Governance compliance will sign.

In many businesses, the most important person in an AI project is not the sponsor. It is the person who can say no: the compliance lead, the head of IT, the clinical director or the managing partner.

Those people are not against AI. They are against signing something they cannot explain to a regulator, an auditor or a client. Give them the answers, and most of them become allies.

These are the six questions we hear most, and how we answer them.

1. Where does our data go?

Nowhere new. The system runs in a secure environment that suits you: your own cloud, your own servers, or hosted by us. One protection broker’s system runs on its own cloud account, and nothing in it depends on ours. A distributor’s runs on its own servers, because its customer data could not sit anywhere else.

2. Will our data train someone else’s model?

No. Your data stays yours. It is used to do your work, and it never trains anyone else’s model.

3. What can an agent do without asking?

Only what you allow, and that is written down before anything is built. Each agent has its permissions scoped to its job. A replies agent can read the inbox and draft. It cannot send unless you have decided it can.

We split work into two kinds. Routine work, which follows clear rules, can be prepared automatically. Judgement work, the kind that carries risk, always goes to a person. At a 16-branch broker, the system finds the opportunity and prepares the call, but the advisor gives the advice. Advice and suitability stay human.

4. What happens with the sensitive cases?

They are held back, by design. At a functional medicine clinic, clinical or regulated enquiries are never drafted by AI at all. In the first 30 days, 81 of 214 enquiries were held back for a person. Compliance should see a number like that as evidence that the guardrail works, not as a gap in the system.

Write the line down first, and make it conservative. You can relax a rule once you trust it.

5. How do we see what it did?

Every action is logged: what the agent did, when, on what, and who approved it. At a commercial insurance broker, each document records who made it, when, and at which stage. If a regulator asks what happened on a case, the answer is a search, not an investigation.

We also watch the system itself. Errors are flagged automatically, so problems are caught early.

6. Can we stop it?

Yes, at any level: one agent, one workflow or the whole system. The simplest control is the one we show on day one, a “send without approval” switch that is off, and that only you can turn on.

The paper compliance actually needs

Compliance does not need a technical diagram. It needs a short, plain description:

• what the system does, and what it never does
• where the data lives, and who can see it
• which steps need a person, and who that person is
• where the record of every action is kept

We write that as part of the Blueprint, in the business’s own language, before any code. It is the document that gets signed.

The quiet benefit

Firms that build AI this way often end up with better governance than they had before. A process that used to live in someone’s head now has written rules, named approvers and a complete log. For a regulated business, that alone can be worth the project.