BERKSHIRE, UK. November 2nd, 2026 – Compliance advisory firm JVR Consultancy is warning businesses not to rely on AI-generated policies when preparing for accreditation, arguing that producing compliance documentation is an important part of understanding how policies should work in practice.
While AI tools can be useful for drafting, structuring and reviewing content, businesses risk missing an important part of the compliance process if they use them to generate policies without properly working through the requirements themselves.
Organisations seeking supplier accreditation, certification or approval under schemes and standards – such as Constructionline, Achilles UVDB, CHAS, SafeContractor, RISQS, ISO management systems and some cyber assurance certifications – may be required to provide a variety of policies, procedures and supporting evidence. These can cover areas including health and safety, quality, environmental management and workforce competence.
JVR Consultancy says these documents should reflect the systems and working practices that exist within the organisation, rather than simply providing the wording that appears to satisfy a particular requirement.
“AI can produce a very professional-looking policy very quickly, but having the document is not the same as understanding what sits behind it,” said Steven Sandhu, Managing Director of JVR Consultancy.
“Writing a policy properly forces you to walk through what actually happens within your business. You have to consider the risks, who is responsible, what controls are in place and what happens if something goes wrong.
“That thinking is part of the value of developing the policy. If you simply ask AI to produce the document for you, you can skip the process that helps you understand what the policy means for your organisation.”
JVR Consultancy says one risk is that generic AI-generated documentation can describe arrangements that sound credible but do not accurately reflect how a particular business operates.
They say auditors are increasingly familiar with generic documentation and may recognise policies that lack the detail needed to demonstrate how an organisation actually operates. A policy could, for example, refer to responsibilities, processes, monitoring arrangements or controls that haven’t been established or put into practice.
Different documents produced independently may also create inconsistencies in how responsibilities or procedures are described.
The problem becomes more apparent when a business is required to demonstrate the evidence and working practices behind its documentation. If a policy states that particular checks are carried out, records maintained or procedures followed, the organisation needs to be able to demonstrate that these activities actually take place.
There are also potential financial consequences. Businesses that fail an assessment can face fees for reassessment, meaning that what initially appeared to be a quick, inexpensive way of producing documentation can ultimately prove costly.
Beyond the accreditation process itself, the consequences can be more serious. In safety-critical industries, policies and procedures exist to protect people, and documentation that does not reflect actual working practices can have significant implications.
“When you’re dealing with activities or working environments where there are safety risks, getting health and safety procedures wrong can put lives at risk,” Sandhu said. “Auditors take these requirements particularly seriously because they’re there to prevent accidents and injuries. If a business can’t demonstrate that the right procedures and controls are in place, it risks failing its assessment. This isn’t simply paperwork you need to produce to get through an audit.”
While AI can still have a useful role in supporting compliance work, policies must be developed around the organisation’s real activities, risks, responsibilities and working practices, with appropriate human expertise involved.
As businesses grow, their management systems and the evidence required to demonstrate compliance will often become more extensive. Maintaining accurate documentation is therefore an ongoing responsibility, rather than a one-off exercise undertaken for an accreditation assessment.
“AI doesn’t know your business or how it operates. It can’t replace that understanding. We’ve spoken to clients who have used AI to draft policies, only to find that the documents didn’t adequately reflect their actual working practices,” Sandhu added.
“The fact that AI can help you write something shouldn’t replace the process of understanding it. A compliance policy isn’t just something you submit. It should be something your business can follow.”
JVR Consultancy continues to support organisations across rail, construction, utilities and other regulated sectors, helping businesses prepare for accreditation, develop and improve management systems and maintain ongoing compliance.
ENDS