Owner: Account Lead
Contributors: Head of Delivery (HoD) — technical oversight + escalation ·
AI Compliance Specialist (AIc) — delivery · PM — project coordination ·
CEO — mandatory sign-off on Compliance Assessment Report
Department: D4 — Delivery
Entity: PrivateAI
Status: v0.9 · Reviewing
Version: 0.9 | Last updated: 2026-07-18
What this workflow does: Governs the full lifecycle of an AIc (AI Compliance
Specialist) engagement — from the mandatory Compliance Assessment Report through
CEO-approved implementation planning, phased compliance delivery, validation, and
formal handover.
What triggers it: Signed AIc placement confirmed (DEL-05 complete) and CS-01c
(AI Project Client Onboarding) complete. Payment confirmed (Gate G2). The
Compliance Assessment Report (DEL-04-DOC-01) is the first deliverable of every
AIc engagement — no implementation work begins without it.
What it produces: A fully implemented compliance framework — assessed, planned,
built, validated, and handed over — with a CEO-signed Compliance Assessment Report,
a completed Compliance Implementation Plan, monthly Compliance Status Reports, and
a final handover package.
Why it matters: AIc engagements carry the highest client risk of any REMAP.ai
product — regulatory exposure, data sovereignty, and contractual compliance
obligations are at stake. Every step in this workflow is structured to protect the
client and PrivateAI from compliance gaps and to produce auditable evidence of
the work done.
⚠️ CEO involved — mandatory. CEO signs off on the Compliance Assessment Report
(DEL-04-DOC-01) before any implementation work begins. This is a hard gate on
every AIc engagement without exception.
| Role | Department | Responsibility | CEO? |
|---|---|---|---|
| Account Lead | D4 | Sole accountable owner — client relationship, delivery health, escalation handling, monthly reviews | No |
| HoD | D4 | Technical oversight — reviews CAR and implementation plan before CEO sign-off · escalation authority | No |
| AIc Specialist | D4 | Delivers all compliance assessment, gap analysis, implementation, and validation work | No |
| PM | D4 | Project coordination, Jira board management, status reporting, client comms support | No |
| CEO | D6 | Mandatory sign-off on DEL-04-DOC-01 (CAR) before implementation begins — hard gate | Yes |
| Framework | Jurisdiction | Notes |
|---|---|---|
| ISO 27001 / 27701 | Global | Information security + privacy management |
| GDPR | EU / UK | Data protection and privacy |
| HIPAA | US | Healthcare data protection |
| SOC 2 | US | Service organisation controls |
| Essential Eight | AU | Australian Signals Directorate cybersecurity framework |
| MAS TRM / PDPA | Singapore | Monetary Authority tech risk management + Personal Data Protection Act |
Frameworks in scope for each engagement are confirmed in the signed SOF and
reflected in the Compliance Assessment Report.
Step 1 — Kickoff and data gathering
Step 2 — Current state assessment and gap analysis
Step 3 — HoD review of CAR
Step 4 — CEO sign-off on CAR ⚠️ Hard gate
Step 5 — Present CAR to client
Step 6 — Build Compliance Implementation Plan (DEL-04-DOC-02)
Step 7 — Client approval of Implementation Plan
Step 8 — Phase execution (per implementation phase)
Step 9 — Monthly Compliance Status Report (DEL-04-DOC-03)
Step 10 — Update client health scorecard (CS-05-DOC-01)
Step 11 — Compliance validation and evidence collection
Step 12 — Compliance readiness confirmation
Step 13 — Produce handover package
Step 14 — Handover session with client
Step 15 — Trigger CS-04 and knowledge capture
| Tool | How it's used | Agent-ready |
|---|---|---|
| Jira | Full project board — phases, tasks, blockers, evidence tracking | Yes — confirmed |
| Google Workspace | CAR (DOC-01), Implementation Plan (DOC-02), Status Reports (DOC-03), evidence package, handover package | Yes — API + MCP |
| Google Meet | All client calls — kickoff, status, validation, handover | Yes |
| AWS | Technical control implementation where infrastructure changes are required | Yes — confirmed |
