Answers hide behind click paths
“Which products use this bearing?” means a where-used search, an export and a spreadsheet.
PLM Copilot by Curiosbot
Ask your PLM.
PLM Copilot by Curiosbot lets engineers and change managers question their PLM system in plain language. Every answer shows its source, and every change is previewed, confirmed, verified and audited.
The demo runs on synthetic PLM data.
Real screens from the VELO demo PLM. Data is synthetic. The problem
Product data is critical, and hard to reach.
Reports go stale
Change and task status is copied out of the PLM, so nobody knows how current a number is.
Generic AI is unsafe here
A chatbot that guesses part numbers, or edits a released item without review, is not acceptable in engineering.
PLM Copilot answers from the PLM system itself, shows its source, and never changes data without a confirmed preview.
What it does
One conversation with your PLM system.
Reads run straight away under your own PLM identity. Changes always become a plan that you preview and confirm.
Ask
Overdue tasks, open changes, documents linked to a change, parts modified this week.
See
Dashboards, BOM trees, revision comparisons and where-used maps, saved and refreshed.
Change
Update attributes, raise change requests, attach documents and submit for review, with a preview first.
Teal marks reading. Magenta marks anything that changes PLM data, in the product and on this page.
The product
Questions, structures, sources and checked changes.
Six capabilities, each shown on a real screen from the demo environment. Select a screen to open it at full size.
01 Ask
Ask a question, get a dashboard
Type “Create a dashboard of open changes by owner and age.” The answer is built from the live API response. Counts and charts are computed by the application, not by the AI model, and can be saved and refreshed.
- Plain-language questions about tasks, changes, documents and parts
- Dashboards you can save as a view and refresh later
- If the PLM returns only part of the data, the result says “at least” and is marked as truncated
02 See
BOMs and revisions without the click-through
Ask for “the BOM for DU-1000 at revision C” and get a multi-level tree with find numbers, quantities and states. Revision comparisons and where-used work the same way.
- Repeated parts stay separate occurrences, as they are in the PLM
- The revision rule is stated on the result, so you know which revision each level shows
- Where-used says when some parents are hidden by access rules
03 Provenance
Every answer shows its source
Each result carries a title block, like the corner of an engineering drawing, so you can see where the data came from and how current it is.
- Source system, time retrieved and whether the data is live or cached
- Completeness: complete, or truncated when the PLM returned only part
- Revision context and the PLM identity the question ran as
04 Change
Nothing changes until you confirm
A requested change becomes a plan. You see the system, object, revision and the before and after values, and confirm. The change then runs once through the PLM’s own API and business rules, and PLM Copilot re-reads the object to verify it.
- The preview names the target system, the object and its risk, with current and proposed values side by side
- The receipt separates “request accepted” from “operation completed” and carries an audit reference
- Releases, lifecycle changes, deletes and bulk edits require typing the object ID
05 Administration
Discovered is not the same as allowed
PLM Copilot reads your API descriptions: OpenAPI, OData metadata or WSDL. An administrator reviews each operation’s effect and risk, then enables it for chosen roles. Users see only what they may use.
- An HTTP GET is not assumed safe, and unclassified operations cannot be enabled
- Discovery reads only approved service roots and never runs an operation to test it
- If a later discovery shows an operation changed or disappeared, it is disabled and pending actions that used it are invalidated
06 Audit
Every action is on the record
Requests, validated plans, confirmations, the identity that executed each call, affected objects and outcomes go into an append-only history. A hash chain lets you verify it has not been altered. Secrets are never recorded.
- Filter the history by event type or plan
- See who requested each action and which PLM identity executed it
- Verify integrity on demand: the screen shows the hash chain as intact
Control
Safety rails built into every action.
Bound confirmation
Tied to the exact plan, user, connection and expiry. Any change needs a new confirmation.
Stale-object check
Object state and ETag are re-read before execution. A concurrent edit or a lock stops the change.
Explicit review
Releases, lifecycle changes, deletes and bulk edits require typing the object ID.
No blind retries
After a timeout the object is re-read. Only idempotent calls are resent; otherwise the outcome is marked unknown.
PLM rules apply
Changes go through the vendor API with its permissions and workflow. No direct database writes.
Tamper-evident audit
Append-only, hash-chained history of requests, plans, confirmations, identities and outcomes.
Confirmation binding and expiry, stale objects and locks, duplicate submissions, timeouts, partial failures and audit tamper detection are each covered by automated tests.
