows you — under room questions and under lab fields — are the same AI-generated material, never reviewed by a human, that a marker compares your answer against, and the model answers it shows under scenario tasks are AI-generated and not human-reviewed in the same way. Being shown an answer does not make it correct. An answer key can be wrong in exactly the ways described above, and you should verify anything you take from it before relying on it.

Lab Environments Are Fiction

Every organisation in a lab environment is invented, and so is everything inside it. The companies, staff, customers, suppliers, systems, IP addresses, identifiers and dates were written for the exercise. Any resemblance to a real organisation or person is coincidental.

The evidence in a lab is written to look like the real thing, because reading real formats is the skill being taught. That includes documents modelled on assurance reports, contracts, banking agreements and regulatory correspondence. None of them is a genuine report, agreement or communication, none evidences any real organisation's controls, and none may be relied on or reused outside the exercise. Several contain deliberate errors, because finding them is the point.

The findings, ratings and control mappings in a lab reflect one defensible reading of invented evidence for teaching purposes. They are not professional audit, legal or compliance advice, and a mapping that fits a lab may not fit your organisation.

Third-Party References

Do GRC references third-party frameworks, standards, and tools (such as NIST CSF, ISO 27001, SOC 2, PCI DSS, and others) for educational context. These references do not imply endorsement, affiliation, or partnership with the respective organisations. Trademarks and framework names belong to their respective owners.

Certifications and certifying bodies named on Do GRC, including ISACA (CISA, CISM, CRISC), ISC2 (CISSP, CGRC), the IAPP (CIPP, CIPM, CIPT, AIGP), CompTIA (Security+) and the other bodies listed in Exam Prep, are referred to only to describe them. Do GRC is not affiliated with or endorsed by any of them, and is not an approved, pre-approved or partner provider of any of them. A CPE record shows what you completed on Do GRC and the time credited; each body decides whether it counts toward its certifications.

External Links

The platform may contain links to third-party websites or resources. We are not responsible for the content, accuracy, or practices of external sites. Visiting external links is at your own discretion and risk.

Non-Affiliation Notice

Do GRC is an independent project. It is not affiliated with, endorsed by, sponsored by or accredited by any certification body, standards body, accreditation body or regulator, including ISACA, ISC2, the IAPP, CompTIA, ISO, the PCI Security Standards Council and the AICPA, or by TryHackMe or Hack The Box. Names of certifications, standards and frameworks are trade marks of their owners and are used only to describe what our material covers.

Contact

If you have questions about this disclaimer, please contact us at hello@dogrc.com.