| n8n | Automation controls where applicable to the compliance framework | Yes — native |
| Documeso | CEO sign-off on CAR (or email confirmation alternative) | Yes — API |
| CS-05-DOC-01 | Client Health Scorecard — updated throughout engagement | Yes — API + MCP |
| Wiki.js | DEL-07-DOC-01 Knowledge Base — knowledge entry at close | Yes — native |
CAR review and sign-off (Steps 3–4)
| Step | Condition | Action | Owner |
|---|---|---|---|
| HoD review (Step 3) | Approved → CEO sign-off · Changes → revise and resubmit | HoD | |
| CEO sign-off (Step 4) ⚠️ | Approved → Phase 2 · Changes → revise → HoD → CEO | CEO |
Implementation plan client approval (Step 7)
| Condition | Action | Owner |
|---|---|---|
| Approved | Proceed to Phase 3 | Account Lead |
| Changes requested | AIc + PM assess impact · revised plan presented | Account Lead |
Phase execution blocker (Step 8)
| Blocker type | Action | Owner |
|---|---|---|
| Technical | PM escalates to HoD | HoD resolves |
| Client-side | Account Lead engages client directly | Account Lead |
| Regulatory ambiguity | AIc documents position · HoD reviews · external legal if material | HoD → Legal Lead |
Gap disposition at validation (Step 12)
| Condition | Action | Owner |
|---|---|---|
| All gaps addressed | Client sign-off → Phase 5 | Account Lead |
| Outstanding gaps | Client risk-accepts in writing → note in handover | Account Lead |
| Scenario | How to handle | Escalation |
|---|---|---|
| CEO unavailable for CAR sign-off | No implementation begins. Flag as critical blocker at next L10. | Direct escalation to CEO — no substitute |
| Client requests scope expansion mid-engagement | PM assesses impact. Account Lead presents additional SOF. HoD confirms feasibility. | Account Lead → HoD |
| Regulatory ambiguity — framework interpretation unclear | AIc documents the interpretation taken. HoD reviews. Legal Lead consulted if material legal risk. | HoD → Legal Lead |
| Client fails to complete required actions on their side | PM flags as Amber. Account Lead engages. Engagement timeline adjusted if delay is client-caused. | Account Lead → HoD if unresolved >5 days |
| Evidence gap found during validation | AIc implements compensating control or documents risk-acceptance. HoD approves approach. | HoD |
| Client refuses to sign compliance readiness confirmation | Account Lead and HoD assess. Formal position paper produced. CEO informed. | HoD → CEO |
| Metric | Type | Target |
|---|---|---|
| Compliance Assessment Report delivered on time (%) | Process | 100% per agreed SOF timeline |
| CEO sign-off on CAR obtained before implementation begins (%) | Process | 100% — hard gate |
| Compliance framework coverage achieved (%) | Leading | 100% per SOF scope |
| Monthly Compliance Status Report sent within 5 business days (%) | Process | 100% |
| All identified gaps closed or formally risk-accepted at handover (%) | Lagging | 100% |
| Knowledge base entry filed within 5 days of engagement close (%) | Process | 100% |
| Step | Current state | Suggested automation | Tool | Effort |
|---|---|---|---|---|
| Step 9 — Monthly status report | Manual | n8n monthly trigger → compile Jira phase completion data → draft status report → Account Lead reviews + sends | n8n + Jira | Medium |
| Step 10 — Health scorecard update | Manual | n8n trigger after logged client interaction → reminder to Account Lead to update CS-05-DOC-01 | n8n | Low |
| Step 15 — CS-04 trigger | Manual | n8n: handover confirmation filed → auto-notify Zimal via Discord | n8n + Discord | Low |
| Step 11 — Evidence collection | Manual | n8n auto-collects system logs and configuration exports where API access is available | n8n + client APIs | High |
Upstream:
Downstream:
| Version | Date | Description | Author |
|---|---|---|---|
| 0.9 | 2026-07-18 | Initial draft — 5-phase AIc delivery lifecycle (assessment, planning, implementation, validation, handover), CEO mandatory gate on CAR, compliance frameworks supported (ISO 27001/27701, GDPR, HIPAA, SOC2, Essential Eight, MAS TRM/PDPA), monthly status reporting. | Hamza Tasneem (HoD) |