Every Other ISO Consultancy Now Has a Compliance Platform. Here’s What That Means for Your Certification

Over the past year I have lost count of the ISO consultancies, here and overseas, that have launched their own compliance platform. Most promise to do for small businesses what Vanta did for software companies: automate the evidence, track the controls and get you certified faster. AI coding tools mean a capable consultant can now build one in weeks.

I know, because I built one too. It was called Conformiti: a full platform with separate portals for the client, the compliance team, the certification body, the auditor and the consultant, plus an admin layer. We demonstrated it in May 2026. In October I decided not to launch it. The market is real, but so are the problems, and they land on both sides of the contract. This article sets out what I learned, for anyone being pitched a platform and for anyone thinking of building one.

Short answer

• For clients: a compliance platform becomes one of your most critical suppliers. It holds your whole management system, your audit evidence and a good deal of commercial and personal information. Assess it the way ISO 27001 says to assess any critical supplier.
• For providers: building is now the easy part. Supporting every client indefinitely, keeping the platform secure, updating it every time a standard changes and reaching enough clients to pay for all of it is the hard part.
• The market problem: when every consultancy pitches its own platform, the referral partners that used to carry a product to critical mass disappear.
• The alternative: much of what these platforms do is already in the office suite you pay for, whether that is Microsoft 365 or Google Workspace. That is one less platform holding your commercial and personal data.

Why there are suddenly so many platforms

Two things changed. First, the market proved itself. Vanta raised US$150 million in July 2025 at a US$4.15 billion valuation, with more than 12,000 customers in 58 countries. Second, AI coding tools collapsed the cost of building software. Work that once needed a development team can now be prompted into existence by one person, an approach that has become known as vibe coding.

Put those together and the logic for a consultancy is obvious: you already know the standards and the clients, so why not productise it? That is exactly how I started. What vibe coding lowers is the cost of the first version. It does nothing for the cost of the next five years.

The risks for the client

It becomes one of your most critical suppliers

A compliance platform holds your risk register, your policies, your incident records, your audit findings, your supplier list and often your staff training records. For an ISO 27001 system it holds the map of your weaknesses. Under Annex A controls 5.19 to 5.22 that makes it a supplier to assess and monitor, and under 5.23 a cloud service whose use you are expected to manage. It is worth checking that it actually appears on your supplier register, with an owner and a review date. Our article on supplier data breaches explains why that matters.

How was it built, and who checked?

AI-written code has a known security problem. Veracode’s 2025 GenAI Code Security Report found AI-generated code introduced security flaws in 45% of the tasks it tested across more than 100 models, and its 2026 update found the pass rate had barely moved. In May 2026, security firm RedAccess reported about 5,000 publicly reachable apps built on popular vibe-coding platforms exposing sensitive data, including medical records and internal financials. The platform providers disputed parts of the findings, but the pattern is familiar to anyone who audits software.

None of that means a consultancy’s platform is insecure. It means you are entitled to evidence: an independent certification such as ISO 27001 or a SOC 2 report covering the platform itself, a recent penetration test, and a clear answer on where your data is hosted.

Will it still be there in three years?

A platform built by a small consultancy depends on that consultancy’s client numbers. If it does not reach enough paying clients, it will be repriced, sold or quietly stopped. Before you load your management system into it, find out how you get it all back out in a usable form, and what happens to your records when the contract ends.

Standards keep changing

ISO 9001:2026 and ISO 14001:2026 have both been published, ISO 19011 was revised the same year, and ISO 45001 is still under revision. Every change means new templates, new clause mapping and new prompts in the platform. Ask who does that work, how quickly, and whether it is included in what you pay.

A platform is not a system people run

Certification auditors test whether the system is implemented, not whether the software is tidy. Platforms that generate policies and procedures in an afternoon produce the generic, look-alike documentation that auditors recognise quickly. I cover the same problem with AI-written systems in building an ISO system with AI. The work that makes certification stick is still deciding how your business actually runs and writing that down.

Watch for the conflict of interest

When the consultant who designs your system also sells the platform it runs on, their advice on whether the platform is worth having is not independent. That is not a reason to refuse, but it is a reason to ask what the system would look like without it.

The risks for the provider, from someone who built one

This is the part that decided it for me. Building Conformiti was the straightforward bit. What follows a launch is not:

• Support never ends. Every client you onboard is relying on the platform for their certification. You cannot walk away from them, and you cannot stop maintaining it because the next client is slow to arrive.
• You have to be secure, and prove it. A platform that holds clients’ ISO 27001 evidence will be asked for its own ISO 27001 certification or SOC 2 report, penetration testing, incident response and data residency answers. That is a management system and an audit cycle of its own.
• Liability moves to you. If the platform loses data, misses a reminder that leads to a lapsed licence, or maps a clause wrongly, the client’s problem becomes yours.
• The standards move under you. Every revision is unpaid development work across the whole product.
• The channel has gone. Software like this used to reach critical mass through referral partners: consultancies recommended a product they did not own. Now that most consultancies are pitching their own, nobody is referring anyone else’s, and each platform is limited to its owner’s client list. For most, that is not enough clients to fund the development and support a platform needs to survive.