AI boundaries
AI picks the tool. The application decides.
The model may
- Choose one of the operations enabled for you
- Propose arguments for it
- Ask a clarifying question
The model never
- Run code, SQL or arbitrary HTTP calls
- See PLM data, credentials or session tokens
- Skip validation, permissions or confirmation
The AI model is optional. By default, built-in rules interpret requests fully offline. A local OpenAI-compatible model or a hosted model can be added, and a hosted one only with an explicit administrator opt-in. Instructions hidden in PLM content are treated as data, flagged and ignored.
Integration
Connectors, and where each one stands.
We list the status of every connector plainly. No PLM vendor is claimed as supported until its connector has been verified on a live system.
| System | How it connects | Status today |
|---|---|---|
| SAP S/4HANA | OData services, SAP CSRF | Built from SAP documentation, not yet tested live |
| PTC Windchill | REST Services (OData) | Built from PTC documentation, not yet tested live |
| Siemens Teamcenter | Your gateway’s API definitions | Needs definitions or an SDK bridge |
| Oracle Agile PLM | Web services (WSDL) | Discovery works; execution needs an adapter |
| Any OpenAPI or OData API | Generic connector | Tested against the demo PLM |
A connection never shows as healthy until an authenticated call succeeds. A first pilot turns “not yet tested live” into verified.
Deployment
Runs where your data has to stay.
On your servers
One Docker Compose install for a single organization. With the built-in rules or a local model, nothing leaves your network.
Hosted
Separate organizations, enterprise sign-in, usage metering and quotas, and workers that scale out.
Hosted, private PLM
A small agent inside your network connects out. PLM credentials stay with it, and its own allowlist decides what it can reach.
With the hosted agent, the PLM responses your users ask for pass through the service. The on-premises install is the option when that is not acceptable.
Status
Where it stands today.
Facts about the current build, as of October 2026.
- Live
- Public demo on synthetic PLM data
- 120
- Automated tests, run on SQLite and PostgreSQL
- 3
- Deployment modes from one codebase
Next: verify a first vendor connector with a pilot customer, add delegated sign-in to the PLM, then browser end-to-end tests and billing.
FAQ
PLM Copilot: frequently asked questions
What is PLM Copilot?
PLM Copilot by Curiosbot is a web application that lets engineers and change managers ask their PLM system questions in plain language. It returns live answers, dashboards, BOM trees and revision comparisons with their source, and it makes changes only after you have seen a preview and confirmed it.
Can PLM Copilot change data without asking me?
No. Any change becomes a plan with a preview showing the system, object, revision and the before and after values. It runs only after you confirm, once, through the PLM’s own API and business rules. The object is then re-read to verify the result, and the outcome is recorded in an append-only audit history.
Does the AI model see my PLM data?
No. The model may choose one of the operations enabled for you, propose arguments and ask a clarifying question. It never sees PLM data, credentials or session tokens and never runs code, SQL or arbitrary HTTP calls. The model is optional: by default, built-in rules interpret requests fully offline.
Which PLM systems does it work with?
The generic OpenAPI and OData connector is tested against the bundled demo PLM. Connectors for SAP S/4HANA and PTC Windchill are built from the vendors’ documentation and have not yet been tested against a live system. Siemens Teamcenter needs your gateway’s API definitions or an SDK bridge, and Oracle Agile PLM needs an adapter for execution. A first pilot is how a connector becomes verified.
Where does PLM Copilot run?
It can be installed on your own servers with Docker Compose, or used as a hosted service. For a PLM inside a private network, a small agent runs in your network and connects out, so PLM credentials stay with it. With the hosted agent, the PLM responses your users request pass through the service, so the on-premises install is the option when that is not acceptable.
How are administrators in control?
PLM Copilot reads your API descriptions, but discovered operations are not enabled automatically. An administrator reviews the effect and risk of each operation and enables it for chosen roles. Users see only what they may use, and an operation that later changes or disappears is disabled.
Is there a demo?
Yes. A public demo runs at plmbot.curiosbot.com against the bundled VELO demo PLM. All data in it, and in every screen on this page, is synthetic.
How do we start a pilot?
Get in touch and we will agree a four-week pilot on a non-production PLM system. We need one test environment and a PLM administrator for a few hours a week. Live tests that change data stay opt-in and run only against that system.
Pilot it on your test PLM.
Four weeks on a non-production system: connect, review the catalogue with your PLM administrator, and run real questions from your engineers.