Legal & Compliance. AI Checks on Supplier Legal Documents.

What it does

Legal & Compliance is what happens when you point a structured AI pipeline at every UK company’s public footprint, privacy policies, cookie banners, sub-processor lists, terms of service, modern-slavery statements, beneficial-ownership disclosures, and ask it the same question every procurement and DPO team has to ask manually today: is this partner actually compliant, and is the evidence current?

The answer is delivered as a single A–F grade per company, with the eighteen underlying compliance checks attached as an evidence pack. It’s the layer above your KYC stack and the layer below your legal-review pipeline.

This is a “show what you can do with the data” product, proof that the same iXBRL stream that powers the Pulse can power a much wider surface than financial signalling.

Powering Smallprint.legal

The same engine runs the compliance checks on Smallprint.legal, home to more than 300 legal checking tools and deadlines. Smallprint.legal puts the checks in front of the people who need them day to day; Archive Partners delivers them by API, alert or regular file for teams that want them inside their own procurement, legal and risk workflows.

What the AI is reading

For every active UK company, the engine ingests:

• The company’s public website — including the privacy policy, cookie banner, terms of service, sub-processor list, contact page, and any modern-slavery statement linked from the footer.
• The Companies House filing trail — directors’ report disclosures, audit qualifications, going-concern statements, beneficial-ownership filings.
• The web-archive timestamps — when each policy document was last meaningfully updated, against what regulatory baseline.

The AI then runs eighteen named checks against the population, split across web posture, iXBRL filings, and 2026 UK transparency-standard alignment, and rolls the result into a single letter grade.

What you actually get back

A Legal & Compliance audit ships in three layers:

1. The grade — a single letter, A through F, per company. Designed to slot into a procurement gating rule, a vendor scorecard, or a Slack alert without further transformation.
2. The evidence pack — for every check that contributed to the grade, the engine captures a screenshot, a web-archive reference, and (where applicable) the Companies House filing reference. If your DPO needs to justify the grade in a regulator’s audit, the trail is there.
3. The watchlist feed — once a company is on your Legal & Compliance watchlist, the grade re-runs continuously. The moment a privacy policy goes stale, a cookie banner regresses, or an audit qualification appears in a new filing, the grade drops and the change shows up on your dashboard.

The grade is opinionated by design. We don’t publish a 60-row spreadsheet of partial scores; we publish an A through F with the reasoning attached. Procurement teams want the verdict; the evidence is there for the cases that warrant a closer look.

Where AI matters

The temptation with public-document scanning is to build a regex pipeline and call it done. We tried that. It misses too much:

• Stale policies that look current. A 2022 privacy policy that copied the latest GDPR template still parses as compliant on a regex pass. The AI catches the version-marker mismatch.
• Cookie banners that look compliant. IAB TCF v2.2 conformance is a behavioural test, not a string match. The AI runs the actual consent flow and flags pre-consent tracker firings.
• DPO disclosures buried in PDFs. Many UK firms publish their DPO contact in a downloadable PDF, not the HTML page. The AI reads the PDFs.
• Sub-processor lists scattered across pages. Legitimate sub-processor disclosures span half a dozen URLs on most enterprise sites. The AI clusters them into a single evidence record.

The grade is the AI’s verdict on the full picture, not a pattern-match.

Where it fits

• Procurement onboarding — gate prospective suppliers at the Legal & Compliance grade before legal review. Most teams set a B-or-above threshold for new vendors and a D-and-above threshold for existing low-value contracts.
• DPO and AML triage — the grade is a clean first-pass filter before you commit your legal team’s hours. The bottom decile (E and F grades) usually correlate with the structures-of-interest population.
• M&A target screening — Mailbox-grade compliance posture (no DPO, expired policies, no transparency disclosures) is a common red flag in mid-market UK private targets. Filtering at the top of funnel removes ~10% of false-positive matches.
• Insurance and credit underwriting — the grade correlates measurably with downstream filing-cadence reliability and director-resignation patterns. Underwriters use it as an orthogonal signal to the bureau models.

What it is not

• It is not a legal opinion. A grade does not constitute legal advice or warrant compliance to any specific regulation. It is a structured opinion, machine-graded, with the evidence trail attached for legal review.
• It is not a substitute for KYC. KYC tells you who the directors are. Legal & Compliance tells you whether the public-facing compliance surface matches what a counterparty claims.
• It is not adversarial. We don’t publish league tables or shame any specific company. The grade is delivered privately to the requesting party against a single named partner list. It is built to inform procurement decisions, not to start fights.