AI compliance employees, with approval gates

SigmaTrust includes AI compliance employees — agents that take on the recurring labour of a compliance programme: drafting policies and responses, mapping controls across frameworks, chasing evidence owners, pre-reviewing artefacts against requirements and preparing audit workspaces. Every consequential action passes an approval gate where a named human accepts or rejects it, so the AI accelerates the programme without ever being the accountable party. Behind it stands CyberSigma's CERT-In empanelled, PCI QSA-authorised audit team.

What the agents actually do

'AI for compliance' usually means a chatbot bolted onto a help page. These are workers with defined jobs:

• Drafting — first drafts of policies, control narratives and questionnaire responses, grounded in your actual evidence and scope rather than a generic template.
• Mapping — proposing how a new framework's requirements map onto controls you already operate, which is days of expert spreadsheet work done as a reviewable proposal.
• Chasing — following up evidence owners on schedule, which is the least loved and most necessary job in any compliance programme.
• Pre-review — checking submitted evidence against the requirement before a human assessor spends time on it: wrong period, wrong scope and missing signature get caught early.
• Workspace preparation — assembling the audit workspace for an engagement from the evidence vault, so the human assessment starts from an organised position.

The approval gate is the design, not a disclaimer

The reason AI in compliance goes wrong is accountability laundering — a model produces something, nobody quite owns it, and it ends up in front of a regulator. SigmaTrust's answer is structural: agents propose, humans dispose.

Every consequential action — a policy published, a mapping accepted, a response sent — passes an approval gate where a named person accepts it, and that acceptance is recorded. The audit trail shows who approved what the AI produced, which means the question 'who is accountable for this?' always has a name. This is the same discipline we apply to ourselves: nothing an agent prepares reaches a regulator or customer without an accountable human having signed it.

Where the humans stay

Some decisions never belong to an agent, and the division of labour is explicit:

• Judgement calls — whether a control genuinely operates, whether an exception is acceptable, whether a finding is material — remain with qualified people.
• The audit conclusion itself is made by CyberSigma's CERT-In empanelled, PCI QSA-authorised assessors, in the audit workspace, on evidence they have reviewed.
• Scope decisions come from the guided scoping interview with your team, because an agent cannot know what your business is about to do.
• Anything novel — a new processing activity, an unusual regulator question, an incident — routes to humans by default rather than being pattern-matched.
• The net effect is arithmetic, not magic: the agents absorb the recurring 70 percent so the experts spend their time on the 30 percent that actually needs them.

What this means for programme cost

Compliance programmes are staffed for their peaks — audit season, questionnaire season — and idle-taxed the rest of the year, or understaffed year-round and panicked at the peaks. Agents flatten that curve: the chasing, drafting and pre-review that consume a coordinator's year run continuously at machine cost, and the human hours concentrate where judgement is needed. For most mid-size organisations that is the difference between compliance needing a team and compliance needing an owner.

What is an AI compliance employee?

An agent inside SigmaTrust with a defined job — drafting, control mapping, evidence chasing, pre-review or workspace preparation. It works from your actual scope and evidence, produces reviewable output, and every consequential action passes a human approval gate before taking effect.

Can the AI's output go straight to a regulator or customer?

No. Consequential actions require a named human to approve them, and the approval is recorded. The design goal is that 'who is accountable for this?' always has an answer that is a person, not a model.

Does the AI make audit decisions?

No. Audit conclusions are made by CyberSigma's CERT-In empanelled, PCI QSA-authorised assessors on evidence they have reviewed. Agents prepare the workspace and pre-screen evidence so the assessors' time goes where judgement is needed — the conclusion is theirs.

What happens when an agent gets something wrong?

The same thing that happens when a junior analyst does: the reviewer rejects it at the gate, and the rejection is part of the record. Because nothing consequential bypasses approval, an agent error costs a review cycle, not an incident.

Is our data used to train models?

Your workspace is tenant-isolated, and agents operate inside your tenant on your data for your programme. Data-handling specifics are documented per deployment and covered in the engagement agreement — ask us the question directly and you will get the specific answer in writing rather than a marketing sentence.

How is this different from asking a general-purpose chatbot?

Grounding and accountability. A general chatbot has no access to your scope, controls or evidence, and no approval structure around its output. These agents work from your actual compliance state inside a governed workspace, and their output enters the record only through named human acceptance.