One Compliance Bot, the packs you need
Compliance Bot is one product. The Core pack is always on; industry packs add the rules, check types and approval paths for your sector, and the Internal pack turns your own procedures into checkable rules. One document can be checked against several packs at once, and every finding shows which pack and rule it comes from.
Core plus industry and internal packs
The pack administrator turns packs on or off for each installation. Check types of inactive packs are not offered.
Core
Data protection, AI use and document control for every organisation – plus the shared engine: sign-in, approvals, audit trail and dashboard for all packs.
- CORE.PRIVACY
- CORE.AI
- CORE.DOCCONTROL
Banking
Credit processes, pre-contractual information, KYC/AML procedures and outsourcing for banks and credit institutions.
- BANK.PROCESS
- BANK.PRECONTRACT
- BANK.KYC
- BANK.OUTSOURCING
Food & Beverage
Labels and allergens, nutrition and health claims, HACCP plans, supplier certificates, audit readiness and recalls for food manufacturers and retailers.
- FOOD.LABEL
- FOOD.CLAIMS
- FOOD.HACCP
- FOOD.SUPPLIER
- FOOD.AUDIT
- FOOD.RECALL
Public sector & procurement
Tender documentation, ESPDs, electronic signatures, contracts and records for contracting authorities – with many procurement cases running in parallel, each with its own team, stage and deadlines.
- PUB.TENDER
- PUB.ESPD
- PUB.SIGNATURE
- PUB.CONTRACT
- PUB.RECORDS
Internal
Your own policies and procedures become approved, checkable internal rules. The policy owner approves every rule before the bot uses it.
- INT.DOCUMENT
- INT.RECORD
- INT.AUDIT
- + client-defined
Pharma / medical devices
Packs for pharmaceutical and medical device companies are in preparation.
- no check types yet
Check types, suggestions and approvals
Each pack brings check types. A check type fixes the rules applied, the report section and who must approve.
Upload
Upload a document. Pick check types yourself, or leave the picker empty and the bot suggests check types from what it finds in the document – you confirm.
Check against several packs
One check can combine packs – for example a recall email against Food & Beverage and Core data protection rules. Each pack gets its own report section.
Approve per check type
Each check type creates its own approval task for the right person – the Food Safety Manager for the label, the Data Protection Officer for privacy. The document is released only when all tasks are approved.
See only what you may
Access follows packs and, for procurement, cases. A user without access to a pack sees only that findings exist, not their content.
Procurement cases: in the Public sector & procurement pack every procedure is a case with its own stage, team, deadlines, findings and approvals. Many cases run in parallel; a returned document in one case does not hold up any other.
Practical use cases per pack
Typical situations from practice. All organisations, people and documents in the examples are fictitious.
CORE Core
AI chat assistant on a bank website
A bank plans an AI chat assistant on its public website. The system description and the website notice are checked in one review.
Typical findings: The chat window does not say users are talking to an AI system; risk classification not documented; chat transcript retention missing.
Video surveillance policy of a municipality
A municipality updates its several-year-old policy on video surveillance of the town hall entrance.
Typical findings: Retention period not stated; review date overdue; references to superseded data protection law.
Cleaning up the procedure library before certification
A food company wants every procedure and work instruction properly controlled before its next certification audit.
Typical findings: Missing owner or approval date, overdue reviews, no change history, a work instruction that contradicts its procedure.
BANK Banking
Revised consumer loan process
A bank revises its consumer loan approval process – the banking demo document.
Typical findings: Required steps not reflected, e.g. no documented creditworthiness step or no escalation for exceptions.
Cloud outsourcing contract summary
Before signing with a cloud provider, the outsourcing summary is checked for outsourcing and data protection on the same version.
Typical findings: Exit strategy, audit rights or data location not covered (EBA outsourcing guidelines, DORA); processing contract reference missing.
KYC/AML procedure vs the bank's own AML policy
The board approved a new internal AML policy. The branch KYC procedure must follow both the law and that policy.
Typical findings: Enhanced due diligence approved by the wrong person; review interval for high-risk customers longer than the policy allows.
FOOD Food & Beverage
A season of private-label supplier labels
A retail chain receives new and changed labels for its private-label range from several manufacturers before a seasonal launch.
