Compliance, risk and privacy workflows,
powered by AI.

The new rule waiting for an owner. The control marked complete without its evidence. The data request that touches several systems. Prepare the records, gaps and decisions your responsible reviewers need to see. These are illustrative workflows.

Browse every work area
What needs attention in the latest regulatory update?Source changes and policy questions filtered against the team's agreed watchlist.Is there evidence behind that control status?Risk owners, obligations and observed evidence prepared for the reviewer.Where does this data request need to go?Intake facts, system boundaries and response questions organized before disclosure.Who can actually stop or override this AI decision?Use-case records, reviewer authority and vendor data questions made concrete.

Built for the AI you already use.

  • ChatGPT
  • Claude
  • Copilot
  • Gemini

Explore the work behind the next decision.

Start with a job you recognize. Open it to see what gets prepared, the questions that remain and where a person decides.

Illustrative workflows, adapted to your own procedures and standards. Each needs to be scoped to your operation. Scheduling and system connections are possible setups, scoped separately. People retain the decisions shown.

Regulatory change

Prepare source-backed questions about changes for the people responsible for interpreting them.

A separately scoped scheduled run receives the selected source-feed export.A dated digest of changes, source links, coverage gaps and questions for counsel.

Prepare the changes on the agreed regulatory watchlist

Bring these each run
Approved watchlist, source-feed export, prior digest and business footprint.
The person decides
Counsel determines applicability and the compliance lead assigns follow-up.
Keep the exceptions visible
Draft proposals, final rules and commentary stay distinct; missing feeds are visible.
Work it connects
Compliance staff, counsel and policy owners.

Possible setup. From an approved export. On a schedule, with review.

Counsel flags a regulatory development for an AI governance review.A gap worksheet linking counsel-supplied requirements to policy, inventory and unresolved evidence.

Compare a new AI requirement with recorded practice

Bring these each run
Current source text, counsel's scope, AI inventory and approved governance documents.
The person decides
Counsel interprets obligations and the governance owner approves the response plan.
Keep the exceptions visible
Uncertain applicability stays a legal question; a document match does not demonstrate compliance.
Work it connects
Compliance staff, counsel and policy owners.

Possible setup. From approved files. When an agreed event happens.

Counsel and compliance identify an approved policy gap to address.A proposed redraft showing changed text, its rationale and unresolved implementation questions.

Prepare a focused policy change for its owner

Bring these each run
Current policy version, verified gap record and counsel-approved instructions.
The person decides
The policy owner and counsel approve the change and its implementation.
Keep the exceptions visible
The source policy remains unchanged and the gap stays open until implementation is verified.
Work it connects
Compliance staff, counsel and policy owners.

Possible setup. From approved files. On request.

Risk and control records

Keep risk discussions grounded in assigned responsibilities and inspectable evidence.

The risk lead requests preparation for a business risk review.A draft register of stated risks, existing controls, proposed mitigations and unresolved ownership.

Turn risk discussions into a reviewable register

Bring these each run
Risk workshop notes, incidents, current controls and the organization's assessment criteria.
The person decides
Risk owners validate the entries and authorized leaders accept or fund treatment of risk.
Keep the exceptions visible
A suggested rating is not a risk-acceptance decision; controls need evidence.
Work it connects
Risk owners, compliance staff, control owners and internal reviewers.

Possible setup. From approved files. On request.

A separately scoped scheduled run reads the approved obligation register.A review list of upcoming dates, named owners and evidence still required.

Prepare the next obligation and evidence review

Bring these each run
Counsel-verified obligations, internal deadlines, owner assignments and evidence locations.
The person decides
The compliance lead confirms priorities and counsel resolves uncertain obligations or dates.
Keep the exceptions visible
A date in an old reference is not a current duty; nothing is filed or certified.
Work it connects
Risk owners, compliance staff, control owners and internal reviewers.

Possible setup. From approved files. On a schedule, with review.

A reviewer asks what supports the recorded control status.An evidence index separating documented policy, observed system state and unresolved contradictions.

