The Evidence Problem

AI should do the searching. Humans should do the deciding.

Spend enough time looking at how compliance operates day-to-day, and one thing quickly becomes clear: a disproportionate amount of time is spent on evidence.

Finding it. Collecting it. Chasing it from people across the business. Working out where it belongs. Then repeating much of that work when the same evidence applies across multiple frameworks.

For organisations managing an ISMS, staying audit-ready and responding to growing compliance requirements, it remains one of the most manual and time-consuming parts of the process.

But it’s also exactly the kind of work where AI can make a meaningful difference.

Not by taking compliance decisions out of people’s hands, but by taking away more of the manual legwork surrounding them.

That distinction matters. Because as AI becomes more embedded in compliance, we need to be clear about what technology should – and shouldn’t – be responsible for.

The evidence problem isn't a lack of evidence

Most organisations already have huge amounts of compliance evidence.

It’s sitting across the systems, tools and processes used throughout the business every day.

An access review has happened. A member of staff has completed their training. A supplier has been assessed. A policy has been approved. A ticket has been closed.

The evidence exists.

The problem is finding it, understanding its relevance and connecting it to your wider compliance programme.

Traditionally, that means someone searching across systems, bringing information together and checking that what they have is sufficient.

Then there’s the multi-framework problem.

An organisation managing ISO 27001, SOC 2 and GDPR doesn't necessarily have three completely separate compliance programmes. Requirements overlap. The same activity, and therefore the same evidence, can support assurance across multiple requirements.

But when compliance is managed manually or across disconnected systems, that overlap creates duplicated work rather than efficiency.

The same evidence gets found and handled multiple times.

That isn't where skilled compliance professionals should be spending their time.

We have been building to change that.

This Autumn, Hicomply is introducing AI-Powered Evidence Suggestions, our biggest AI capability to date, designed to change how organisations collect and manage compliance evidence.

Instead of teams having to search for evidence and work out where it belongs, Hicomply continuously surfaces relevant evidence from connected systems and suggests where it applies across the controls and frameworks you manage. Every suggestion is then put to your team to review, accept, reject or amend.

The aim is to move evidence collection from a retrospective exercise before an audit to something that happens continuously as your business operates.

More on exactly how we’re doing that later.

AI creates an opportunity to change the model

The opportunity for AI isn't simply to automate more of compliance.

It's to remove the repetitive work that prevents compliance teams from spending their time where their expertise matters most.

Evidence collection introduces one of the strongest opportunities for this.

Executed effectively, technology can take on more of the legwork involved in finding, organising and assigning evidence, helping teams build a clearer, more connected view of their compliance programme.

Less time on repetitive tasks. More time reviewing information, understanding where it matters and making informed decisions that still require human judgement.

There is an important distinction there.

Because making compliance faster shouldn't mean removing accountability from the people responsible for it.

Automatethe legwork, not the judgement

There is a temptation with AI to measure progress by how much human involvement can be removed.

For compliance, I think that's the wrong measure.

We could keep pushing towards a model where technology makes more decisions, removes more review and gets organisations to a completed dashboard faster.

Some solutions champion this.

But a greener dashboard doesn't necessarily mean a stronger compliance programme.

AI should ease the demand on compliance professionals. It shouldn't make their decisions for them.

Evidence exists to demonstrate that something happened, that controls are operating as intended and that an organisation can substantiate the assurances it gives to auditors, customers, boards and other stakeholders.

That requires judgement.

Is this the right evidence? Is it current? Does it demonstrate what we think it demonstrates? Is it sufficient? Does something require further investigation?

Technology can remove much of the work surrounding those decisions.

The decisions themselves should remain with people.

The future of audit readiness is almost here

This is the shift we're building Evidence Suggestions to enable.

Evidence collection remains one of the most manual, repetitive and time-consuming parts of managing compliance. And as organisations grow, so does the effort required to find, organise and demonstrate the evidence needed across multiple frameworks.

AI-Powered Evidence Suggestions continuously reviews your connected sources, surfaces relevant evidence and suggests where it belongs across the controls and frameworks you manage. You review, accept, reject or amend every suggestion before it becomes part of your programme.

The principle behind it is simple: use AI to reduce the manual legwork surrounding evidence, without removing the human judgement that gives that evidence meaning.

What this means: teams spend less time collecting and organising evidence, reduce unnecessary duplication across frameworks and maintain greater visibility of their compliance programme throughout the year.

What this doesn't mean: handing control of your compliance programme to AI.

Evidence Suggestions is being built around the same principle we apply to Hicomply more broadly: technology should support the people responsible for compliance, not replace their judgement.

For us, that's more than a new capability. It's a new standard for how evidence collection should work.

Continuous evidence changes audit readiness too

There is a bigger opportunity here than simply saving time.

For many organisations, evidence collection is still closely tied to the audit cycle.

An audit approaches, activity increases and teams start gathering the information required to demonstrate what has happened over the previous months.

That creates the familiar audit scramble.

The alternative is to make evidence management part of the way compliance operates throughout the year.

That's the model Evidence Suggestions is designed to support: building your evidence bank continuously as work happens across the business, rather than reconstructing it retrospectively.

When teams have continuous visibility of compliance progress and posture, there is less need to reconstruct the programme retrospectively when an audit arrives.

Audit readiness becomes less of a project and more of a by-product of how the organisation operates.

That's an important part of what continuous compliance should mean in practice.

Not constantly preparing for an audit, but maintaining the visibility throughout the year so that you're ready to demonstrate assurance when it's required.

The future of compliance isn't human or AI

As AI becomes embedded into more compliance technology, I think we need to ask better questions than simply, “What can we automate?”

We should be asking:

“What work requires human judgement, and what work ispreventing people from applying that judgement effectively?”

Searching for evidence and repeatedly organising the same information isn't a good use of your team’s time.

Reviewing what that evidence tells you, challenging whether controls are effective and deciding whether the organisation can genuinely demonstrate assurance is.

That's the line we're drawing.

Let technology handle more of the legwork. Keep people responsible for the decisions.

For me, that's what human-in-the-loop compliance should actually mean.

Not a disclaimer added to an AI feature, but a deliberate decision about where technology stops and human judgement begins.

We’re setting a new standard. See it for yourself.

Book a demo with one of our team to see the new capability in action.