The assessment is the start. Most of the work is what happens afterwards.
Getting a risk score is the easy part. Producing the policies a regulator would ask for, showing your staff were trained, proving you actually closed the gaps, and keeping all of it current as the law moves — that's the part that takes months if you do it from scratch. Here's what the platform does about each.
Pre-populated compliance documents
Each one is built through a short guided walkthrough that reuses what your assessment already established, so you're only asked what it couldn't answer — typically a handful of questions rather than a blank template. £99 each, and you get up to 3 builds of each document so you can revise as things change without buying again.
DPIA Draft
Structured as the ICO's own published seven-step template. Consultation and sign-off are left as explicit blanks rather than invented — those are your DPO's to complete, and a DPIA that fakes them is worse than none.
Human Review / ADM Policy
The document Article 22C effectively requires you to be able to produce: who reviews what, on what timescale, and whether they genuinely have authority to change the outcome before it takes effect.
Data Retention & Deletion Policy
Per-category retention periods, the statutory minimums that apply in your sector, deletion automation, backup purge and legal holds — with a named owner and review cadence.
Vendor Due Diligence Pack
For the tools you buy rather than build. A per-vendor questionnaire and a computed High/Medium/Low risk rating with its reasoning, in a form you can put in front of a procurement committee.
Every document arrives in three parts. First, a plain-English explainer of what the document is, what we filled in, and what remains yours to do. Second, the full draft with our guidance notes alongside each section. Third, the same content with all the guidance stripped out — a clean copy you can edit and adopt as your own policy. They are working drafts for your DPO or solicitor to complete and approve, not approved instruments.
Because "we didn't know" isn't a defence, and you'll be asked to prove otherwise
A built-in training course on automated decision-making, written for the people who actually operate these tools rather than for lawyers. Modules cover what counts as an automated decision, what meaningful human involvement really means, the Equality Act exposure, and what to do when someone challenges a decision.
Each module ends in a short quiz. Completing them all issues a dated certificate, valid for a fixed period and downloadable as a PDF. Refreshers surface automatically once a module goes stale, and a team view shows an administrator who has completed what, so you can evidence coverage across a department rather than hoping. The core modules are the same for every organisation, with industry-specific examples woven in throughout, and an extra module for public sector bodies covering the Public Sector Equality Duty. Can be exported to SCORM if you already run your own LMS.
| Member | Status |
|---|---|
| Recruitment lead | Certificate issued |
| Hiring manager | 4 of 6 modules |
| Operations | Refresher due |
| DPO | Certificate issued |
Staying current, and being able to show it
An assessment proves where you stood on one day. These are the things that let you show a regulator, a client, or your own board that you didn't stop there.
Remediation tracking
Every recommendation becomes a tracked item you can assign to a named person with a due date. Anything still open past its date escalates to the account owner instead of quietly sitting there.
Regulatory monitoring
We watch the legislation this product cites and tell you when something changes that affects a finding in a report you already hold. Separately, a plain-English feed of UK regulator activity on automated decisions — every item reviewed by a person before it reaches you.
Anonymised benchmarking
How your rating compares with other companies we've assessed in your industry. No other company's identity or details are ever shown to you, or yours to them.
Incident log
A place to record near-misses and complaints about automated decisions as they happen, so the record exists before anyone asks for it.
Public trust page
An optional shareable page showing you've been independently assessed — useful in tenders and client due diligence. You choose whether to publish it.
Built for groups, not just single companies
Divisions and business units can run their own assessments independently while a group parent sees across them — a structure up to five levels deep, with genuine isolation between units and consolidated reporting upward. Access is role-based, every state change is written to an append-only audit log, and you can export everything you hold at any time.