Connect control statements to the available evidence

Bring these each run
Approved control list, dated evidence exports, system scope and reviewer criteria.
The person decides
The control reviewer judges sufficiency and the responsible owner resolves gaps.
Keep the exceptions visible
Policy text alone does not prove a control operated; old or incomplete evidence stays labeled.
Work it connects
Risk owners, compliance staff, control owners and internal reviewers.

Possible setup. From an approved export. On request.

Data inventory and retention

Keep records of data use and retention decisions specific enough for accountable review.

The privacy lead asks teams to document a business data process.A draft inventory of data categories, purposes, systems, recipients and unknown flows.

Draft the map of where personal data is used

Bring these each run
System inventory, owner interviews, schema descriptions and approved data-flow records.
The person decides
Data owners verify facts and counsel determines legal classification and basis.
Keep the exceptions visible
Unknown systems and transfers remain gaps; classification is not inferred from a field name alone.
Work it connects
Privacy staff, counsel, data owners and system administrators.

Possible setup. From approved files. On request.

The privacy lead is preparing a retention schedule review.A draft matrix connecting categories, approved periods, triggers, owners and unresolved conflicts.

Organize retention rules by record category

Bring these each run
Record inventory, counsel-approved retention requirements and existing schedule.
The person decides
Counsel confirms the rules and data owners approve operational arrangements.
Keep the exceptions visible
No generic retention period is substituted and no deletion is initiated.
Work it connects
Privacy staff, counsel, data owners and system administrators.

Possible setup. From approved files. On request.

A separately scoped scheduled run reviews the approved exception register.A list of expiring exceptions with recorded reasons, owners, holds and missing review evidence.

Find retention exceptions that need a fresh decision

Bring these each run
Current retention schedule, exception register, counsel-confirmed holds and decision history.
The person decides
The privacy owner and counsel decide whether to extend, end or revise each exception.
Keep the exceptions visible
Silence is not approval; hold conflicts are escalated before any disposition.
Work it connects
Privacy staff, counsel, data owners and system administrators.

Possible setup. From approved files. On a schedule, with review.

Privacy requests

Prepare the factual record and proposed response while people control scope and disclosure.

A person submits a request concerning their data.An intake draft recording the request, receipt time, verification status and routing questions.

Prepare a new privacy request for the responsible owner

Bring these each run
Original request, approved intake procedure and counsel-defined timing rules.
The person decides
The privacy owner confirms identity, request type and routing; counsel resolves disputed scope.
Keep the exceptions visible
Do not infer identity from an email address or request unnecessary identification.
Work it connects
The privacy request owner, counsel and relevant system owners.

Possible setup. From approved files. When an agreed event happens.

The privacy team requests a scope review through a separately scoped system connection.A review of the configured export map, relationship boundaries and prior-run status.

Check what a proposed portability export would include

Bring these each run
Authorized read access, approved subject identifier, configured export policy and run logs.
The person decides
The privacy owner and system administrator confirm scope before separately authorizing an export.
Keep the exceptions visible
No policy is activated or export run; portability does not delete records or prove request completion.
Work it connects
The privacy request owner, counsel and relevant system owners.

Possible setup. Through a scoped connection. On request.

The privacy owner has assembled the authorized response material.A draft response with an evidence index, unresolved search gaps and proposed redaction questions.

Prepare the response from reviewed request records

Bring these each run
Verified request scope, approved search results, correspondence and counsel's instructions.
The person decides
The privacy owner and counsel approve exemptions, redactions and disclosure before sending.
Keep the exceptions visible
Third-party information, incomplete searches and uncertain identity remain blockers to release.
Work it connects
The privacy request owner, counsel and relevant system owners.

Possible setup. From approved files. On request.

AI governance

Make the proposed use, data exposure and human decision points visible before approval.

A business team proposes a new use of AI.An intake brief comparing the use with approved policy and listing required reviewers and missing facts.

Prepare an AI use case for the approval discussion

Bring these each run
Use description, affected people, data inputs, current AI registry and approved review rules.
The person decides
The governance owner decides the approval route and counsel determines legal questions.
Keep the exceptions visible
An existing tool approval does not automatically approve a different use or data scope.
Work it connects
AI governance owners, counsel, privacy staff and business sponsors.

Possible setup. From approved files. When an agreed event happens.

