AI in compliance: useful vs theatrical

Every compliance tool has an "AI" sticker on it now. Most of it is theatre: a chat panel bolted onto the side that will, the moment you ask it anything specific, confidently cite a control that doesn't exist or summarise a policy it never read. It demos well and audits badly.

Useful AI in a regulated context is a narrower, more boring thing. It reads your actual records, it stays inside your permissions, and it can't change anything. Here's the line between the two, and where we drew it.

Theatrical AI

You can spot it by the failure mode:

• It retrieves and hopes. A vector search pulls "relevant" chunks and the model writes a plausible paragraph over them. When the chunks are wrong, the answer is wrong — fluently.
• It can act. It offers to "mark this control as complete" or "close this finding," which is exactly the authority you don't want a probabilistic system to have in an audit trail.
• It's ungoverned. No per-tenant boundary, no record of what it saw, no off switch your security reviewer can point to.

It looks impressive in a sales demo and falls apart the first time real money or a real auditor is on the line.

Useful AI

We built ours around three constraints, and they're the whole difference:

1. Read-only tools, not freeform retrieval. The assistant calls typed functions — list these risks, load this CAPA, summarise this period — that hit the database inside your row-level-security context. It reads exactly what you can read, nothing more, and there's no "search and pray" step to hallucinate over.
2. It cannot mutate. Every assist drafts into a form for a human to review and save. The audit log only ever records a person's signature, never the model's. AI proposes; you dispose.
3. Shaped output, not loose text. Structured suggestions run a tool-using research pass and then a schema-bound generation pass, so the result is a checkable object — a verdict with cited references, a draft with named fields — not a wall of prose you have to fact-check by hand.

What that buys you in practice

Within those constraints, the AI earns its place by doing the genuinely tedious parts:

• Gap analysis verdicts each control as ready, partial or gap — with the evidence references behind the verdict.
• The readiness analyser writes a narrative verdict for each SOC 2 criterion and persists snapshots, so you can watch readiness move.
• The mapping suggester proposes how ISO 27001 controls map to SOC 2 criteria, one at a time or in bulk.
• Form-fill assists draft CAPA root causes, risk treatments, management-review inputs and the SOC 2 system description — from your live data, for you to edit.
• The chat assistant answers questions against your workspace and links the record references it cites straight to the detail page.

None of those save a record. All of them save you an afternoon.

Governance a reviewer can verify

The questions a security committee asks about AI have boring, checkable answers here: it's off by default per workspace; every route is gated by both that toggle and the user's per-module access; supported providers run in zero-retention mode so your data never trains a model; and it's provider-agnostic — OpenAI directly, or Claude, Gemini and Llama via OpenRouter, as a per-org choice.

Theatrical AI optimises for the demo. Useful AI optimises for the audit. In compliance, only one of those keeps working after you've signed the contract.

See exactly what each surface does on the AI page, or book a demo to watch it run on a real workspace.