AI Compliance Tools
AI Governance, Risk & Compliance for SMEs
Startup / AI Governance
The story
This one started from a conversation, not a bug. A family friend who runs a small business mentioned she'd started using AI tools for customer service and had no idea what she was actually allowed to do with customer data. Nobody at her company was tracking it. That stuck with me - it seemed like a gap between how fast SMEs were adopting AI and how little support existed to help them do it responsibly.
Why I built it
Big companies have compliance teams for exactly this. Small ones don't, so AI governance ends up as nobody's job. The risk is real, but the existing tools are built for enterprises with legal departments, not a ten-person company trying to keep up.
What I built
I'm building a GRC tool that does the unglamorous part for SMEs: log what AI tools you're actually using, get flagged on the risky ones, and generate the policy paperwork without needing a law degree to fill it in.
What I did
- Came up with the product concept and shaped the feature roadmap
- Ran validation conversations with people who actually work in compliance
- Built the MVP features used in early demos
- Turned regulatory language into something a non-specialist can follow
How I built it
Build flow
Onboarding -> AI use-case log -> automated risk scoring -> policy generation -> monitoring dashboard.
How it works
A user logs each AI tool they use, the system scores the risk based on what data it touches and how it is used, and generates a policy plus a monitoring checklist tailored to that use case.
Software
What was hard
- Explaining regulation without dumbing it down or drowning people in caveats
- Deciding how much to build before getting more real feedback
- AI regulation itself keeps changing under the product
Demos and build notes
Results & impact
- ✓ MVP in its final stretch
- ✓ Validated the idea directly with people who work in compliance, not just other students
What I'd tell past me
- The regulation part was the easy half - getting an SME owner to actually open the tool is the real problem
- Mentor feedback from people in the industry changed the product more than any feature I came up with alone
If I keep going
- Finish the MVP and run a small pilot with real SME partners
- Keep the policy templates current as the EU AI Act rules settle