The team is reviewing an AI-assisted decision process.An oversight worksheet covering reviewer information, authority, competence, time and override records.

Check whether a reviewer can make a real decision

Bring these each run
Process map, reviewer instructions, access details and observed review examples.
The person decides
The governance owner approves changes to oversight; counsel assesses legal requirements.
Keep the exceptions visible
A sign-off button or nominal reviewer does not demonstrate meaningful review.
Work it connects
AI governance owners, counsel, privacy staff and business sponsors.

Possible setup. From approved files. On request.

The business proposes using an AI service with company data.A question pack comparing stated data uses, retention, training, subprocessors and contract commitments.

Prepare privacy questions for an AI supplier

Bring these each run
Vendor documentation, proposed use, data categories and supplied contract terms.
The person decides
Privacy staff assess evidence and counsel approves legal positions before the business commits.
Keep the exceptions visible
Marketing claims and incomplete answers are not treated as verified safeguards.
Work it connects
AI governance owners, counsel, privacy staff and business sponsors.

Possible setup. From approved files. On request.

Audit preparation and follow-up

Prepare the evidence reviewers need and keep unresolved findings visible.

The audit lead requests a plan for a defined review.A draft scope, evidence request list and proposed sampling and test procedures.

Prepare a bounded privacy audit plan

Bring these each run
Audit mandate, risk register, prior findings, system inventory and applicable reviewer criteria.
The person decides
The audit lead approves scope, independence arrangements and procedures.
Keep the exceptions visible
The plan does not establish assurance or certification; exclusions and access gaps remain explicit.
Work it connects
Internal reviewers, compliance leads and remediation owners.

Possible setup. From approved files. On request.

An owner reports that a remediation action is complete.A comparison of the finding, promised action and supplied evidence with retest questions.

Prepare the evidence needed to close an audit finding

Bring these each run
Original finding, agreed action, owner response and implementation evidence.
The person decides
The responsible independent reviewer decides whether the finding can close.
Keep the exceptions visible
A completed task or revised policy alone does not demonstrate the fix works.
Work it connects
Internal reviewers, compliance leads and remediation owners.

Possible setup. From approved files. When an agreed event happens.

A separately scoped monthly run receives the approved program exports.A draft report of request handling, overdue actions, evidence gaps and changes in recorded risk.

Prepare the privacy program review from recorded activity

Bring these each run
Dated request and finding exports, agreed metric definitions and prior-period records.
The person decides
The privacy lead verifies the report and chooses which issues to escalate.
Keep the exceptions visible
Missing records and changing denominators are labeled; activity counts do not prove compliance.
Work it connects
Internal reviewers, compliance leads and remediation owners.

Possible setup. From an approved export. On a schedule, with review.

Incident and breach coordination

Organize privacy response evidence and rehearsals around the people responsible for decisions.

A vendor reports an incident involving a service the company uses.A factual intake with reported scope, received times, contract references and unanswered questions.

Prepare a vendor incident notice for the response team

Bring these each run
Vendor notice, relevant agreement, service inventory and approved response procedure.
The person decides
The privacy lead coordinates with security; counsel determines notification duties and timing.
Keep the exceptions visible
Vendor assertions remain attributed and uncertain impact is not treated as confirmed.
Work it connects
Privacy leads, counsel, security incident owners and communications reviewers.

Possible setup. From approved files. When an agreed event happens.

The response team provides a new confirmed development.A draft record of facts, timestamps, actions, decisions and outstanding questions.

Keep the incident decision record tied to evidence

Bring these each run
Authorized incident updates, source records and confirmed response decisions.
The person decides
The incident owner verifies facts and counsel approves legal conclusions and disclosure.
Keep the exceptions visible
New information does not silently overwrite earlier accounts; a log entry is not a reportability decision.
Work it connects
Privacy leads, counsel, security incident owners and communications reviewers.

Possible setup. From approved files. When an agreed event happens.

The response owners request a tabletop exercise.An invented scenario, staged discussion prompts and an after-action record template.

Prepare a privacy incident rehearsal

Bring these each run
Approved response plan, participant roles, exercise objectives and known process gaps.
The person decides
The exercise sponsor approves the scenario and owners choose follow-up improvements.
Keep the exceptions visible
Exercise outcomes do not demonstrate real incident readiness; no live alert or notice is sent.
Work it connects
Privacy leads, counsel, security incident owners and communications reviewers.

