How CSIRT-Sim uses artificial intelligence

Version 1.0 of 3 October 2026, effective from the day it is published on the site. This is a translation; if it differs from the Polish version, the Polish version prevails.

CSIRT-Sim is a crisis-exercise simulator. Some of the content during the game and in the final report is written by a language model (AI). This page explains what the AI does and what it does not do. We publish it in line with the transparency obligation in Article 50 of the EU AI Act.

Where the AI is used

The AI model is used in five places. Each time it receives the scenario description and the game state: roles, indicators and event titles. In addition:

Assessing a decision written in your own words. When you type your own decision instead of picking one from the list, the AI judges whether it is realistic, describes how it plays out and proposes its effects on the crisis indicators. If it finds the decision impossible, it rejects it and gives the reason. The model receives the text of the decision (12 to 600 characters), even when it rejects it.
Advisor. During the game the team can call an advisor: a law firm, a former CISO or a PR agency. The answer is written by the AI. The model receives the text of the question (12 to 500 characters).
Final report. After the game the AI writes a commentary: what worked, what did not and why. The model receives the course of the session, the decisions taken and the questions put to the advisor.
Escalations. In group sessions and in the administrator's classes, at medium or hard difficulty, the AI adds extra events to the inbox, such as a question from a journalist or the regulator, tailored to what has already happened. The model receives only the game state, without players' texts. There are no escalations in the solo demo.
Event requested by the administrator (only in their classes). The administrator can ask the AI for a new event in the game. The model receives the administrator's hint and the titles of previous events.

What the AI does not do

It does not compute the score. The score is calculated by a fixed algorithm from the crisis indicators at the end of the game. The AI cannot change it. The AI affects the indicators only through the effects of decisions written in your own words, and within limits: one such decision can move each indicator by at most 25 points out of 100, and the financial loss by at most EUR 125k.
It does not decide the effects of decisions from the list. The effects of decisions from the scenario catalogue were written by the authors. The same decisions from the list always give the same score. This is also how the peer-reviewed article about the project describes it.
It does not assess people. The score is a teaching aid, not a formal grade. The course grade is decided by the teacher, not by the system.

Who provides the model and what happens to the data

The AI model is provided by Anthropic Ireland, Limited (Claude models). We do not attach nicknames, IP addresses, cookies or session codes to the data we send. However, whatever you type into a decision or question reaches the model.

Anthropic does not train models on data from our account. It automatically deletes the texts sent and the responses within 30 days, with the exceptions described in section 3 of the privacy notice.

Do not enter real personal data: names, details of real customers or information about real companies. The game is fiction and should stay that way.

When the AI is unavailable

The game works without AI too. AI features can be switched off, and demos and group sessions have a daily AI budget. When the AI is not available, the game carries on, but without decisions in your own words, the advisor and escalations, and the report is built from a template. The score is calculated in the same way. The budget resets at midnight UTC.

Limitations

AI-written content can be imprecise or wrong, including about the law. CSIRT-Sim is a teaching tool, not legal advice. More in the terms of use.

Questions: contact@ksiezopolski.pl