AuditBadger: AI Drafts Compliance Policies — You Approve

I spent the better part of a year building AuditBadger, a compliance management platform that leans on AI to handle the heavy lifting of policy drafting for SOC 2 and ISO 27001. The core idea is straightforward: templates encode the baseline requirements, and the AI rewrites controls and trust service criteria to fit your company's actual context. Beyond that, it helps you map out your own controls, runs an initial risk assessment, and even generates a business continuity plan skeleton so you can see what the process is supposed to look like.

Here is what made this a genuinely different experience for me. Last year I almost posted something similar, but the feedback at the time centered on a missing piece — a proper SOC 2 report. That stuck with me. I decided to put the tool through its paces and earn both SOC 2 Type I and SOC 2 Type II using AuditBadger as the backbone. The journey was not instant; it required absorbing the SOC 2 nuances, learning the common gotchas, and building out automatic evidence collection. But the fact that a single platform could carry me from zero to a Type II report is the part that still surprises me.

On the roadmap, European AI Act and NIS 2 support are going live soon. HIPAA is already integrated, though I keep it off by default and flip it on for customers who explicitly want to test it. CyberEssentials and ENS are planned for later this year. The platform itself is feature-complete at this point, and my co-founder — an ISO 27001 Lead Auditor — and I still run our own work through it every day.

Most of the early adopters joined our Slack workspace, and that has become a surprisingly valuable loop. When someone gets stuck on a particular control or a risk-assessment edge case, we help them troubleshoot in real time. It is the kind of feedback that only comes from actually using the tool yourself, and it keeps shaping what we build next.

If you are running a startup or small team that needs to tackle SOC 2 or ISO 27001 without hiring a full-time compliance person, this might be worth a look. I am happy to walk through anything — the AI drafting logic, the evidence-collection pipeline, or how we handled the Type II evidence requirements.