Hire an AI compliance evidence readiness reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• Gaps closed, new, still open and overdue, with the counts against last quarter
• Up to ten gaps to close first, each with the evidence an auditor will ask for
• Gaps marked closed that have no proof yet
• A short list of points to confirm with a qualified person

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Saying a company is compliant. These checks show readiness gaps, nothing more.
• Treating a policy that exists as a control that works. Ask for evidence it is followed.
• Letting overdue gaps sit. Name the owner every quarter.
• Giving legal advice. Point to a qualified person.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: You are working toward SOC 2, ISO 27001 or GDPR readiness and need to show steady progress.

• This quarter. Counts of gaps closed, new, still open and overdue, set against last quarter.
• Close first. Up to ten ranked gaps, each with its framework, reason, proposed owner and the evidence an auditor will ask for.
• Claimed closed, no evidence. Gaps marked fixed that have no proof yet, and the proof each one needs.
• Overdue. Gaps open for more than a quarter, with the owner and the date each was found.
• Ask a qualified person. Points that an auditor, lawyer or data protection lead should confirm.
• Files and missing. Each step's saved file, the updated gap register and every MISSING line in one list.

How the work is checked

• Every closed gap has evidence or is marked "claimed closed, no evidence".
• Every gap has a framework, a date and, once a person confirms it, an owner.
• Nothing is called compliant, certified or passed.
• The list is capped, and the cap fits the owners' time.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Confirm the scope. Checks what is in scope and notes any change since last quarter.
• Build the base once. Makes an evidence checklist for each framework and reuses it every quarter.
• Run the checks. Runs the readiness check for each framework in scope. For GDPR, it adds a privacy check when your code or data use changed.
• Update the register. Marks each gap closed, claimed closed with no evidence, overdue or new.
• Choose the order. If an audit is within 90 days, it puts the gaps that block it first. Otherwise it ranks by risk.
• Cap the list. Hands back at most ten gaps for the quarter, with owners to confirm, and stops.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id quarterly-compliance-readiness-keeper only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/quarterly-compliance-readiness-keeper/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The frameworks in scope and which systems and teams they cover
• The date of any audit or review (optional)
• What changed this quarter, such as new systems, suppliers or ways of using personal data (optional)
• Evidence you have for each control, such as policies, screenshots and access reviews
• The code, if you want the privacy check (optional)
• Last quarter's register, after the first run

Helpful context (optional)

• Your last audit report, if you have had one
• A list of your suppliers that handle customer data

Tools and access

• Claude Code: It can keep the register and checklists in a folder and read your code for the privacy check.
• Claude, ChatGPT or Gemini: The questions run fine in plain chat. An AI that reads files can check a pasted control list or evidence log.

Functions and deliverables

• Compliance evidence readiness reviewer: Review readiness gaps for your chosen standard. Recheck evidence, track overdue work and rank what needs attention first.
  • Gaps closed, new, still open and overdue, with the counts against last quarter
  • Up to ten gaps to close first, each with the evidence an auditor will ask for
  • Gaps marked closed that have no proof yet
  • A short list of points to confirm with a qualified person
• Compliance readiness checklist builder: Share your frameworks and current controls. Get an evidence checklist with gaps and ranked fixes.
  • A checklist by control area
  • Status for each item
  • Gaps ranked by priority
  • A readiness summary
  Source: Burhan Sebin.
• SOC 2 readiness checker: Name your scope. Answer six questions and get gaps to fix before the SOC 2 Type II watch period.
  • Ready or gap for each of the six questions
  • Controls that skipped a cycle, and mid-period changes that need paperwork
  • Evidence coverage by quarter of the period
  • A verdict of on track, needs attention or material risk
  • Your top three fixes, each with an owner and a date
  Source: Alireza Rezvani.
• ISO 27001 audit prep coach: Get your ISO 27001 audit prep done before the auditor arrives. Name your scope, answer six questions, and get a verdict with your top 3 fixes.
  • Answers to six audit questions, with gaps marked
  • A list of weak or missing evidence
  • A pass or fail on the high-risk controls, with a sample for each
  • A verdict: ready, close criticals first, or not ready
  • Your top 3 actions with an owner and a timeline
  Source: Alireza Rezvani.
• GDPR audit prep coach: Get a GDPR audit prep check before a review. Name your scope, answer six article-based questions and see the privacy gaps to fix first.
  • Six questions tied to GDPR articles
  • What evidence would satisfy each one
  • A list of gaps ranked by risk
  • Fix steps before the review
  Source: Alireza Rezvani.
• GDPR privacy checker: Review code for possible privacy risks. Get scan findings, a draft impact assessment and a data-request tracker.
  • A scan report of personal data and risky code
  • A draft impact assessment
  • A tracker for data subject requests
  • Fixes ranked by risk
  Source: Alireza Rezvani.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You are working toward SOC 2, ISO 27001 or GDPR readiness and need to show steady progress.
• An audit or review is booked and you need to know what blocks it.
• You have a gap list that nobody has updated in months.

Limits to check before starting

• You need a legal opinion or proof that you are compliant: ask an auditor, a lawyer or a data protection lead.
• You want a one-off first look at your gaps with no quarterly tracking: run a single readiness check for your framework, or ask an auditor for a scoping call.
• You need someone to send evidence or contact an auditor for you: do that step yourself, because this agent never sends or changes anything.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Start a chat with the agent. In Claude Code, add it as a skill or save it in .claude/agents, then ask it to run this quarter's check.
• Tell it your frameworks and scope. The first run builds a checklist for each and a register of gaps.
• Give it the evidence you have. Answer its questions from what you can show.
• Confirm the owners it suggests, and take the ranked list to your team.
• Run it next quarter. It compares with the register and marks what closed or went overdue.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/quarterly-compliance-readiness-keeper for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.