Your policy says what should happen. Your regulator asks what did.
Show the rule, the record and the named owner behind every AI decision your regulator could ask about.
AI is already drafting, summarising and screening work that regulators care about. Compliance teams are being asked to stand behind it. GenWA Guard checks that work against your policies and the rules you select, and GenWA Evidence keeps the record, so you answer from facts rather than from memory.
of UK financial services and insurance professionals say they thoroughly review and significantly edit AI-generated material before it goes out.
Smarsh survey of 2,000 UK financial services and insurance professionals, April 2026 (vendor survey)of the same group use generative AI every day, including for compliance documentation.
Smarsh, April 2026 (vendor survey)believe their firm's surveillance systems are fully equipped to detect risks in AI-generated content.
Smarsh, April 2026 (vendor survey)enterprise respondents can show that staff follow their written rules for generative AI (survey of 100 UK and Irish decision-makers, small sample).
SAS, September 2026 (vendor survey)You answer for AI you did not choose, cannot fully see and cannot yet evidence.
of UK employers have a formal policy on generative AI at all.
CIPD, 2025 and 2026 (employer survey)Tools arrive on personal accounts, expense claims and features added to software you already own. What it costs you: a compliance view built on the tools you happen to know about.
Seven in ten respondents to the SAS survey had written rules, and about one in eight could show they were followed. What it costs you: a document that does not protect you when a supervisor asks for proof.
Less than half of surveyed financial services staff thoroughly review AI material before release (Smarsh, 2026). What it costs you: errors reach customers, and you find out afterwards.
The Data (Use and Access) Act 2025 widened the room for automated decision-making and added safeguards: people must be told, be able to contest and get meaningful human review. What it costs you: procedures rewritten by hand, team by team.
In a 2025 survey of financial services compliance professionals, 24% had policies for third-party AI use (ACA Group and NSCP, vendor and trade-body survey). What it costs you: risk you carry but did not design.
A tender, an insurer, an auditor or a regulator asks, and the answer is assembled by hand from several systems. What it costs you: days of senior time and answers that differ from one request to the next.
A policy states intent. A control acts at the moment the prompt is sent.
Regulators in the UK have moved from asking whether you have a policy to asking whether it was applied to the work in front of them. That is not a documentation problem. It is a placement problem: the rule sits on the intranet, and the request happens somewhere else. The practical answer is to put the check in the path of the work, send every exception to the person whose authority covers it, and keep the record as a by-product. Compliance then spends its time on judgement, not on chasing.
Control applies to AI used through GenWA. We prepare the evidence; accredited bodies issue any certification. This supports your compliance work and is not legal advice.
Six things a compliance team can put in front of a supervisor.
Guard acts on the work. Evidence keeps the proof. Together they work as a pair.
Documents, prompts, calls and messages are checked against your policies and the regulations you select. Guard can block, challenge or send an item to the person who must approve it.
About GuardRules that sit in the path of the workYour policy becomes rules that apply to AI used through GenWA, so it is followed whether or not anyone remembers it.
About RulesA Log of what happenedThe Log is the record of events: what AI saw, produced and who approved it, held in your AWS or Azure account, or hosted by GenWA on AWS as agreed.
About the LogEvidence Packs and Compliance MappingReady reports for a period, a tender or a visit, built from the record, with your controls mapped to the frameworks and regulations you choose.
About Evidence PacksAnswers drawn from your own recordThe Intelligence Layer is being built. It will draw trends and answers from the Log, each linked to the entries behind it.
About the Intelligence LayerThe compliance and risk toolkitThe GenWA Toolkit bundles the register, Rules, Change Control, Evidence Packs, Compliance Mapping, Control Matrix and Exception Log. We confirm in writing which parts are available today.
See the GenWA ToolkitAnalyse, review, flag, report: compliance sees only what needs a decision.
A harness is the set of checks, rules and approvals that sits around a piece of AI work. Guard reads the work, reviews it against your rules, flags what does not align and reports, so the exception reaches the right person with the reason attached.
Animated flow showing analysis, review, flagging and reporting of AI work
- 1Analysis
AI use is read against your rules, policies and chosen regulations.
- 2Review
Each finding is checked against the evidence behind it.
- 3Flag
Anything outside the rules is raised to a named owner.
- 4Report
What was found and what was decided is recorded and dated.
- Reading drafts and messages against written rules.
- Preparing evidence extracts and first-pass summaries.
- Tracking and summarising changes in rules for your review.
- Anything affecting a customer's credit, hiring or medical matters, where people decide.
