Businesses using artificial intelligence to produce compliance policies without properly understanding the requirements behind them could be putting their accreditation prospects at risk, according to compliance advisory firm JVR Consultancy.
The firm says that although AI can help businesses draft and organise documentation, relying on it to create policies without examining how they apply in practice risks undermining a key part of the compliance process.
Companies applying for supplier accreditation, certification or approval through schemes and standards such as Constructionline, Achilles UVDB, CHAS, SafeContractor, RISQS, ISO management systems and certain cyber assurance certifications may need to submit a range of policies, procedures and supporting evidence. These typically cover subjects including health and safety, quality management, environmental responsibilities and workforce competence.
JVR Consultancy believes these documents must be based on the organisation’s actual operations and procedures, rather than simply containing language designed to meet an assessment requirement.
“AI can produce a very professional-looking policy very quickly, but having the document is not the same as understanding what sits behind it,” said Steven Sandhu, Managing Director of JVR Consultancy.
“Writing a policy properly forces you to walk through what actually happens within your business. You have to consider the risks, who is responsible, what controls are in place and what happens if something goes wrong.
“That thinking is part of the value of developing the policy. If you simply ask AI to produce the document for you, you can skip the process that helps you understand what the policy means for your organisation.”
One concern is that AI-generated policies can appear convincing while describing processes and arrangements that are not actually followed by the business, the consultancy says.
Auditors are also becoming more familiar with generic documentation and may identify policies that fail to provide sufficient detail about how an organisation works. This could include references to responsibilities, monitoring systems, controls or procedures that have not been properly established or implemented.
Producing individual documents separately can create further difficulties if they contain conflicting information about roles, responsibilities or how particular processes should be carried out.
These weaknesses can become particularly evident when assessors ask businesses to provide evidence supporting their written policies. Where documentation claims that checks are completed, records are kept or specific procedures are followed, the organisation must be able to show that these activities happen in practice.
There may also be direct financial implications for businesses that do not pass an assessment. Reassessment can involve additional fees, potentially making the apparent savings from quickly generating documentation with AI an expensive false economy.
The risks extend beyond accreditation, particularly in sectors where health and safety procedures are essential to protecting employees and others. Policies that do not accurately reflect working practices can have serious consequences.
“When you’re dealing with activities or working environments where there are safety risks, getting health and safety procedures wrong can put lives at risk,” Sandhu said. “Auditors take these requirements particularly seriously because they’re there to prevent accidents and injuries. If a business can’t demonstrate that the right procedures and controls are in place, it risks failing its assessment. This isn’t simply paperwork you need to produce to get through an audit.”
JVR Consultancy stresses that AI can still be a valuable tool in compliance work, provided it is used to support rather than replace the development of policies based on an organisation’s genuine activities, risks, responsibilities and working methods. Appropriate human knowledge and expertise remain essential.
As organisations expand, their management systems and the evidence needed to demonstrate compliance are likely to become more complex. Keeping policies and supporting records accurate and up to date should therefore be treated as a continuing business responsibility, rather than a task completed only when accreditation is required.
“AI doesn’t know your business or how it operates. It can’t replace that understanding. We’ve spoken to clients who have used AI to draft policies, only to find that the documents didn’t adequately reflect their actual working practices,” Sandhu added.
“The fact that AI can help you write something shouldn’t replace the process of understanding it. A compliance policy isn’t just something you submit. It should be something your business can follow.”
JVR Consultancy works with organisations in rail, construction, utilities and other regulated industries, providing support with accreditation preparation, management system development and improvement, and ongoing compliance.
