Compliance
Regulatory technology and compliance frameworks — automated auditing, policy-as-code, and governance tooling.
Our Focus
We make compliance programmable and less painful. Regulatory requirements are growing in scope and complexity, but the tools most organizations use to manage them have not kept pace.
Our research bridges the gap between legal and regulatory text and working software — turning policies into code, audits into automation, and governance into something that actually scales.
Key Research Areas
Policy-as-Code
Translating regulatory requirements into executable rules. We study how to represent complex compliance logic in machine-readable formats that can be tested, versioned, and audited like software.
Automated Auditing
Continuous compliance monitoring and evidence collection. We build systems that replace periodic manual audits with real-time validation — reducing cost and increasing coverage.
Governance Frameworks
Organizational structures and decision-making processes for technology governance. We research how compliance, security, and engineering teams can work together without slowing each other down.
Key Questions
- How do we keep compliance automation current as regulations evolve?
- What does continuous compliance look like in practice, not just in theory?
- How should AI governance frameworks account for rapidly changing capabilities?
- Where does compliance tooling create genuine risk reduction versus checkbox theater?
Frequently Asked Questions
- How do we keep compliance automation current as regulations evolve?
- Compliance automation should be built on modular, versioned rule engines that separate regulatory logic from enforcement infrastructure. When regulations change, only the rule definitions need updating — not the underlying platform. Monitoring regulatory feeds, participating in standards bodies, and maintaining a regulatory change management process are essential for staying current.
- What does continuous compliance look like in practice, not just in theory?
- In practice, continuous compliance means automated evidence collection integrated into CI/CD pipelines, real-time policy evaluation against running infrastructure, automated drift detection with alerting, and living audit trails that are always ready for review — replacing the traditional cycle of periodic manual audits followed by rushed remediation.
- How should AI governance frameworks account for rapidly changing capabilities?
- AI governance frameworks need to be principle-based rather than prescriptive, with regular review cycles tied to capability milestones rather than calendar dates. They should define risk categories and evaluation criteria that adapt as models evolve, include provisions for rapid response to novel capabilities, and require ongoing monitoring of deployed systems — not just pre-deployment assessment.
- Where does compliance tooling create genuine risk reduction versus checkbox theater?
- Genuine risk reduction comes from tooling that enforces controls in real-time, provides actionable evidence of security posture, and integrates with engineering workflows. Checkbox theater results from tools that generate reports without enforcement, measure documentation completeness rather than actual control effectiveness, or optimize for audit appearance rather than actual risk reduction.