Possible setup. From approved files. On request.

From “I prompt it”
to “it is ready to review.”

Start with a simple version of one job. Make the preparation more automatic as the inputs, rules and review process become reliable.

On request

Bring the files or exports. Run the preparation when you need it, and review what comes back.

First, agree the useful output.

On a schedule

Prepare the review at an agreed interval, with a clear owner for exceptions and missing inputs.

Next, establish access and a review queue.

When something happens

An agreed event starts the preparation. Duplicate records, failures and retries have somewhere to go.

Then, test the trigger and recovery.

The person still approves the payment, releases the work or sends the message. Scheduling and integrations are scoped to the job.

Already have a prompt
that gets you most of the way?

That is a useful starting point. Bring the prompt, an example result and the part you still have to chase or fix.

We can start by examining what you have: its inputs, the exceptions it misses and what would make it reliable enough to hand off.

Describe what you have built
How we build and review the work

Your rulebook. Your expert’s eye.

The written requirement is only part of the job. Your expert knows where the evidence lives, what a common exception looks like and when to ask. We capture that knowledge from SOPs, loose checklists or a walkthrough, then build it into the workflow.

A standard your team can check.

Your lead agrees what counts as a match, an exception and an unresolved item. We test the workflow against that standard, including incomplete cases, and show the misses before your team uses it.

Bring together the evidence your systems hold.

Certificates in email. Requirements in contracts. Records in your compliance system. Start with those files and exports in your own workspace, with your procedure built in.

How we test the workflowHow checks report their results

Worked examples in detail

Certificate review · November

Needs follow-up
Unit 12: liability limit below the lease requirement. Draft chase note prepared.
Coming due
Roofing contractor: certificate expires 30 November. Renewal not received.
Needs information
Unit 3: no insurance clause in the lease provided. Electrical contractor: limits unreadable in the scan.
Matches
Units 5, 7, 9 and 14, and the landscaping contractor match the requirements checked.

What your team brings to each run

This month’s certificates and the insurance clauses from the relevant leases or subcontracts.

The rules already built in

Check cover types, limits, additional insured and expiry. List missing or unreadable evidence separately from a match. Flag certificates expiring within the quarter.

Your manager decides what to chase and sends the prepared notes. The record shows what was checked and what still needs information.

Conflict checks at intake

Compare the inquiry with your export of clients and adverse parties. Return matches with their source matters and a draft intake note for the attorney.

Law firm intake

The person decides. Your responsible attorney, compliance officer, quality manager or safety lead confirms the findings and approves the next action.

Incident reports into actions

Turn a field report into your investigation record and draft corrective actions with owners and due dates. Flag possible reporting obligations for the safety lead to resolve.

Engineering operations

The person decides. Your responsible attorney, compliance officer, quality manager or safety lead confirms the findings and approves the next action.

Client onboarding checks

Check identification, account forms and source-of-funds papers against your checklist. Screen names against the sanctions lists your team supplies and list document gaps for the compliance officer.

Financial operations

The person decides. Your responsible attorney, compliance officer, quality manager or safety lead confirms the findings and approves the next action.

Rule changes against your policies

Read a regulator’s notice against your policy library. List the clauses it touches and the source passages, giving your compliance lead a focused starting point.

The person decides. Your responsible attorney, compliance officer, quality manager or safety lead confirms the findings and approves the next action.

What is your
version of this?

One job is enough to start.

Describe what comes in, what you do now and what you wish would be ready without another prompt.

Prepare a discussion outline. Your answers stay in this browser tab. You can edit and copy the outline to bring to a conversation. Nothing is sent or saved.

Go straight to a fit call

One recurring job.
Or a connected department.

Start with one workflowFind a focused starting point in work you already do.Map your department against thisExplore connected workflows, ownership and implementation.

Existing sprints, scope and pricing are on Get started. Establishing a function? Explore building a new capability.

Which check depends on one person?

Bring the rule, a typical file and someone who knows the exceptions. We’ll work out how to put that knowledge to work for the team.

Book a 30-minute fit call.