Skip to main content
The 5-step compliance loop

From “we don't know what AI our staff use” to a live Readiness Score in a week.

Every stage of the loop produces evidence that compounds into Article 4 readiness — and every stage is something most competitors skip.

Step 1
Discover
Days 1–7

Anonymous 2-minute staff survey, delivered via SSO or shareable link. Surfaces every AI tool your team uses — including the ones IT didn't know about.

What happens
  • Multi-select question of common AI tools (ChatGPT, Copilot, Gemini, Claude, Perplexity, GitHub Copilot, Lexis+ AI, Harvey, ATS AI, CRM AI, HR AI, plus free-text Other)
  • Frequency question — daily / weekly / monthly / rarely
  • Use-type question — drafting, research, analysis, code, client comms, internal, decision support
  • Aggregated only after 5+ responses (preserves anonymity)
  • Responses linked to HMAC pseudonyms, never names or emails
Why it matters

The MIT NANDA study found 90%+ of workforce using personal chatbot accounts; only 40% of companies have official LLM subscriptions. SMEs literally cannot complete Step 1 of every published compliance guide (“inventory your AI use”) because the inventory is hidden in browser tabs. This solves it in a week.

Step 2
Map
Days 7–10

Auto-assign each staff member the exact training they need: Core + tool-specific + role overlay + sector overlay.

What happens
  • Core literacy modules (always) — 5 modules, 50 minutes total
  • Tool-specific micro-module per AI they actually use (ChatGPT, Copilot, Gemini, Claude, Perplexity, GitHub Copilot specifics)
  • Role overlay (Staff / Manager / Compliance-Legal-Risk / HR / Refresher)
  • Sector overlay (Legal / Accountancy / Recruitment / Financial Services / Marketing)
  • Matrix view: rows = staff, columns = tools, cells = status pill (assigned / in progress / completed / expiring soon)
  • Idempotent — re-running auto-assign adds only what's missing
Why it matters

Article 4 doesn't ask for “generic AI literacy”. It asks for training “taking into account the technical knowledge, experience, education and training and the context the AI systems are to be used in”. A solicitor using Lexis+ AI gets a different matrix from a recruiter using AI-enabled ATS. Generic LMS players can't do this.

Step 3
Train
Days 10–21

Staff complete their assigned matrix — usually 30–90 minutes spread over 4–7 micro-modules — at their own pace.

What happens
  • Mobile-first reader with auto-save scroll position + time-on-page tracking
  • Scroll + time gating before quiz unlocks (defends against speed-clicking)
  • Module quiz: 5 questions, deterministically shuffled per learner+attempt+day (anti-cheating)
  • Final assessment: 15 questions sampled from a pool of 30, 80% pass mark
  • "Ask the Trainer" optional chat panel (Business tier+) for in-context questions
  • Certificate PDF on pass, with QR code → public verification URL
Why it matters

The training is the content layer of the platform — necessary, not sufficient. We treat it as one of five pillars, not the headline. Quality matches the dedicated LMS providers; positioning is different.

Step 4
Evidence
From day 1, regenerated weekly

A live Article 4 Readiness Score plus an on-demand PDF evidence pack — the artefact your insurer, regulator, or client procurement asks for.

What happens
  • Live Readiness Score (0–100): weighted blend of training currency, tool coverage, AUP acknowledgment, and pack freshness
  • Continuous Evidence Dashboard with per-staff, per-tool, per-module drill-down
  • On-demand PDF pack: cover letter, methodology document, certificates, training records CSV, audit log CSV, machine-readable manifest
  • Hash-chained audit log — every state change cryptographically signed, tamper-evident
  • Public certificate verification at /verify/{code} (no auth required)
  • Trust Center: public per-org page your customers' customers can visit
Why it matters

Competitors give you a certificate. Procurement teams want the pack. Regulators want the pack. Insurers want the pack. We make “always be evidence-ready” the default state, not a deadline scramble.

Step 5
Monitor
Ongoing

Forward-looking view — what will lapse soon, what's new, what to act on next.

What happens
  • Expiring certificates in 30/60/90 days
  • New AI tools detected since the last review
  • Annual renewal triggers (automatic re-assignment)
  • New-tool triggers (auto-assign the right module when a learner picks up a new AI)
  • Recommended-actions list (admin to-dos, prioritised)
Why it matters

Compliance isn't a once-a-year box-tick. It's a continuously-changing surface: new staff, new tools, expiring certificates, new regulations. The Monitor stage is what makes the platform actually an “operating system” rather than a periodic course.

Ready to run the discovery?

Start with a free 7-day anonymous survey. You'll have your AI register inside 48 hours — and a clear view of what training each person needs by the end of the week.