Checking a customer file against written criteria is a job for software.
KYC documents, loan files and claim files, checked against the criteria you have written down. The routine checks run on your systems; your reviewers decide the exceptions.
If a file is not done until you have checked it against the criteria…
You open the file, check each document against the written criteria, tick the box and pass it on.
Most files are complete. The incomplete one is why the check exists.
Your board says "do AI". Compliance says "not like that". The routine part of the check is a written rule, so it can run on your own systems, with the evidence your regulator reads, and your reviewers see only the files that fail.
See what reaches your reviewers.
Three invented customer files checked against written criteria. Files that meet them clear on their own; a person gets the rest, with the criterion that failed.
Files checked against written criteria
| File | Document | Written criterion | Check |
|---|---|---|---|
| KYC-0417 | Proof of address | Dated within the last 3 months | Cleared |
| KYC-0418 | Identity document | Not expired | Exception · C2 |
| LN-0207 | Income statement | Required above the lending limit | Exception · C4 |
Sent to your team
What the 30 days look like.
A Proof shows you on your own data: one workflow, run for 30 days beside your current process, for a fixed price. Nothing you run today is switched off.
Pick the workflow.
We scope one workflow with you and agree in writing, on day 5, what it has to get right for you to keep it.
Test it on your own data.
Up to three candidate AI models and one leading hosted model do the same checking on your past customer files, on your systems, which we can read but never change. A leading hosted model is only tested where your data policy allows. If a simple rule does the job, we'll use a rule.
Take the evidence to your leadership.
You get a working workflow, a comparison you can rerun, and a pack showing how it meets the rules in one country or region.
You keep what we built either way.
The data, the rules, the tests and the documents stay yours. The exact terms are at the bottom of this page.
Customer data stays with you. We compare, and we tell you which wins.
Customer files are the data you least want to send out. So the check runs on your systems, and we measure it against a leading hosted AI model only where your data policy allows one.
Hosted AI model (rented)
- Best quality on some hard tasks
- Customer data leaves your environment
- Cost grows with every token (a unit of text the model reads or writes)
- Terms and models change when the vendor decides
- The audit trail sits in someone else's logs
Your own model, on your systems
- Runs in your cloud account, a sovereign cloud in your jurisdiction, or on your own hardware
- You choose when models change, with tests as the evidence
- Every AI dependency has an exit plan
- The evidence pack is written for your regulator
We're vendor-neutral. If a leading hosted model wins on your workflow, we'll tell you. On day 30 you get four numbers for each candidate: accuracy on your own test set, cost per 1,000 tasks, response time for the slowest typical case (p95), and how much data left your jurisdiction. If the hosted model wins, the report says so.
We're preparing an open benchmark of open and regional models against leading hosted models on banking tasks. No results yet.
Tell me when it's outThe rules we map to, by region.
Every Proof includes a pack showing how the workflow meets the rules in one country or region, mapped clause by clause to the rules that apply.
A map, not legal advice. Local counsel checks each pack before its first use in a region.
India
RBI FREE-AI committee report
Its 26 recommendations as an engineering checklist.
SEBI consultation paper on AI and ML use
Oversight and accountability for model output.
DPDP Act and Rules
Consent, purpose, retention and breach-reporting checks across training and inference data.
Australia
APRA's letter to industry on AI
An AI inventory, lifecycle ownership, and human accountability for high-risk decisions.
CPS 230
Where an AI vendor sits in your register. That call is yours and your counsel's.
CPS 234
Information-security controls for the AI assets you hold, including those a third party manages.
Privacy Act
Privacy-policy transparency for automated decisions that significantly affect individuals. Commencement is a question for your counsel.
GCC
UAE PDPL
Transfer and data-subject-rights checks on prompts, retrieval and training data.
Saudi PDPL and SDAIA AI Ethics Principles
The PDPL is law. The SDAIA principles are principles.
DIFC and ADGM data rules
CBUAE guidance note on AI and ML
EU / UK
EU AI Act
Documentation, oversight and logging for high-risk uses.
GDPR / UK GDPR
Lawful basis, DPIA (data protection impact assessment) and automated-decision checks.
DORA
ICT third-party risk mapping that covers your AI providers.
How hard would it be to leave your AI vendor?
Eight questions, five minutes. You get a score, a band and up to three fixes. It runs in your browser and sends nothing unless you book a readout.
Straight answers.
- "We don't want AI. Just automate this."
- We'll take that brief. If a simple rule does the job, we'll use a rule and tell you so. Checking an expiry date or a required document is a rule. A model only reads what rules cannot, such as a free-text note, and your team reviews what it flags.
- "Will my reviewers push back?"
- They stay the ones who decide. They stop re-checking the files that clear and get only the exceptions, each with the criterion it failed.
- "Our files are partly on paper."
- We start with what is already captured: scans, case-management exports, spreadsheets. If part of a file exists only on paper, we tell you on the first call whether getting it readable fits in 30 days.
- You're a small firm. Why trust you with this?
- The offer is built so you carry little risk: fixed scope and a written bar, agreed on day 5. If we don't believe we can clear the bar, we stop on day 7 and you owe nothing more. So the worst case is the kickoff fee and a written account of why it didn't work.
- What do we have if we stop working together?
- It all runs in your environment, and you keep what we built: the data, the test set, the instructions to the model, any model weights (the trained model files) and the documents.
- Do you ever hold our data?
- In a Proof, no. Everything runs in your environment, under your access controls.
- Are open models good enough?
- Sometimes. On some narrow workflows a smaller model running in your environment holds its own; on others it doesn't. Nobody knows which until it's measured on your data. That's what the comparison is for.
Bring us the workflow compliance keeps blocking.
A 30-minute call and six questions. You get green, amber or red, and if it's red we say so and tell you why.
From $30K, fixed scope. Live in 30 days, or you don't pay the balance. 30% at kickoff, 70% only if the bar we agree on day 5 is hit. Terms are set out in each statement of work. You own the data, the rules, the tests and the documents; nothing is locked to us. Exact terms
Regulators and laws are named for reference only. TinyPhi is not affiliated with or endorsed by any regulator.