What the tools do
The practice runs retrieval-grounded drafting tools. "Retrieval-grounded" means the tool is given the engagement's own source documents — the device description, the risk file, the test reports, the applicable standards and guidance — and is constrained to draft from those sources, citing the passage each statement rests on. It is used for three things:
- Producing first drafts of structured documents whose content is already fixed by the sources, such as the frameworks table of a biological evaluation plan or the clause-by-clause skeleton of a gap report.
- Cross-checking a draft against its sources: finding statements with no supporting passage, and passages in the sources that the draft has not addressed.
- Searching large document sets quickly, for example locating every mention of a material across a supplier's declarations.
The tools run on hardware under the consultant's control. They are not cloud services, and client material does not leave that environment to be processed.
What they never do
- No output leaves the practice unreviewed. Every AI-assisted draft goes through the same second-pass consultant review as any other draft, working from the sources rather than the draft, before it is issued.
- No tool makes a regulatory judgement. Classification, endpoint selection, risk acceptability, the sufficiency of evidence: these are the consultant's decisions, written in the consultant's words, and the review record says so.
- No client document is used to train any model, by the practice or by any third party. The tools do not learn from your file.
- No client material is sent to a third-party AI service. If a task ever required one, it would be agreed with the client in writing first and would use anonymised material only.
Controls on client documents
Local processing is one control among several, not a guarantee on its own. The others are described in the privacy notice and apply whether or not a tool is involved: client folders on a Microsoft 365 tenant with multi-factor authentication; access per client, per named person, with expiry; no "anyone" links anywhere on the tenant; encryption at rest and in transit; a retention schedule by record category; incident handling with client notification within 72 hours; and a mutual NDA available before anything is shared.
What this is not
It is not "AI-powered compliance", and the website does not use that phrase. The tools make a careful consultant faster at the mechanical parts of the work and more thorough at cross-checking. They do not replace the reading, the reasoning or the responsibility, and every deliverable is signed by a person who has done all three.
If you would prefer that no drafting tool is used on your engagement, say so on the scoping call. The work takes longer and costs more, and it is available.