A compliance program run by agents, checked by people

Alchemer · 2025 to present · Global Compliance Manager

Problem. One compliance manager, seven frameworks (SOC 2 Type 2, ISO 27001, GDPR, HIPAA, CCPA, FERPA, EU-US DPF), and hundreds of customer security assessments a year. Answering from memory is slow and drifts out of date.

What I did.

• Built a governed knowledge base, one maintained page per topic, so every answer traces to a source.

• Agents draft assessment answers only where the knowledge base supports them and leave the rest blank. A separate read-only agent re-checks every flagged item. I review and submit.

• Every answer I correct is logged with its cause (source wrong, source stale, wrong page, misread), and the source is fixed so the error doesn’t come back.

• Wrote the company’s Responsible AI program on ISO/IEC 42001: policy, risk and impact assessments, systems register, model cards. Eight documents, approved by the CISO.

• Put the tooling under a CI gate of 2,600+ automated tests that blocks any change that fails, including my own.

Result. Customer security assessment turnaround went from 5 days to 2 hours, with every answer traced to a source and reviewed by a person before it goes out.