Nobody misses a filing deadline because the writing was slow.
Filings slip somewhere else entirely, and it is worth being precise about where, because the tools being sold most aggressively address the one stage that was never the problem. The drafting assistant that produces polished regulatory prose in a demonstration is solving the last two days of a six-week process.
The way to work out what is worth buying is to walk one cycle and mark where the days actually go.
Stage One: Working Out What Is Due
The cycle starts with a question that sounds trivial and frequently is not: what do we owe, to whom, and by when.
In a smaller regulated business this lives in somebody’s head, a spreadsheet, and a calendar reminder that survived two laptop refreshes. It works until the person is on leave, or a threshold is crossed that triggers an obligation nobody was tracking, or a regulator changes a form and the change is noticed by accident.
Regulatory change monitoring is the tooling category here, and it is worth buying before anything that writes. What it does is watch the sources that publish changes and tell you which of them touch obligations you actually have.
The thing to check is scope. A monitor tuned to a handful of major regulators will produce a clean, reassuring feed and miss the state-level or sector-specific body that issues the form you file most often. Ask which sources it covers, then check your own filing list against that answer rather than the marketing page. Our piece on managed IT services and compliance covers how these obligations tend to be distributed across a small business.
Stage Two: Assembly, Where the Weeks Disappear
This is the stage that eats the calendar, and it is almost never demonstrated.
Assembly means gathering the underlying material: the access logs, the training completion records, the incident register, the asset inventory, the policy versions in force during the period, the sign-offs. In a small firm this material sits across five systems and three mailboxes, and a good proportion of it is retrieved by asking a colleague to send a screenshot.
Two failure modes dominate. The first is that the evidence exists but cannot be located inside the window, so somebody reconstructs it from memory and the filing rests on a recollection. The second is subtler and worse: the evidence is retrieved from a system that has since changed, so it describes today rather than the period being reported.
AI helps here more than anywhere else in the cycle, and the useful capability is unglamorous. A tool that connects to the systems of record, pulls the relevant records for a stated period, and presents them with their source and retrieval timestamp removes most of the elapsed time in a filing.
What to insist on is that it names what it could not retrieve. A pack that looks complete and silently omits the one system that was unreachable is more dangerous than an obviously incomplete one, because nobody goes looking. The distinction between assembled and assembled-with-gaps has to survive to the person signing.
Stage Three: Reconciliation Against the Numbers You Already Reported
Before anything is drafted, the figures have to agree with what you have said before.
This matters because regulators read filings in sequence. A headcount that moved without explanation, a control count that fell, a date that contradicts last period’s submission: each invites a question, and answering it six months later costs more than getting it right now.
The tooling that helps is cross-filing comparison, which reads your prior submissions and flags where this period’s numbers diverge. It is a genuinely good use of the technology because the work is mechanical, high-volume, and exactly what a human skims past at eleven at night.
Its limit is that it flags divergence and cannot tell you whether the divergence is wrong. A headcount that fell because a subsidiary was sold is correct and will be flagged; a headcount that fell because a data source changed shape is a defect and looks identical. Treat the output as a question list, never a fault list.
Stage Four: Drafting, Which Is the Short Part
Now the writing, and this is where the sales effort is concentrated.
Drafting assistants are competent. Given the assembled evidence and the prior filing, they produce serviceable narrative sections faster than a person, and for a firm filing the same forms quarterly, the saving is real if modest.
The risk is specific and it is not bad prose. It is a confident sentence describing a control that was not in force during the reporting period, generated because the model read the current policy rather than the version that applied. That is a misstatement to a regulator, and it is produced by a tool doing exactly what it was asked. Every generated assertion about a control needs to point at the dated evidence behind it, which is only possible if stage two preserved the dates. This is the same class of risk we cover in our article on AI and cybersecurity compliance.
Stage Five: Review and Attestation
Someone signs. That signature is a personal statement, and it is the reason the tooling question is not purely about efficiency.
A reviewer who receives a generated filing has a harder job than one who receives a human draft, because the generated version reads as more finished than its evidential basis warrants. Fluency is not accuracy, and a well-formed paragraph invites less scrutiny than a rough one.
What helps is a review view that shows each assertion beside the evidence it rests on, so the reviewer checks the link rather than the language. What does not help is a clean document and a separate evidence folder, which is what most tools produce and what guarantees the two are never compared. The legal framing around this is covered in our piece on secure workspace solutions and regulatory compliance.
Stage Six: The Part Everybody Skips
After submission, retain the package.
Not the filing. The package: the evidence as retrieved, the timestamps, the tool versions, who reviewed and when, and what the tool reported it could not obtain. If a filing is queried two years on, this is the difference between an afternoon and a fortnight.
It is skipped because the deadline has passed and the pressure is gone, which is precisely why it should be automatic rather than a task on somebody’s list. Any tool worth buying writes this without being asked.
The Policy Version Problem, Which Sits Under All of This
One mechanism causes most of the misstatements described above, and it is worth naming separately because no tool advertises against it.
Policies change. A filing describes a reporting period in the past. So the correct answer to “what control was in force” is almost never what your policy library currently says, and every system in a small business is optimised to serve the current version.
