AI shows up at four points in the policy lifecycle. Drafting: write a first version from source material or older policies. Updates: summarize exactly what changed, so reviewers can focus on the delta. Translation: push one policy into 30+ languages with consistent regulatory terms. Q&A: an in-product assistant answers employee questions on any policy, with the cited source. A human approves every AI output before it ships.

SkillSmith comes with 100+ pre-built framework templates. The major ones are all there - SOC 2, ISO 27001, HIPAA, GDPR, NIST, PCI DSS, FedRAMP, and SOX. So are the newer regulatory frameworks like DORA, NIS2, and CMMC. One control test produces evidence for every applicable framework at once. Custom frameworks are supported through configuration alone, with no code required.

Yes. We migrate everything: your policy library and attestation history, your control library and risk register, your audit findings and CAPA records, plus past vendor records and questionnaires. The historical test results and remediation timelines come with you. Your audit baselines and risk trends stay continuous through the transition. A migration specialist runs the move as part of your onboarding program.

No. SkillSmith is its own platform, built specifically for governance, risk, compliance, and policy work. Nothing underneath it requires a separate license, an admin role on another product, or validation testing whenever that other product ships an update. You get full REST and GraphQL endpoints, the right to export your data into any open format, and configuration freedom that doesn't run into another vendor's package limits. Your IT team integrates however the program needs to.

SOC 2 Type II, ISO 27001, and ISO 27701 certified. GDPR and CCPA compliant. HIPAA-ready configurations for healthcare and life sciences. FedRAMP Moderate for US public sector. Data residency options in the US, EU, UK, Canada, Australia, and APAC. Full audit logs, e-signatures, and immutable history meet 21 CFR Part 11 for FDA-regulated environments. Independent auditors can verify our own controls through our public Trust Center.

60 days for a single business unit. 90 to 120 days for an enterprise rollout across multiple regions. A named implementation lead works alongside your team on framework setup, data migration from your existing tools, integration configuration, and the rollout of policy attestation across your workforce. Pricing is per-user with volume tiers, and the subscription covers every standard connector, every supported framework, and every module on the platform.