Compliance software, built around the records you're asked for

What I’d build first, and what waits

Start with the records people chase you for. For most businesses that’s four things: a register of what you have to comply with and who owns each item, controlled policies and procedures, staff signing that they’ve read them, and training records with expiry dates. A client’s pre-qualification questionnaire or an ISO auditor asks for these first, so the configurator starts with them selected.

If supervisors still hand in paper forms, inspections, incidents and corrective actions can join that first month. Risk assessments, contractor and supplier checks, evidence pulled from your IT and a dashboard by site come next, as a second phase with its own fixed price.

Phase two: evidence for ISO 27001 and Cyber Essentials

If you hold ISO 27001 or are working towards it, most of the auditor’s questions are about IT controls: who has access to what, whether leavers were removed, whether laptops are encrypted and backups ran. In phase two the system collects that evidence on a schedule instead of someone taking screenshots the week before the audit. It reads user lists from Microsoft 365 or Entra ID, Google Workspace or Okta, device status from Intune, and repository settings from GitHub. It can also read an older on-premise system with no API, from a nightly export or its database, which is where products built for cloud start-ups tend to stop.

Each control is written once and mapped to every standard it serves, so the access review that answers an ISO 27001 Annex A control also answers the matching Cyber Essentials question and your UK GDPR security record. Controls are stored as data you can edit. When ISO 27001:2022 replaced the 2013 version, the Annex A controls were regrouped from 114 into 93; a change like that is an edit to the register and its mappings, not a rebuild.

What AI can do here

Three places it helps, with a manager signing off each time:

• Read a certificate. Someone photographs a CSCS card, a first-aid certificate or an insurance schedule. The system reads the name, type and expiry date into the record for a manager to confirm.
• Draft the corrective action. From an incident report or an audit finding, it drafts the root cause and the action in your format. The person responsible edits and accepts it.
• Check a tender’s requirements. It reads a client’s pre-qualification questionnaire and lists each requirement against the documents you already hold, so you see the gaps before the deadline.

These sit outside the first release, at £1.5k to £5k each. I wouldn’t let AI close an incident or pass an audit on its own.

Moving your records across

What comes across. Your register, every policy with its version history, who signed what and when, staff and their training records, cards and certificates with expiry dates, past audits, incidents and open actions.

Files and evidence. Certificates, photos, signed forms and old audit reports are included in the import price. Records your current tool exports as data are rebuilt as records here, tied to the person, site or policy they belong to. Anything that only comes out as a PDF is filed against the right record, so an auditor can still trace the history.

How. A trial import goes into a copy of the new system. You pick a dozen staff and policies and compare their cards, signatures and versions with the old tool, and I correct every mismatch before launch. Keep the old tool for the first month in case someone needs to look something up, and diary its notice date.

When off-the-shelf is enough

One standard, everyday forms and fewer than twenty logins: at that size a compliance subscription is the cheaper route. A product is also the better pick if:

• you’re a software business pursuing ISO 27001 or SOC 2, where Vanta-style tools test your cloud set-up automatically;
• you want an inspection app from the App Store with a large template library;
• your consultant already runs your management system in their own platform.

Custom pays off once your records are split across a quality tool, an H&S tool, a training spreadsheet and a shared drive, when per-user prices climb with every site worker who needs to sign a policy, or when clients’ contract requirements don’t fit any product’s forms.