02 · IMPLEMENTATION · 6–10 WEEKS

Compliance-in-a-Box

Deploy a structured AI governance environment in Microsoft 365, including an Evidence Vault,
agreed registers, workflows and configured controls. Deliverables are organised for internal review
and, where scoped, future audit scrutiny.

WHAT IT IS

Your Microsoft 365 tenant becomes a compliance control room.

Compliance-in-a-Box is an end-to-end implementation engagement. By the time the engagement closes, your organisation’s AI governance infrastructure is live not designed on paper, but built, configured, tested, and operational inside your existing Microsoft 365 environment.

The solution is designed to use your Microsoft 365 environment wherever appropriate. Required entitlements, external dependencies and data flows are confirmed during scoping. Governance artefacts are version controlled in SharePoint, with an agreed permission model and documented workflows

Get Started

ARCHITECTURE DEPLOYED

What gets built inside your tenant.

SharePoint Evidence Vault


Structured site architecture with document libraries for FRIAs, DPIAs, governance policies, incident records, and audit artefacts. Controlled permissions, version history, and sensitivity labels applied.

AI Risk Register & Logs


Microsoft Lists configured with AI system inventory (risk classification, owner, status), FRIA log, DPIA tracker, and vendor AI register all linked to the Evidence Vault with automated deadline alerts.

Copilot Studio Agents


Intake workflows built in Copilot Studio for FRIA requests, DSAR submissions, and new AI use case reviews triggered from Teams, logged automatically, and routed to the appropriate reviewer.

Purview Controls


Sensitivity labels, DLP policies, retention schedules, and unified audit log access configured generating the control evidence that supervisory authorities and auditors expect to inspect.

First FRIA and DPIA completed


Priority assessments executed, reviewed by a qualified compliance professional, approved, and archived in the Evidence Vault. Auditor access protocol tested and confirmed operational.

DELIVERY TIMELINE

Six to ten weeks. Structured phases.

01. Weeks 1–2 · Foundation



SharePoint site architecture deployed. Evidence Vault structure configured. Sensitivity labels and permission model applied. AI risk register initialised in Microsoft Lists with existing inventory data.

02. Weeks 3–4 · Registers and workflows


All registers populated. Copilot Studio intake agents built and tested. FRIA and DPIA workflows connected to the Evidence Vault. Teams notifications configured for review triggers.

03. Weeks 5–6 · Purview and controls


Purview DLP, sensitivity labels, retention policies, and audit log access configured. Control evidence baseline established and documented for the first regulatory review period.

04. Weeks 7–10 · Assessments and handover


Priority FRIA and DPIA completed and archived. Auditor access protocol established and tested. Handover session with your team. Full architecture documentation delivered to the Evidence Vault.

Build the governance infrastructure required for your applicable AI Act obligations

Start with a scoping call to confirm the right configuration for your tenant and timeline.

Book a Scoping Call