Check Point lets firms write their own AI guardrails in plain language
Check Point has introduced custom guardrails as part of Check Point AI Security, letting companies write their own AI rules in plain language, test them and enforce them on every message and tool call. The company argues that the rules that cause the most damage are the ones no vendor ships by default.
- Check Point's custom guardrails let firms write AI rules in plain language and enforce them on every message and tool call.
- According to Check Point's 2026 Cloud Security Report, only 14 percent of organizations enforce and audit formal GenAI policies.
- Saved guardrails run without an LLM, adding about 35 to 40 milliseconds at the 95th percentile for one or two rules, per Check Point.
- Self-hosted support is due from November 2026.
- Check Point advises starting in detect mode, and notes guardrails check one message at a time.
The rules no vendor's list contains
Check Point points to a gap between the threat lists that guardrail products share and the rules a business actually needs. It cites its 2026 Cloud Security Report, according to which only 14 percent of organizations say they have formal GenAI policies that are actively enforced and audited.
The company gives several examples of chatbot failures that involved no attacker. In 2024, a Canadian tribunal held Air Canada liable after its chatbot told a passenger about a bereavement refund the airline did not offer. New York City's assistant for small businesses was caught telling employers they could take a share of their workers' tips, and the city shut it down this year. The parcel firm DPD found its chatbot swearing at a customer. According to Check Point, each broke a rule its owner could have written in one sentence.
The same gap applies to data loss prevention (DLP). Check Point notes that every country sets its own categories of protected data. US health data has 18 identifiers to remove before it counts as de-identified, Korea's privacy law strictly limits the processing of resident registration numbers, and a bank in Spain must catch DNI and NIE numbers that no US list contains.
Why prompts, keywords and second models fall short
Check Point describes three common fixes and their weaknesses. A line in the system prompt, such as never give investment advice, is a request to the model rather than a control: the model can be argued out of it and nothing records when it slips. Keyword lists and regular expressions catch exact formats but not meaning, and misfire in both directions. The company cites a bank chatbot that scolded a customer for typing "virgin" in a question about Virgin Money's own savings accounts.
The third option, asking a second AI model to judge every message, understands meaning but adds hundreds of milliseconds and a cost to every message, and hands each one to a model provider, according to Check Point.
How the builder works
A user describes what should be caught in a sentence. The builder's AI assistant asks a question or two if the scope is unclear, then compiles a policy that can be read before saving. It chooses the rule type for each part:
- Meaning rules cover topics such as whether a reply gives financial advice. They catch paraphrases, work across languages and have three sensitivity levels.
- Pattern rules cover exact formats such as an IP address, an internal account number or a national ID, with nothing to tune.
- Logic joins the two, for example flag this unless that is also present.
Testing happens in the same conversation. Users paste in example messages or let the builder generate some, see which rule fired, and describe any change needed. Check Point says going from description to a tested detection takes under five minutes.
Speed, agents and limits
The AI model only helps build the guardrail. Once saved, it runs without a large language model in the loop, so the check makes no external calls. According to Check Point, a policy with one or two rules adds about 35 to 40 milliseconds at the 95th percentile, so it can run on every message rather than a sample. From November 2026 it can also run in self-hosted environments.
Each guardrail can be scoped to user messages, model replies, or the inputs and outputs of an agent's tool calls. A DLP rule for national ID numbers could check what a support agent writes into a ticket or an outbound email. A pattern such as a command to drop a database table can be applied only to a database tool, which makes it precise.
Check Point lists limits. Guardrails work best on one bounded topic at a time and check one message at a time, so they will not catch problems that only emerge across a conversation. They are not meant for adversarial threats, which the prompt attack detectors in the same policy handle. Judging whether generated code is safe remains hard. The company recommends running a new guardrail in detect mode first and watching what it flags before blocking anything.
What it means for businesses
For companies deploying AI apps and agents, the pitch is that enforcing business-specific rules no longer has to wait for a vendor's roadmap or depend on pages of regular expressions. Check Point says custom guardrails give those rules the same protection as shared threats. The company offers demo sessions, documentation and a webinar, and says an article on audio guardrails and voice input for agents is next in its series.
Check Point: Custom Guardrails: The AI Rules No Vendor Can Write for You
