Boring? Think Again. Your Compliance Roadmap Could Be Your Biggest Differentiator

Yass Omar

Head of Legal and Regulatory AffairsSeptember 1, 202621 min read

What we’re seeing today is only the tip of the iceberg of how pervasive AI technology will become in our lives and world at large. This means more and more products & services will emerge, using AI, to handle sensitive data & information, from our health records to our banking transactions. There are no signs of this development slowing down, with the market for AI in Healthcare alone set to be around $173 billion dollars by 2029. There has never been as a good time as now to familiarise yourself and your organisation into compliance frameworks and best practises needed, to ensure that you really mean when you tell stakeholders, ‘we really care about data privacy and security’.

The process can often be summarised best via a compliance roadmap. At a high-level, a compliance roadmap is an outlay of the various certifications, and their respective timelines by which your company needs to attain to deliver on business goals and operations. It serves as a guide for ensuring that all necessary compliance measures are implemented and maintained, helping companies mitigate risks and ensure ongoing adherence to legal obligations.

At the end of 2023, we at Heidi made a conscious decision to make compliance a priority. Through the development of our comprehensive compliance roadmap, and through internal dedication and strategic focus, we successfully achieved compliance with GDPR, HIPAA, ISO 27001:2022, and SOC 2 within a span of just 10 months. In this blog post, I’ll aim to provide some high-level guidance to organizations to understand how to effectively prioritize their compliance roadmap, offering insights from our own journey at Heidi.

Start practicing with a partner

Care is better with Heidi

For some businesses with the extra reserves, there are options to outsource the admin process of getting certifications done, using verifiable auditors and third-party specialists. These often come with a higher cost but can remove some of the guesswork and complexity involved if you lack the expertise in-house.
There are ways to get some certifications with lower barriers of entry, which includes a large portion of self-learning to ensure it is executed well.
These include an attestation, self-assessment, and ‘Quick Win’ certifications we discussed above. Deciding which style of certification depends on where your core market is and what is the bare minimum certification required.
For attestations, it is recommended to only use it if you are starting slow, and as a lily-pad towards affording a full certification conducted by a third-party
Self-assessments can be not as competitive as other forms of low-cost certifications and if this is the path being taken, Cyber Essentials would be a great place to start, with Cyber Essentials Plus being even more favourable. These certifications can be completed on their website for just a couple of hundred pounds
Heidi went through a similar process of starting with small certifications to then build up to bigger ones as we acquired reserves in our budget. We recommend to other businesses to start small and continue building the resources to do more, add as many of the basic certifications you can until your business is ready to need more.
This continuous process of acquiring certificates whilst building the business is essential to keep client-leads warm; some clients may only wish to engage with your business once certain data privacy and security milestones have been attained
This puts you on the front-foot to say these certifications are pending, making it easier to re-engage them further down the line. This is as opposed to letting them grow cold because of being unable to affirm if you’ll be compliant within a reasonable timeline.

Regulatory Landscape: Understanding the ever-changing regulatory requirements in your industry.
Client Requirements: Tailoring your roadmap to meet the specific compliance demands of your key clients.
Risk Management: Identifying and mitigating risks associated with non-compliance or delayed certification. See Uber’s $295 million dollar fine from the EU over their GDPR non-compliance which most companies would not survive. There is always a huge risk of being non-compliant and continuing operations in any given market; thinking of these risks will give you leverage to push-back against pressure from leadership & sales to drive growth for the sake of it, and instead do so from a more considered vantage-point.
Technology and Tools: Leveraging compliance management platforms and tools to streamline certification processes. Some great ones to recommend & start with are Vanta or Drata.
Foster positive relationships with third-party auditors: These are the independent teams who’ll help you get prepared for the external audits by conducting internal audits where they can highlight blind spots, go over interview questions, and guarantee you get that certification. While external auditors often have a need to remain impartial and not disclose if you are falling short of passing their tests; the internal auditors can be candid with you about this and so it’s best to seek a long-term relationship with them.
Seek strong, ongoing relationships with external auditors: When undertaking an audit for a certification, there’s a lot that can go wrong and grey areas that can make a difference between a pass or fail, benefitting from investing thousands of dollars or watching it all go down the drain. Especially when the challenge of multiple certification audits becomes frustrating, it's important to not take the situation out on people, most especially your external auditors who are just trying to do their job (and who can also make your life awful!). Remember to be kind and engage with all parties in as positive a manner as possible!
Internal Stakeholders: Engaging key stakeholders (e.g., Legal, IT, Operations) early in the process. It is best to be realistic about the compliance roadmap and not let it be thrusted upon your business’ broader to-do list, causing you to potentially even must re-do your product strategy from scratch. Even the smallest product decision can make you non-compliant
Continuous Improvement: Ensuring your compliance roadmap is a living document, regularly updated to reflect new challenges and opportunities.