ComplyEncrypt logoComplyEncryptGet Started
All articles

Why a Chatbot Is Not a Compliance Department, and What ComplyEncrypt Does Differently

•S.M. Waqas Imam
Why a Chatbot Is Not a Compliance Department, and What ComplyEncrypt Does Differently

Compliance documentation is read by people whose job is to find what is wrong with it: a certification body auditor, a client's procurement team, or an EU supervisory authority. A policy that reads well but describes controls that do not exist, or cites a requirement that has been withdrawn, is therefore worse than a missing policy, because it creates a record that can be contradicted.

General-purpose assistants such as ChatGPT and Claude have made it possible to draft a full policy set in an afternoon. The same fluency is the hazard. In Mata v. Avianca, a federal judge sanctioned two lawyers $5,000 after they filed a brief containing non-existent cases generated by ChatGPT. The lawyer had asked the assistant whether the cases were real, and it assured him they could be found in reputable legal databases. The judge also noted that there is nothing inherently improper about using AI, but lawyers keep a gatekeeping role in ensuring the accuracy of their filings. Compliance carries the same principle: the organization remains answerable for its records, whoever or whatever drafted them.

General-purpose assistant versus compliance system

A general-purpose assistant produces plausible text from a prompt. It holds no knowledge of the organization's actual assets, no record of what management approved last quarter, and no obligation to stay inside the structure of the standard. A compliance system holds the organization's state, meaning its scope, risks, owners, evidence and dates, and generates documents from that state. The first answers the question “what would a policy look like?” The second answers “what is true about this organization, and what must be recorded?”

Where it can go wrong

1. Version drift

Much of what these models learned about ISO 27001 comes from the 2013 edition. The 2022 revision reorganised Annex A from 114 controls in 14 categories into 93 controls in four themes, and ISO 27001:2013 certificates stopped being valid after 31 October 2025. A Statement of Applicability that quietly uses 2013 numbering, such as A.9 for access control or A.12 for operations security, looks authoritative and fails at the first audit. Will the reviewer notice? An auditor will.

2. Invented references

A model can cite a clause, article or sub-requirement that does not exist, or attach a real obligation to the wrong provision. Asked to confirm its own answer, it may simply confirm it, as the Mata episode showed.

3. Role confusion

GDPR distinguishes the controller from the processor. The 72-hour notification window in Article 33(1) belongs to the controller, while a processor must notify the controller without undue delay under Article 33(2). A generic answer often merges the two, and the exporter's incident procedure then promises the wrong thing to the wrong party.

4. Documents that describe a company that does not exist

Asked for an access control policy, a model writes what a good company would do: quarterly access reviews, a security committee, an annual penetration test. It cannot know whether this organization does any of it. In the scope of clause 7.5, documented information is meant to be a controlled record of reality, and a fluent fiction becomes a liability the moment someone asks for the evidence.

5. No memory and no evidence trail

Each conversation starts again. There is no version history, no approval, and no link between a policy, the risk it treats and the record proving it operates. Clauses 7.5.2 and 7.5.3 expect exactly these: identification, review, approval and control. A chat history, however long, is not a controlled repository.

6. Confidential data in the wrong place

Pasting client contracts, asset lists or incident details into a general chat tool is itself an information security decision, in the scope of Annex A controls 5.19 to 5.23 (supplier relationships and cloud services) and 5.34 (privacy and protection of PII). Depending on account terms and settings, which the organization must verify, the compliance effort can create the very exposure it was meant to prevent.

Why a person with real understanding is still needed

Clause 7.2 requires the organization to determine the competence needed by persons whose work affects the performance of the management system, and to ensure it on the basis of education, training or experience. A tool does not satisfy that requirement. Someone must ask the right question, recognize version drift, decide what is actually true about the organization, and sign off the result.

There is an uncomfortable paradox here. To check the assistant's answer, the user must already know enough to tell a correct clause from a plausible one. A founder without that background cannot see the difference, and the output looks equally confident either way.

What is different about ComplyEncrypt

ComplyEncrypt is built around the standard rather than around a chat box.

Workflows designed around the clauses

The process follows the structure of ISO/IEC 27001:2022 and GDPR: scope, risk assessment, Statement of Applicability, policies, records of processing, internal audit and management review. Each step has defined inputs and outputs, so the system asks the organization for facts before it drafts anything.

A model trained for this work

The AI inside those workflows is trained for ISO 27001 and GDPR work, and operates within the structure rather than improvising from an open prompt, which narrows the room for version drift and invented references.

A controlled document repository

ComplyEncrypt keeps the organization's documented information in a controlled repository, built to support the documented information requirements that run through the ISO management system standards. That is clause 7.5 in ISO 27001, ISO 9001, ISO 14001, ISO 45001, ISO 42001 and ISO 50001, and clauses 4.2.4 and 4.2.5 in ISO 13485. In the scope of clause 7.5.3, control means that documents are available and suitable for use where and when needed, and adequately protected against loss of confidentiality, improper use or loss of integrity. It also covers distribution, access, retrieval and use, storage and preservation, control of changes through version control, and retention and disposition. Documents of external origin, such as an executed Standard Contractual Clause or a certification body's report, are identified and controlled as well. A shared folder or a chat history addresses none of this systematically, and every one of these points is something an auditor can ask to see.

Documents generated from the organization's own state

What is written reflects what the organization has recorded about itself, so policy and practice stay aligned, and each document carries identification, review and approval under clause 7.5.2 before it enters the repository.

Judgment placed in front of a person

Decisions that need human judgment, such as accepting a residual risk or deciding which controls apply, are put to a named reviewer rather than passing through silently.

A quarterly cadence

Internal audit and management review (clauses 9.2 and 9.3) run in the same system, supported by an infrastructure retainer, so the evidence stays current after the certificate is issued.

None of this removes the need for a competent person. It places that person's judgment where it matters, and removes the clerical work around it.

A call for vigorous document control

The question for a founder is no longer whether to use AI in compliance. It is whether the AI is working inside a structure that an auditor can follow, and whether the records it produces are controlled, current and traceable. The organization is mandated to prove that, not merely to claim it. Who would want to discover the difference during a client's vendor assessment?

ComplyEncrypt pairs workflows designed around ISO 27001 and GDPR with an AI model trained for the work and a controlled document repository, so the documents and evidence your company holds describe how it actually operates and stay controlled, quarter after quarter.

References