---
# /blocks/compliance/ - the first use case rebuilt for the buyer (James,
# 22 October 2026), and the pattern the other use cases follow. It replaces
# /blocks/obligations/ (now a 301 here): the same use case, named for what a
# buyer searches. Drawn by UseCasePage from the fields below (`format: 2`);
# the Markdown body is unused.
# Origin: block-map-canon-v0.5 entry 3 (the obligations block) and the
# block-page template. This page now diverges from canon in its name, its
# structure and all of its copy; carry it back into the canon before the page
# is next re-stamped, or it is lost.
# Confidentiality: shape yes, implementation no. The outputs are illustrative
# composites (no client, no real rule, no gated figure) and the page says so.
title: 'Compliance'
slug: 'compliance'
headline: "Compliance, *inline with the work*."
object: "Each regulatory and contractual obligation, and every policy you hold yourselves to, from the day it lands to the day it is audited."
pain: "A customer sent a security questionnaire, and it took a week and four people to answer what we already knew."
summary: "**Your own policies, applied as the work happens** - a draft that breaks a rule flagged before it leaves, every obligation evidenced as it is met, and the exceptions, not a sample, put in front of a person."
description: "Compliance inline with the work: your policies and obligations in your company brain, exceptions flagged as they happen, and evidence ready for any audit."
metaTitle: "Compliance inline with the work, on your company brain"
related:
  - 'resilience'
  - 'financial-crime'
  - 'product'
order: 9
format: 2

signs:
  - "A customer's security questionnaire stalls a deal while someone hunts for evidence you already had."
  - "Compliance is a sample: a few files checked each quarter, and hope for the rest."
  - "The policy says one thing and the team does another, and nobody finds out until the audit."
  - "Nobody can say which AI tools the team uses, on what data, or under which policy."
  - "A rule changes, and nobody can say quickly which of your existing duties it touches."

beforeAfter:
  - moment: "A draft goes out"
    today: "It is checked against policy only if someone thinks to, and usually after it has gone."
    after: "It is read against your own policies as it is written, and anything that breaks one is flagged to its owner before it leaves."
  - moment: "A customer sends a questionnaire"
    today: "Someone spends a week finding answers and evidence the business already had."
    after: "Each answer is drafted from your own policies and evidence, with its source, for the owner to check and sign."
  - moment: "A rule changes"
    today: "It lands in one inbox, and someone works out later, under pressure, what it means for you."
    after: "It is read against the obligations you already carry, and each affected owner has an impact note before the rule is in force."
  - moment: "Checking that it holds"
    today: "A sample is reviewed each quarter, and the rest is assumed."
    after: "Every obligation is evidenced as it is met, and the review is of what actually deviated."

outputs:
  - kind: "exception flag"
    title: "Proposal draft: a term your policy does not allow"
    fields:
      - ["what it saw", "A client proposal offering unlimited liability, where your contracting policy sets a cap."]
      - ["which rule", "The contracting policy, liability section, owned by the head of legal."]
      - ["recommends", "Restore the standard cap, or ask the head of legal to approve an exception."]
      - ["how sure", "Sure of the conflict. Whether an exception is justified is the owner's call."]
      - ["sources", "The draft, the policy clause and past approved exceptions, each linked."]
    permission: 'recommend'
    status: "flagged to the author and the policy owner before it is sent"
  - kind: "questionnaire answers"
    title: "Security questionnaire from a prospective customer"
    fields:
      - ["what it holds", "A draft answer to each question, from your own policies, controls and evidence."]
      - ["sources", "Each answer linked to the policy or record it came from."]
      - ["gaps", "Four questions have no evidence on the record. They are marked for the owner, not guessed."]
      - ["owners", "Head of IT, with the head of compliance for the policy answers."]
    permission: 'draft'
    status: "drafted, held for the owners to check and sign"
  - kind: "AI use register"
    title: "A new AI assistant in use in the finance team"
    fields:
      - ["what it saw", "An AI assistant in regular use in the finance team that is not on the register."]
      - ["what it touches", "Customer invoices and payment data, which your AI policy limits to approved tools."]
      - ["recommends", "Review the tool with the finance director, then approve it on the register or move the work to an approved one."]
      - ["owner", "The person responsible for AI use, with the finance director."]
    permission: 'recommend'
    status: "added to the register as unreviewed, owner told"

steps:
  notices: "Drafts, contracts, rule changes, control tests, questionnaires and the AI tools in use, where they already appear."
  connects: "Each one to the policies and obligations it touches, and each obligation to its owner, its controls and its evidence."
  judges: "Whether the work matches your own policies, what a change means for you, and whether the evidence that a control held is complete."
  checks: "Every action against your rules: who may see what, and what needs a signature before it leaves."
  acts: "Within the permission you have granted: it flags, recommends, drafts, or acts where you allow it."
systems: "It reads from your compliance tool, such as Vanta or Drata, your document and contract systems, and the places evidence is produced. It does not replace them, and nothing is migrated."

