Automating the compliance year without handing over the decisions
Last checked 2026-11-13
This site is about ongoing compliance work, the jobs that come round every week, quarter and year. It explains what an AI worker can take off your plate, and where a person has to stay in charge.
What recurs in a compliance year
Getting a permit or an approval is a project. Staying compliant afterwards is a routine, and the routine is where things slip. A register goes six months without a review. A contractor's insurance lapses and nobody notices. A reporting date arrives while the person who knew about it is on leave. None of these failures comes from not knowing the rules. They come from too many small, dated tasks spread across too many people.
For most regulated businesses the recurring work falls into six groups:
Registers
Risk, legal, hazard, chemical, plant and contractor registers that need regular review and an owner for every entry.
Audit evidence
Records gathered for internal audits and certification audits, filed so an auditor can follow them.
Reporting dates
Fixed annual deadlines, such as Australia's NGER reporting date, plus event-driven deadlines that start when something happens.
Incidents
Notification, the incident register, investigation and corrective actions.
Document control
Versions, review dates, approvals and making sure the right people have read the current procedure.
Training records
Tickets, licences, inductions and the expiry dates that go with them.
If what you need is help getting an approval in the first place, such as a referral, a licence application or a permit, see our sister site regulatoryapprovalautomation.com. This site covers what comes after.
What can be automated and what stays with a person
The useful line is between admin and judgement. Admin is finding, sorting, reminding, chasing and drafting. Judgement is deciding what something means and putting your name to it. An AI worker is good at the first and should not be doing the second.
| Recurring task | What an AI worker can do | What stays with a person |
|---|---|---|
| Register reviews | Track review dates, ask each owner to confirm or update their entries, and record the answers | Rating risks, choosing controls, accepting residual risk |
| Audit evidence | Collect requested records from SharePoint and OneDrive into one audit folder, list what is missing, chase owners | Deciding whether evidence is adequate, answering the auditor, responding to findings |
| Reporting deadlines | Keep the calendar, send reminders well ahead, gather the inputs, draft the figures pack | Checking the figures, signing off, lodging with the regulator |
| Incidents | Draft the incident report and the notification wording from the facts given, update the register, track corrective actions | Deciding whether an incident is notifiable and notifying the regulator |
| Document control | Flag documents past their review date, route drafts for approval, chase read-and-acknowledge | Approving content and releasing a new version |
| Training and licences | Flag expiring tickets, licences and insurances, remind the worker and their supervisor | Deciding who may do the work, and stopping work when something has lapsed |
How an AI worker on Microsoft 365 does it
The Everything, made by SG1 Consulting (the publisher of this site), is an AI worker that lives in Microsoft Teams. It works with the tools a Microsoft 365 business already uses: Outlook and shared mailboxes, Outlook Calendar, SharePoint and OneDrive, SharePoint Lists, Excel, Word, To Do and Planner. You talk to it in Teams, or by text from your phone.
For compliance work, that means:
- Reminders from a reporting calendar. It works from the dates you give it and reminds the right owner with enough lead time to act.
- Chasing owners for evidence. It asks people by email or Teams for the record it needs, follows up, and tells you who has not answered.
- Collating evidence. It finds files in SharePoint and OneDrive and gathers them into an audit folder with an index.
- Drafting. It drafts incident notifications, reports and register updates for a responsible person to check, approve and submit.
- Flagging lapses. It flags expired licences, tickets and insurances. Its quoting work already flags subcontractors with lapsed insurance.
- Remembering your rules. Rules you set, such as "warn me 60 days before any plant inspection", persist between conversations.
It asks before anything important goes out, and when something looks off it stops and shows you what it thinks is wrong. It is not a dedicated EHS or QHSE system. It works alongside the registers and documents you already keep in Microsoft 365, rather than replacing them with a new database.
What stays with a person
Regulators deal with people and organisations, not with software. Every obligation on this site has a responsible person behind it, whether that is a business owner, an officer, a WHS manager or whoever your systems name. That person:
- decides whether an incident, breach or event is reportable;
- makes the notification or lodges the report, by whatever channel the regulator requires;
- approves controlled documents and accepts risk ratings;
- signs declarations and answers auditors and inspectors;
- decides what to do when a record is missing or a licence has lapsed.
An AI worker makes those decisions faster to reach, because the facts, files and drafts are already together. It does not make them for you.
Before you start
The Everything runs inside your Microsoft 365 tenant with tightly scoped permissions, but your data does leave the tenant for AI processing. Its privacy policy names Microsoft (Azure OpenAI) and OpenAI as AI providers and says providers may process information outside your country. The public site does not claim any certification such as SOC 2 or ISO 27001, and it does not name a hosting country.
Compliance records often hold personal and health information, so check your own privacy, data handling and record-keeping obligations before you connect any AI tool to them, and decide which sites, lists and mailboxes it should and should not use. The Everything costs $400 AUD/month + GST per company with unlimited team members, and has a 14-day free trial with no credit card. If you cancel, your files stay where they always were, in your Microsoft account.
Questions people ask
Is this a replacement for an EHS or QHSE system?
No. The Everything is a general AI worker on Microsoft 365. It works with the registers, lists and documents you already keep in SharePoint, OneDrive and Excel. If you use a dedicated compliance system, the AI does not replace it.
Will the AI submit reports to a regulator for me?
No. It drafts, gathers and reminds. A responsible person checks the content and makes the notification or lodgement. The Everything asks before anything important goes out.
Which regulations does this cover?
The examples on this site come from Australian rules (such as WHS incident notification and NGER reporting) and United States rules (such as OSHA recordkeeping). They are examples, not a complete list. Check which obligations apply to your business.
How is this different from regulatoryapprovalautomation.com?
That site covers getting approvals, permits and licences in the first place. This one covers the ongoing work of staying compliant once you have them.
Does my data stay in Microsoft 365?
Your files stay in your tenant, but content is sent to AI providers (Azure OpenAI and OpenAI) for processing, which may happen outside your country. The privacy policy says it does not permit customer content to be used to train general-purpose models for other customers.
Try it on your own compliance year
The Everything is an AI worker that lives in Microsoft Teams and works with the registers, documents and mailboxes you already have in Microsoft 365. It asks before anything important goes out. $400 AUD/month + GST per company, unlimited team members, with a 14-day free trial and no credit card.
See how The Everything works