A document store shows you the live policy. A wiki shows you the live page. An AI tool pointed at either will describe the present tense with complete confidence and no indication that the period in question predates the change.
The practical consequence is specific. A control tightened in June, described in a filing covering January to March, is a claim that something was true when it was not. It is not caught by review, because the reviewer is reading the same current library. And it is not caught by the tool, because the tool was given exactly what it asked for.
Two things fix it, neither of which is AI. Policy versions need effective dates, not just modified timestamps, so a period can be resolved to a version. And the evidence pack needs to record which version it pulled, so a reviewer can see that the answer came from the right one.
If your policy library cannot answer “what did this say on 14 February”, no filing tool can compensate, and buying one first will produce a faster route to a less defensible submission.
Who Owns the Calendar When It Is Automated
A monitoring tool changes who notices a change, and that raises a question worth settling before it is switched on.
If the tool emails a distribution list, nobody owns it, and a genuine change lands beside forty routine notifications and is read by nobody. If it emails one person, it is owned right up until that person is on leave during the fortnight a form changes.
What works in a small business is narrow and boring: the change feed goes to a named person with a named deputy, and every item gets an explicit decision, either it affects an obligation we hold or it does not. That decision is recorded, which matters more than it sounds, because next year somebody will ask why a change was not actioned and the honest answer needs to exist somewhere.
Tools that only produce a feed leave this to you. Tools that require a disposition on each item are doing something more useful than filtering, and the difference is easy to miss in a demonstration where every item is interesting.
The Two Questions That Eliminate Most Tools
Ask both before a demonstration.
Can it tell me what it could not retrieve? If the answer is no, or the answer is a support log rather than something in the filing view, the pack will look complete when it is not.
Can I get from any statement in the filing back to the dated evidence behind it? Not the source system, the actual record as it stood in the period. A tool that cannot do this makes the reviewer’s job harder while appearing to make it easier.
Most of the category fails the second question. Establishing which systems can even answer it is ordinary AI readiness work, and the assembly itself is intelligent process automation pointed at a compliance function rather than an operational one.
Where We Would Not Let a Tool Have the Last Word
Three places, and they are not about capability.
Materiality judgements, because deciding whether something is significant enough to disclose is a legal call with consequences that do not sit with the vendor. Anything describing an incident, since incident narratives are read adversarially later and the wording matters more than in any other section. And the attestation itself, which is a person’s statement about their own knowledge and cannot be delegated to software regardless of how good the software is.
Everywhere else, the constraint is your own evidence trail rather than the tooling. General AI tool selection is covered in our piece on AI cybersecurity tools, and the shift in day-to-day document work is in our article on AI assistants versus classic office tools.
Frequently Asked Questions
Which stage should we automate first?
Assembly, because that is where the weeks go. Regulatory change monitoring is a close second if your filing obligations are not written down anywhere authoritative. Drafting comes last, since it is the shortest stage and the one where a mistake is most expensive.
Can AI write a filing we can submit as-is?
It can produce the narrative sections, and it should not be submitted without a reviewer checking each assertion against dated evidence. The failure mode is not clumsy writing, it is a fluent description of a control that was not in force during the period.
What does a good evidence pack contain?
The records as retrieved, the retrieval timestamps, the period they cover, the systems they came from, and an explicit list of anything the tool could not obtain. That last item is the one most packs omit and the one that matters when a filing is queried.
How do we handle a tool that flags a difference from last period?
Treat it as a question, not an error. A figure can move for entirely legitimate reasons, and a real defect looks identical to a legitimate change until somebody checks. The value is in never missing the divergence, not in the tool’s verdict about it.
Do we still need a specialist if we buy good tooling?
Yes, for materiality and for anything describing an incident. Those are judgement calls with legal consequences, and no filing tool takes on that risk for you.
Who Is Behind This Advice
Our team has sat in filing cycles at businesses small enough that the person assembling the evidence is also the person who signs. That shapes the advice: the tool that reduces the drafting from three days to one is pleasant, and the tool that reduces the evidence hunt from four weeks to four days changes the outcome.
We have also seen the failure this article is arguing against. A client bought a capable drafting assistant, kept the same manual evidence hunt, and reported no change to their filing timeline at all. The prose was better and the deadline was just as tight.
Matt Rosenthal leads Mindcore and pushes for compliance automation that reduces elapsed time rather than the word count, which usually means buying at a less exciting stage of the process.
Buy at the Assembly Stage, Not the Drafting Stage
Walk your own cycle before you shortlist anything, and mark where the days actually go. Write down every filing you owe and check a monitoring tool’s source coverage against that list rather than its marketing. Automate evidence assembly first, and require it to name what it could not retrieve, in the filing view rather than a log. Use cross-filing comparison to catch divergence, and treat every flag as a question rather than a fault. Buy drafting last, and only where every generated assertion can be traced back to dated evidence from the period. Give the reviewer a view that puts each statement beside its evidence, since a clean document and a separate folder guarantees nobody compares them. Retain the whole package automatically, because the day it matters is the day nobody remembers building it. If you want help mapping where your own filing cycle loses its weeks, book a free strategy call and we will start with your last submission.
