Policies, access reviews, audit evidence: your IT compliance documentation no longer has to be produced by hand.
In the IT Compliance Pilot, we automate one area of your documentation that is still maintained in Word, Excel or SharePoint today, within 6 weeks. With AI agents that are auditable themselves.
This is what IT compliance documentation looks like in many companies.
Policies in Word
They sit as files on SharePoint. When were they last reviewed, and which version applies?
Access reviews in Excel
The list circulates by email across departments. Who actually signed it off, and when?
Evidence just before the audit
Screenshots and exports are gathered once the date is already in the calendar.
This is not a criticism. It is the norm, especially in companies with 50 to 500 employees, where the information security officer carries the topic alongside many others. And it also applies to many companies that already have a compliance tool.
Who the pilot is for. And who it is not for.
A fit
- 50 to 500 employees
- ISO 27001, NIS2 or the Cyber Resilience Act
- Documentation is still largely produced by hand
- Audit or assessment within the next 12 months
- Information security or IT lead and management are on board
Not a fit
- No ISMS and no plan for one
- General AI consulting or chatbots
- “Let us first see what is possible”
What still runs by hand today and can be produced automatically.
The agents run on an AI platform and work with the tools you already use, such as SharePoint, Word, Excel or your existing compliance tool.
- Keeping policies current and making changes traceable
- Preparing access reviews and getting them signed off
- Collecting and filing audit evidence: screenshots, exports, logs
- Documenting permission changes and offboarding
- Evidencing backup and restore tests
How the pilot works. One area, six weeks.
- Week 1
Define
Choose the area, set measurable success criteria, agree the security concept with your information security officer.
- Weeks 2 to 4
Set up
Set up the AI agents, read-only, in your existing tools.
- Week 5
Test
Test with your information security officer and sign-off.
- Week 6
Hand over
Documentation and evidence are produced automatically. Plus a final report.
The basis is a data processing agreement and a security concept that your information security officer approves before the start.
An agent that collects audit evidence must not become an audit finding itself.
Many automations run through a shared admin account, with full access and no log. The auditor then rightly asks: who actually accessed this? Before an AI agent starts with us, these rules apply:
- 01Its own identity, no shared service account.
- 02Read-only: the agent collects and documents, it changes nothing in your systems.
- 03Only the systems it needs for its task.
- 04Every action is logged.
- 05A person signs off before a document or piece of evidence enters the ISMS.
Control before execution. Especially in compliance itself.
The compliance check: one conversation, an honest assessment.
Together we look at one area of your documentation, for example policies or access reviews. Afterwards you receive a one-page written assessment: what can be automated, what that saves and what a pilot would look like for you. Even if it goes no further.
- Free of charge and without obligation
- One area of your documentation
- One-page written assessment
- No sales presentation
Fabian Hausner
Founder & CEO Woodlands Advisory GmbH · SAP Global Security Advisory Lead
8+ years of experience in information security, forensics, compliance and presales, with responsibility for security advisory across SAP Signavio, SAP LeanIX and WalkMe. Woodlands Advisory comes from cybersecurity and compliance. That is why every agent we set up starts with the question the auditor asks too: who accessed what?
Founder-led engagements. Delivery is handled by a curated team of senior practitioners. No outsourcing, no junior substitution.
Founder profile →Things people ask first.
Do you need access to our systems?+
Read-only, and only to the systems the task requires. The basis is a data processing agreement and a security concept that your information security officer approves beforehand.
Do we need a new tool for this?+
Yes. The agents run on an AI platform on which we build your AI department. To start with, one licence at around 100 euros per user per month is usually enough. The results continue to land in the tools you already use, such as SharePoint, Word, Excel or your existing compliance tool.
What does the pilot cost?+
Pilot companies receive special terms well below the regular project price. We discuss the details after the compliance check.
What do you ask in return?+
A case study with your name and logo, a quote and two reference calls with prospective clients. We agree this in writing.
How much effort is it for us?+
Your information security officer is involved in choosing the area, in the security concept and in the test. We set out the exact scope in the pilot proposal.
What if it does not work?+
We set measurable success criteria together before the start, for example how many pieces of evidence are produced and filed automatically. The pilot is measured against them.
Four questions. Three places. An honest answer.
If your details fit the pilot programme, you can choose a time for the compliance check right here. Your answers stay in your browser and are not stored.
- ·Your role in the company
- ·The size of your company
- ·How your documentation is produced today
- ·When your next audit is due