- Sign-off on consequential items and regulatory reporting.
- Reading ambiguous rules and deciding what they mean for you.
Compliance is a judgement function. AI is strongest at reading large volumes against a rule and weakest where context, intent and consequence matter.
Three sectors where compliance carries the heaviest AI load.
Pick the sector closest to yours.
Consumer Duty and financial promotions
Firms regulated by the Financial Conduct Authority (the UK conduct regulator) must show good outcomes for customers and approve financial promotions. Guard checks AI-drafted communications against the rules you select, and Evidence shows who approved what.
See financial servicesAI in pricing support, claims and customer letters
The Bank of England and Financial Conduct Authority 2024 survey found 95% of insurers using AI. Guard checks drafted letters and notes; people decide on claims and pricing. Evidence answers the reinsurer, the auditor or the supervisor.
See insuranceSpecial-category data and inspection evidence
Health data needs strict handling. Rules keep it out of consumer AI tools, the Data-Flow Map shows where it goes, and the Log supports inspection by the Care Quality Commission. Clinical judgement stays with clinicians.
See healthcare and careThree routes, matched to where your compliance team is today.
Advisers are human and agentic. A fourth route, the Accelerator, is by application only and is paid by equity, project, retainer or licence, for founder-led businesses that want us alongside them.
Our advisers, human and agentic, review your AI use against your policies and the rules that apply, and design the checks and the record on paper first.
See advisoryProductsGuard and Evidence run in your AWS or Azure account, or hosted by GenWA on AWS as agreed. They check work as it happens and build the record and reports as AI is used.
See Guard and EvidenceIncubatorWe build a workflow you want to put AI into, in an agreed engagement in a controlled environment, with the checks and record designed in from the start.
See the IncubatorEstimate the hours Evidence could give back when you are asked for proof.
Enter how often you are asked for evidence and how long each answer takes today. The result is an indicative estimate from your figures, not a forecast or a promise.
Evidence time calculator
Indicative, from the numbers you enter
- A record covers the same share of every request.
- A person still checks and signs off whatever the record produces.
Items marked assumption can be edited. No figures are stored or sent.
How this is worked out
Hours by hand a year = requests a year x hours each. Hours a record could cover = hours by hand x share covered. Hours still needing a person = the rest.
Three colleagues who share the work, and three functions to bring alongside.
People who own the risk, and teams whose AI use you will be asked about.
Owns the rules and what you would show a regulator or insurer.
For Compliance and General CounselThe boardAsks whether AI is under control and expects a plain answer.
For the boardChief operating officerOwns the processes where the checks and approvals must fit.
For the chief operating officerLegal teamsShare the confidentiality and supervision questions.
AI for legal teamsCustomer service teamsSend the most customer messages that need checking.
AI for customer serviceMarketing teamsProduce the promotions that need sign-off.
AI for marketing teamsWant to see the record a supervisor would ask for?
Book a demo and we will walk through a check, an exception and the evidence pack that follows, using example data.
Keep reading
Straight answers.
How can a compliance team prove that AI use follows policy?
Keep a record made as the work happens and check each request against your written rules. GenWA Guard applies your rules to AI used through GenWA and GenWA Evidence keeps the Log and reports built from it, so the proof exists before anyone asks.
What does GenWA Guard do for a compliance team?
Guard checks documents, prompts, calls and messages against your policies and the regulations you select. It can block an action, challenge a result or send it to the person with authority to approve it, and it reports what aligned and what did not.
Can AI make compliance decisions for us?
No. AI can read, compare and prepare, but people decide. Decisions about credit, hiring and medical matters stay with people, and consequential items go to the named person whose authority covers them.
Does GenWA make us compliant or certified?
No. GenWA maps your controls to the frameworks you select and prepares the evidence. Accredited bodies issue any certification, and the mapping supports your compliance work without being legal advice.
Does Guard see every AI tool in the business?
No. Controls apply to AI used through GenWA, meaning connected and routed tools. The Register and an advisory review help you find what else is in use, so you can decide what to bring under control.
Where does the record live?
The record is held in your AWS or Azure account, or hosted by GenWA on AWS as agreed. You choose, and we agree it in writing before we start.
How does a compliance team get started?
Start with the AI health check or book a demo. The health check gives a first view of what AI is in use and where control is thin. Our advisers, human and agentic, then help you choose where Guard and Evidence should begin.
See your AI controls the way a supervisor would.
Control-mapped to the rules you select. We prepare the evidence; accredited bodies issue certification. This supports compliance and is not legal advice.