Role
Compliance
Who is accountable for a procedure being applied - its author, or the department head who did not write it? Compliance begins where that answer stops being obvious.
Intro call
Four questions we would start with
Who is accountable for applying a procedure?
If you cannot name one person for each of them, some obligations have no owner - and that usually surfaces during an inspection.
How do you know a procedure is current against the regulations?
If it is because nobody has raised an objection, then it being current is an assumption.
What do you not do, even though you know it has to be done?
Usually: reviewing procedures, internal checks and refreshing training. Always for the same reason - there is no time.
Where does an employee's report of a possible irregularity go?
If there is no single, protected route for it, then either the report does not happen or it goes outside.
We take over the tracking and the chasing, you keep the judgement and the conversation
Maintaining the map of obligations, watching whether procedures are current, handling training and preparing for inspections can be taken off the desk. Judging whether something is an irregularity stays with a person.
- An obligation has an owner and a date. - Every requirement is assigned to a process, a person and the procedure that delivers it, and gaps are visible as gaps.
- A procedure has a review date. - A document unchanged for years reports itself instead of waiting for an inspection.
- A report has a protected route. - With acknowledgement of receipt, a deadline and restricted access, so that confidentiality does not depend on who happens to be watching the inbox.
Scope
What can be taken off compliance
Twenty example tasks. Each one has a human approval point. Below is a selection, and the scope we fit to your regulatory obligations.
The map of obligations
- A register of obligations by area and legal basis
- Linking an obligation to a process and a procedure
- Pointing out obligations with no owner assigned
- A signal when a regulation affecting an obligation changes
Procedures and whether they are current
- A register of procedures with the date of the last review
- A signal when a procedure needs reviewing
- Pointing out procedures affected by a change in the law
- The approval flow for a new version (approval: the process owner)
Training and declarations
- The list of people covered by a training obligation
- The status of training and declarations by person and date
- A reminder before the date passes
- Outstanding items summarised by department
Reports and whistleblowers
- A protected reporting route with acknowledgement of receipt
- Assigning the case with restricted access
- Watching the response deadlines set by the regulations
- A register of reports with no identifying data in the summaries
Internal checks
- A plan of checks based on the risk of the area (decision: the specialist)
- The list of questions and evidence to gather
- A register of findings and corrective actions
- Material for an external inspection
A day's work
Today
- Your map of obligations is a spreadsheet, updated irregularly
- You learn about a change in the law from a newsletter or from a lawyer
- You check by hand which procedures need reviewing
- You collect outstanding training by asking departments for lists
- Reports arrive in an inbox several people have access to
- Before an inspection you assemble the evidence over two weeks
With AI assistance
- Obligations are assigned to processes and owners, and gaps are visible
- A change in the law points out the procedures and obligations it affects
- A procedure due for review reports itself
- You see outstanding training by department without asking
- A report has a protected route and a deadline that is watched
- Evidence for an inspection is gathered as you go
- Obligations covered
fewer requirements with no owner assigned
obligations are linked to a process and a person
- Current procedures
fewer documents describing the state before a change in the law
a review has a date and a signal
- Mandatory training on time
fewer people without the training required
statuses and reminders happen without manual work
- Ready for an external inspection
the evidence is gathered beforehand, not in the week before
the material is built as you go
We start with the map of obligations, because without it there is no knowing what to watch.
- Step 1
Obligations, processes, owners
A register with the legal basis and the assignment. Gaps usually show up at this stage already.
- Step 2
Procedures and review dates
Signals about documents that need updating.
- Step 3
Training and reports
Statuses, reminders and a protected reporting route.
- Step 4
Internal checks
A risk-based plan and a register of findings. Last, because it rests on the map from step 1.
Common questions
Questions that come up at the first meeting
How is this different from a lawyer and a data protection officer?
A lawyer assesses a particular case and contract. A data protection officer watches one area - personal data - and has their own statutory duties. Compliance is accountable for whether the company's processes match the obligations that bind it, whatever the field.
Can compliance be handled by a smaller team?
Compliance in most companies is one or two people for an area that covers the whole organisation - the problem is not a surplus of hands, it is that not everything can be watched. Taking over the tracking of dates and statuses replaces nobody, it allows attention to reach the obligations that today exist in the register and nowhere else.
Does this fall under the AI Act?
Supporting compliance is not a high-risk use under the AI Act. The limit to remember for reports concerning particular people comes from a different order - from article 22 of the GDPR: whether an irregularity occurred cannot be decided solely by automated means. It is worth keeping the two regimes apart, because confusing them is the most common mistake in conversations about compliance.
Still have a question that is not here? Book a call
Next step
How many of your procedures have not been reviewed in more than two years?
We will show you what compliance looks like when an obligation has an owner and a procedure past its date reports itself.