Typical findings: Undeclared or non-emphasised allergens, missing quantity of ingredients, claims whose conditions are not met.
Monthly supplier certificate sweep
QA checks every month that supplier certificates and specifications are still valid.
Typical findings: Certificate expired; scope does not cover the supplied product; specification older than the company interval.
Preparing for an unannounced certification audit
A manufacturer wants to know where its evidence is weak – in procedures and in completed records.
Typical findings: Clauses without evidence; mock recall not performed; HACCP plan not reviewed after a process change; sampled records missing a second signature.
PUB Public sector & procurement
School meals tender in a small municipality
A municipality prepares an open procedure for school meal services. The tender asks for CVs of kitchen staff.
Typical findings: Award criteria without weighting; brand named without "or equivalent"; no conflict-of-interest declarations; CV form asks for more data than needed.
Evaluating several tenders: ESPDs and signatures
After the deadline, each tender is uploaded into the same case and checked against the same rules.
Typical findings: References below the minimum; no ESPD for a relied-upon entity; certificate expired at signing time. The bot never excludes a tenderer.
Contract file review before an external audit
Before an audit, the files of modified contracts are reviewed – each file is a case in the contract or archive stage.
Typical findings: Modification above the de minimis limit without a review clause; payment period too long; retention shorter than the schedule.
Many procurement cases in parallel
A procurement department runs many procedures at the same time, with several procurement officers.
Typical findings: One case list sorted by next deadline; each officer sees only their own cases; a returned document in one case does not hold up another.
INT Internal + Certora
Label release records against the company's own procedure
A food manufacturer wants every label release to follow its labelling procedure QP-07, not only the law.
Typical findings: Outdated supplier specification; translation not checked by a second person; missing Technical Director countersignature after an allergen change.
Low-value procurement against internal rules
Below the national thresholds, a municipality follows its own rules on how many offers to request and who approves.
Typical findings: Fewer offers requested than required; order approved below the approval level; file not stored in the required register.
Quarterly internal audit of complaint files
Internal audit samples complaint files against the bank's complaint-handling procedure every quarter.
Typical findings: Acknowledgement sent too late; response approved by the same person who handled the complaint; final letter missing.
SOON Pharma / medical devices
Coming soon – no use cases yet.
Employee training with Certora
Compliance Bot checks documents and records; Certora trains and certifies the people who write and run them. If employees learn exactly the rules the bot checks against, fewer findings arise in the first place.
Approved rules as training content
Approved internal and pack rules, with their source section, can be synced to Certora as training content – only sources the policy owner has released for training.
Training need suggestions
When the same rule is breached repeatedly, the dashboard suggests a training need for the role or team – for example "translation not checked by a second person – 2 occurrences – QA specialists".
A person decides
The process owner dismisses the suggestion or requests a training assignment in Certora. Compliance Bot never assigns training automatically and does not evaluate individual employees.
Concept. The training link is off by default and is shown in the demo as a concept. Integration details are to be confirmed.
On-prem: one shared Kwizmo & HalBrain instance
Compliance Bot runs in the client's premises with all its packs and procurement cases and one data store. Litoria and Certora are part of Kwizmo & HalBrain and use the same instance. The LLM, on-prem or EU SaaS, is connected only to Kwizmo & HalBrain.
- Client premises (on-prem): everything below runs inside the client's premises.
- Compliance Bot – one product with packs: Core (always on), Banking, Food & Beverage, Internal, and Public sector & procurement with procurement cases running in parallel (e.g. JN-DEMO-2026-014 preparation, JN-DEMO-2026-009 evaluation, JN-DEMO-2023-031 contract).
- Compliance Bot data store – documents, findings, approvals and audit trail; every row tagged by pack and, for procurement, by case.
- Kwizmo & HalBrain – one shared instance with the AI engine and LLM connection. Litoria and Certora are part of it and use the same engine; they do not read Compliance Bot documents, findings or cases.
- Training link (concept): approved rules can flow from Compliance Bot to Certora when turned on.
- LLM – on-prem or EU SaaS, connected only to Kwizmo & HalBrain. No other connection leaves the premises.
Which packs fit your organisation?
Tell us your sector and your main document types, and we will show you the matching packs and check types.
Contact
E-mail: tadej.drmaz@comp-consulting.eu