How AuditPulse Works: The Methodology Behind the 4-Minute AI Compliance Diagnostic.

Why Most AI Compliance Tools Miss the Point

Most compliance tools ask whether you have a policy. AuditPulse asks whether your policy reflects how your AI systems actually operate.

That distinction is the foundation of everything we built.

A company can have a documented AI ethics policy, a published model card, and a signed-off risk assessment - and still have critical regulatory exposure. The reason is almost always the same: the documentation describes an intended state, not an operational one.

AuditPulse was built to surface the gap between the two.

The Four-Axis Scoring Model

Every AuditPulse diagnostic scores your answers across four weighted axes. Each axis reflects a distinct dimension of regulatory exposure.

Data Risk - 35% of total score

The heaviest axis. Uncontrolled data is the primary driver of regulatory liability under every framework we map against. The questions in this axis assess whether your training data is governed, lineage is traceable, and consent architecture is defensible.

A company with clean data governance has a structural advantage in any audit. A company without it has nowhere to hide when a regulator asks for provenance.

Governance Maturity - 30% of total score

Documentation, oversight mechanisms, and process maturity. This axis assesses whether your organisation has the structures in place to demonstrate control - not just claim it. Human-in-the-loop oversight, explainability capability, and incident response planning are the core signals here.

Operational Risk - 20% of total score

Deployment scale, evaluation cadence, and bias detection practices. This axis captures how much risk your AI systems are generating in production and whether you have the monitoring infrastructure to detect it.

Regulatory Exposure - 15% of total score

Jurisdiction, data type, and certification status. This axis determines which frameworks apply to your specific situation and at what penalty level. A company with EU users faces different exposure than one without. A company processing health data faces different obligations than one that does not.

The Recency Multiplier

One of the most distinctive elements of the AuditPulse model is the recency multiplier.

Compliance scores decay over time even when nothing changes internally.

Three forces drive this decay:

Regulatory updates add new requirements. What satisfied an auditor in December 2025 may not satisfy one in April 2026 after three sets of EU AI Act implementation guidance were published in Q1.

Guidance clarification changes interpretation. Abstract requirements become concrete when regulators publish enforcement guidance. A requirement that seemed theoretical becomes a specific obligation with a specific standard.

Precedent shifts expectations. When regulators take action against companies for specific gaps those gaps become higher priority for every company in the same category.

The recency multiplier is applied when a company's last formal AI risk assessment was more than 12 months ago. It reflects the regulatory reality: an outdated assessment does not demonstrate ongoing compliance. It demonstrates that you were compliant at a point in time that may no longer be relevant.

The Seven Diagnostic Questions

The standard AuditPulse diagnostic uses seven questions. Each maps to a specific regulatory article and a specific axis in the scoring model.

The questions were selected through a process of identifying the controls that appear most consistently in regulatory enforcement actions, enterprise procurement requirements, and investor due diligence requests.

They are not exhaustive. They are diagnostic. The goal is not to map every possible compliance requirement - it is to identify the gaps that create the most material exposure in the shortest possible time.

Q1 - Training Data Governance Maps to EU AI Act Article 10. Assesses whether training datasets are free of uncontrolled PII and copyright exposure. The highest weight question in the data risk axis.

Q2 - Data Lineage Maps to ISO 42001:2023 Section 8.4 and SOC 2 CC6.1. Assesses whether an immutable record of data provenance exists for the core inference model.

Q3 - Human Oversight Maps to EU AI Act Article 14 and NIST AI RMF GOVERN 1.2. Assesses whether human-in-the-loop oversight exists for high-risk automated decisions. One of the most commonly flagged gaps in our diagnostics.

Q4 - Bias Detection Maps to NIST RMF MAP 2.1 and EU AI Act Article 9(7). Assesses whether bias detection thresholds are enforced before deploying new model weights.

Q5 - Explainability Maps to EU AI Act Article 13. Assesses whether the system can automatically explain the rationale behind AI-driven decisions to end users.

Q6 - Risk Assessment Recency Maps to SOC 2 CC7.3. This question is inverted - a YES answer indicates a gap. If more than 12 months have passed since the last formal AI risk assessment the recency multiplier is applied.

Q7 - Infrastructure Certification Maps to SOC 2 CC7. Assesses whether infrastructure is certified against SOC 2 Type II or ISO 42001. Certification is the baseline credentialing that enterprise customers and investors expect.

What the Report Contains

The AuditPulse report is not a summary. It is a structured compliance document designed to be presented to a board, attached to an investor data room, or submitted in response to an enterprise procurement request.

Every finding includes a specific regulatory citation - not a general framework reference but an exact article number. Every Critical finding includes a regulatory exposure estimate in USD and EUR.

The remediation roadmap is prioritised by effort and regulatory impact. The goal is not to list everything that could be improved - it is to tell you what to fix first and why it matters.

The report is delivered as a branded PDF within four minutes of payment. It includes a unique reference number and generation date so it can be cited as a dated assessment in any governance context.

Why Four Minutes

The four-minute delivery time is not a marketing claim. It is a function of the architecture.

The diagnostic answers are passed to Claude Sonnet via the Anthropic API with the full question context and regulatory mapping. The model returns a structured JSON object containing findings, scores, and remediation steps. The PDF builder renders the report and Resend delivers it to the customer's inbox.

The entire pipeline runs in under five minutes in normal conditions.

Speed matters because the alternative is weeks. A compliance consultant takes weeks to schedule, weeks to assess, and weeks to deliver. AuditPulse delivers a structured, citable, board-ready document before the meeting that triggered the question is over.

The Difference Between Information and Evidence

A conversation with an AI gives you information. AuditPulse gives you evidence.

When a regulator asks how you assessed your AI compliance posture you cannot show them a chat transcript. You can show them an AuditPulse report with a reference number, a methodology citation, a dated assessment, and a signed-off remediation roadmap.

That is the difference between knowing where you stand and being able to prove it.