In 2026, every GRC platform has to market AI features. Only a few of them are truly useful. SecTepe.Core has three AI building blocks that have proven their worth in practice. There is also one clear line where we choose not to use AI.
1. Policy Drafts That Fit Your Context
A wizard step asks about 10 questions: industry, size, cloud use, and regulatory context. From the answers, an LLM writes a full policy draft that is already tailored to your organization. Three things matter here:
- Templates as a base: the LLM adds to and refines templates. It does not write from scratch. This cuts the risk of hallucinations a lot.
- Compliance anchors: each paragraph is linked to the requirements it covers (ISO 27001 A.X.Y, BSI building block Z). The auditor sees the purpose at once.
- Approval workflow: each draft needs human approval. Nothing goes live on its own.
2. Audit Assistant With Retrieval (RAG)
During an audit, the auditor asks questions like "How do you document your supplier security checks?". The RAG assistant searches your own ISMS by meaning. That covers policies, procedures, and evidence. It gives a direct answer and cites its sources. This beats a plain LLM answer in three ways:
- Answers are based on your real documents, not on training data.
- The sources are shown too, so the auditor and the compliance officer can check them.
- It works across frameworks: the same question draws on a different pool of evidence, based on the active framework.
3. Threat Models Based on STRIDE
For a new system, such as a new API or a new cloud service, the LLM writes a first draft of a STRIDE threat model. STRIDE stands for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. The architect or security engineer reviews the draft, adds to it, and drops what does not fit. In 30 minutes, they have what would have taken two half-day workshops.
Where We Choose Not to Use AI
- Risk rating: an LLM never scores a risk on its own. Rating a risk is a conscious management choice, and someone has to own the decision to accept it. "The AI says it's 7/10" is not enough.
- Audit sign-off: no LLM may set a compliance status. A human signs off. The LLM only helps with the prep work.
- Incident classification: critical calls (such as "must this be reported under NIS-2, yes or no?") follow fixed rules with a clear audit trail. An LLM does not make them.
Data Protection: What Happens to the Content?
All AI requests run through IONOS AI in German data centers, with no US provider involved. For strictly isolated environments, an on-prem option with a local model is available. Then the data never leaves your own infrastructure.
What to Expect
AI makes compliance faster, not better. A generated policy is not "done". It is a good first draft that a human with domain knowledge still has to sharpen. A RAG assistant does not replace a compliance officer. But it turns research that takes 30 minutes into an answer in 30 seconds.
Conclusion
AI in compliance work is valuable when it is meant to speed things up, with a human who approves. It is dangerous when it is sold as a stand-in for human decisions. SecTepe.Core holds this line every time. Where AI helps, it saves a measurable number of hours in each compliance cycle.