How the Heldr team builds an AI Compliance Scan in six weeks

Official software lists rarely tell the whole story. We combine interviews, supplier information and workflow review to reveal tools, embedded models and indirect automated actions.

We ask people to show us how work actually happens. A sales employee summarises calls, HR filters applications and finance tests an assistant inside its accounting package. Those conversations surface uses that never appeared in procurement because AI arrived as a feature rather than a new product.

Each gap receives a priority, owner and practical next step. The result is a plan a management team can run, not a report that disappears into a folder.

We separate urgent exposure from structural improvement. An open connection to confidential data needs immediate action. A missing annual review may be important but can be scheduled. That distinction protects attention and prevents a long list from paralysing the team.

A score helps management see priority and compare progress over time. It is not a legal verdict and it should never hide the story behind the number. Two companies with the same score can face completely different exposure.

That is why every score links back to observations and evidence. We explain which assumptions were made, which information is still missing and what would change the assessment. Honest uncertainty is more useful than false precision.

The organisation has an AI register, a prioritised risk picture, named owners and a short roadmap. More importantly, people know where to bring a new use case and which questions to ask before connecting data or granting an AI system access.

The scan is a starting point. Ownership only becomes real when the organisation reviews new tools, follows up actions and updates decisions as systems change. We therefore design the rhythm together with the evidence.