Compliance is software, not a PDF

For years compliance had a precise shape: a document. The organisational model, the policy, the register, the impact assessment. Signed, filed, forgotten until the next inspection.

It worked when organisations changed slowly. Today a company adopts, changes or drops digital tools every month. The document starts ageing the day it is approved.

The AI Act case

Regulation (EU) 2024/1689, the AI Act, makes the problem obvious. Since 2 February 2025 the bans on unacceptable practices apply, together with the literacy obligation in Article 4: providers and deployers of these systems must take measures to ensure their staff have a sufficient level of competence.

To comply with Article 4 you first need to know which systems the company uses. It sounds trivial. It is not. In many organisations nobody has a complete inventory. Tools come in from below: a subscription on a department's card, a browser extension, a feature switched on inside software that was already there.

A PDF cannot keep up with that reality. Software can.

Outside the EU the direction is similar, even without a single regulation. In the UK the topic is left to sector regulators; in the US to state laws and federal guidance. The source changes, the problem does not: proving what you use and how you govern it.

What changes when compliance runs

Thinking of compliance as software means three concrete things.

First, the rule becomes a question the system asks at the right moment. Not "read the policy", but "you are switching on a new tool: what is it for, who uses it, what data does it process?".

Second, evidence is produced while people work, not afterwards. Every answer leaves a dated trace. When the inspection comes, the documentation already exists.

Third, the lawyer stops being the author of a text and becomes the designer of a process. It is a change of profession, not just of tools.

This is the logic behind AI READY for the AI Act, Presidio 231 for organisational models and Auriga NIS2 for cybersecurity. They do not replace legal judgment. They bring it where it is needed, when it is needed.

The risk to avoid

There is a mirror-image risk, and it should be said. Turning compliance into a series of checkboxes can produce the same fiction I criticise in consent forms: everything ticked, nothing understood.

Design makes the difference. A good compliance system does not ask people to declare they have understood. It puts them in a position to understand, and checks it. If compliance software copies the interfaces it is supposed to fight, we have simply digitised the problem.

Law that works is law that gets used. And to be used, it has to live inside the tools, not next to them.