runsOn:
  - part: '01'
    text: "Every obligation, policy, control and piece of evidence, with a full history of what changed and when."
  - part: '03'
    text: "Your policies, what your terms mean and who owns each obligation, written by your people and approved by them."
  - part: '05'
    text: "Rule changes, contracts, control tests and audit requests, from sources someone accountable has named."
  - part: '06'
    text: "Who may see each obligation and its evidence, checked before every answer and every release."
  - part: '07'
    text: "Drafting impact notes, evidence packs and exception flags, only through actions agreed in advance, each with a named owner."
  - part: '08'
    text: "Where owners approve a pack, correct a mapping or sign an attestation."
  - part: '09'
    text: "Tested against your own past information requests before it is trusted with new ones."
askIt: "Can I use this AI tool on client data, and which policy says so?"
compounds: "The obligations, owners and controls it records are what supplier risk, operational resilience and management reporting read next, so each of those starts with the record already in place."
area: 'risk'
leaves: "obligations, policies, owners and controls"
shares: ['third-party', 'resilience', 'reporting']

staysHuman: "Attestations, regulatory submissions and anything a regulator or customer sees stay behind a named person's signature, permanently if that is your policy."

start:
  scope: "One policy set, one framework or one class of obligation: the duties that cost you most to evidence."
  proof: "It runs at observe against your own past requests and questionnaires first, so you see how it would have done before it is allowed to do anything."
  connects: "The systems you already run: your compliance tool, policy library, contract repository, ticketing and the tools where evidence is produced. Connectors are built for you, as part of the work."
  owns: "You own the result: the obligations record, the rules, the permissions and the way it runs, handed over to your team or run for you."

faq:
  - q: "We already use Vanta or Drata. Why this?"
    a: "Keep it. If you need a SOC 2 or ISO 27001 certificate, those tools are built for that, and the company brain reads from them. What they cannot see is the work itself: the proposal going out, the clause in a contract, the decision in an email. That is where your own policies are kept or broken, and that is where this works."
  - q: "Why not an AI assistant over our policy documents?"
    a: "An assistant can find a policy. This holds what each policy means, who owns it and what it applies to, checks the work against it, and keeps the evidence that it held, with permissions checked before every answer."
  - q: "Which rules and frameworks does it cover?"
    a: "Yours, and the frameworks you choose. A framework such as ISO 27001, Cyber Essentials, UK GDPR, the EU AI Act or ISO 42001 is a starting map: its requirements are matched against your existing policies and controls, the gaps are shown, and your owner confirms each mapping. It is not certification, and an independent auditor still audits."
  - q: "Who can see what?"
    a: "Only what each person is allowed to see. Permissions are checked before every answer, and every question is recorded."
  - q: "Will it send anything to a regulator or a customer on its own?"
    a: "No. Anything that leaves waits for a named owner to sign it, and you can keep it that way for good."
  - q: "Where does our evidence live?"
    a: "In your company brain, which you own, in your own environment rather than in a vendor's product. The way ours is governed, from the sources it admits to the permissions it checks, is on the page about how we run our own."
  - q: "Is this available today?"
    a: "It is built for each company that runs it, on that company's own brain, not installed off a shelf. The question audit comes first and shows what it would and would not do for you before anything is built."

backtest: "Take three past requests: a customer questionnaire, an auditor's request, and one where the evidence could not be found. What did your own record hold, and when could you reach it?"

# The hero's loop (BlockHeroLoop): a slice of the brain around the object,
# and three stories condensed from the outputs above. Each story's four steps
# are what it notices, connects, judges and checks; the fifth station, act,
# shows the permission it acted on and the outcome.
loop:
  hub: 'obligation'
  nodes: ['rule', 'consultation', 'control', 'evidence', 'contract clause', 'audit request', 'owner', 'attestation']
  links:
    - ['obligation', 'rule']
    - ['obligation', 'control']
    - ['obligation', 'evidence']
    - ['obligation', 'contract clause']
    - ['obligation', 'owner']
    - ['obligation', 'attestation']
    - ['rule', 'consultation']
    - ['control', 'evidence']
    - ['audit request', 'evidence']
  stories:
    - signal: 'consultation published'
      touches: ['consultation', 'rule']
      steps:
        - 'a consultation lands'
        - 'three duties you already carry'
        - 'real impact, before it is in force'
        - 'each duty has a named owner'
      permission: 'recommend'
      outcome: 'impact note drafted and routed'
    - signal: 'audit request arrives'
      touches: ['audit request', 'evidence']
      steps:
        - 'an auditor asks for evidence'
        - 'gathered as the work happened'
        - 'the pack is complete'
        - 'release on the owner''s signature'
      permission: 'draft'
      outcome: 'pack ready, held for signature'
    - signal: 'non-standard clause signed'
      touches: ['contract clause', 'owner']
      steps:
        - 'a non-standard clause is signed'
        - 'the commitment it creates'
        - 'a new obligation on the record'
        - 'every obligation has an owner'
      permission: 'recommend'
      outcome: 'obligation registered, owner told'
noindex: false # launched 2026-07-24 as /blocks/obligations/
updated: 2026-10-22 # rebuilt for the buyer; inline with the work, frameworks, the brain it runs on
---