In the end, the open-ended support commitment and a market crowded with consultant-built products decided it. The demand is there. The economics of serving it from a consultancy are much harder than they look.

What you probably already own

Most of the functionality in these platforms already exists in the office suite your business already pays for. Most Australian businesses run Microsoft 365 or Google Workspace, and both cover the core of a management system:

Which features are included depends on your Microsoft 365 plan or Google Workspace edition. Check your licences before planning around a specific feature.

The advantage is not only cost. Your records stay inside your own Microsoft or Google environment, under the access controls, multi-factor authentication and retention settings you already manage, with a provider that holds its own independent security certifications, including ISO/IEC 27001. That is one less third party holding your commercial and personal information, one less supplier to assess, and no exit problem if a vendor folds.

The tools do not build the system for you. Registers and automations still need designing around how your business works, and that design is where a management system succeeds or fails, whichever software it sits in.

The third option: use AI yourself

Buying a consultant’s platform is not the only way to get the benefit of AI. The same tools that let consultancies build platforms are available to you. Two approaches work well:

• Connect AI to the systems you already run. Many businesses already have a safety, quality or document platform that their people use every day. Connecting an AI assistant to it can do much of what a new platform promises, without moving your records anywhere. I have seen Claude connected to SiteDocs work very well: drafting from existing records, finding gaps and pulling evidence together, inside a system the site teams already know.
• Build your own, for your business only. A business with capable in-house people can use AI to build its own registers, workflows and dashboards, often on Microsoft 365 or Google Workspace. Because it serves one organisation rather than hundreds, the support, security and maintenance burden is far smaller than a commercial product’s, and you decide when it changes.

Either way, the AI tool becomes part of your information systems. Decide what data it can see, what it can change on its own and who checks its output, and add it to your asset and supplier registers. That is what ISO 42001 is for, and our article on four questions to ask before you let an AI agent loose is a practical starting point.

There is no single right answer. The best option for each business depends on its size, the scope of its management system, the information systems it already runs and the people it has to look after them. A ten-person contractor already living in SiteDocs, a professional services firm on Microsoft 365 or Google Workspace and a software company chasing SOC 2 will each land somewhere different, and that is a decision worth making deliberately rather than by whichever platform was pitched first.

Questions to ask before you sign up to any compliance platform

1. Does the platform itself hold an independent certification, such as ISO 27001 or a SOC 2 report, and can I see it?
2. Where is my data hosted, who can access it, and is any of it used to train AI models?
3. How do I export everything, in what format, and what happens to my data when the contract ends?
4. How many organisations use the platform today, and who supports it if the person who built it leaves?
5. Who updates it when a standard changes, how quickly, and is that included in the price?
6. Which of these functions could we run in Microsoft 365 or Google Workspace, which we already pay for, or by connecting AI to a system we already use?
7. If my consultant supplies the platform, what would their recommendation be without it?
8. Is the platform listed on our supplier register, with an owner and a review date?

Compliance software: FAQs

Are compliance automation platforms worth it?

They can be, particularly for software companies that need SOC 2 or ISO 27001 evidence collected from cloud systems at scale. For many small and mid-sized businesses, the same registers, reminders and dashboards can be built in Microsoft 365 or Google Workspace, without adding another supplier that holds sensitive records.

Can Microsoft 365 or Google Workspace be used to run an ISO management system?

Yes. In Microsoft 365, Lists can hold the registers, SharePoint can manage controlled documents, Forms can capture inspections and incidents, Power Automate can send reminders and Power BI can report to management review. In Google Workspace, Sheets, shared drives, Forms, AppSheet and Looker Studio do the same jobs. Certification auditors assess whether the system works, not which software it runs on.

Will a certification auditor accept a system run in Microsoft Lists or Google Sheets?

Yes, provided the records are complete, controlled and show the system is implemented. Auditors look for evidence that processes are followed, reviewed and improved. The software is not a requirement of any ISO standard.

What should I check if my consultant offers their own platform?

Ask for the platform’s own security certification, how you export your data, how many organisations use it, who updates it when standards change, and what the system would look like without it. Then add it to your supplier register like any other critical supplier.

How Streamline can help

Streamline does not sell software. Our ISO mentoring service guides your own people to build and certify a management system in the tools you already use, usually Microsoft 365 or Google Workspace, so the system and the data stay yours. If you would rather hand it over, our outsourced ISO manager service runs it for you. If you are already on a compliance platform, an internal audit can test whether the system behind it would stand up to certification, and whether the platform itself has been assessed as a supplier. Get in touch to talk it through.

Sources: SecurityWeek, Vanta raises $150 million at $4.15 billion valuation (24 July 2025); Veracode, 2025 GenAI Code Security Report (July 2025); coverage of Veracode’s July 2026 update; Axios on RedAccess research (7 May 2026).