Governance as infrastructure: building COMPAP.

A policy proves intention. It does not prove the control is owned, working or evidenced. COMPAP is RCDEN's developing internal assurance map, built to connect each obligation to the person, control, evidence and decision that make it real.

Policies are the start—not the operating system

COMPAP is an internal compliance and assurance system designed around controls rather than check-boxes. A control can carry an identifier, objective, target state, owner, review route and evidence reference. Completion means the evidence supports the required outcome—not simply that somebody clicked “done”.

The developing system is intended to bring together areas such as export controls, cybersecurity, data protection, health and safety, environmental responsibilities, product safety, supplier assurance, contract obligations and document control. The goal is not to collapse different legal regimes into one score. It is to give each obligation a consistent operational home.

Keep the map; control the evidence

COMPAP is designed to operate metadata-first by default. It can record what evidence exists, where an authorised person can find it, when it was reviewed and how its integrity is checked without turning the hub into an uncontrolled copy of every sensitive file.

That separation matters in defence work. Classification, export control, customer restrictions and need-to-know rules still govern the underlying material. A convenient interface must never become a reason to move information into the wrong environment.

People-first principle

Capable people become more capable with AI. AI is not the capable person—and it does not own the judgement, accountability or consequence.

AI as navigator, never authority

As the controlled knowledge base grows, RCDEN plans to add an internal company AI that helps authorised staff navigate it. The intended role is practical: surface relevant obligations, explain relationships, locate approved evidence and suggest the next question a person should consider.

It will not be a public release, an autonomous compliance officer or a mechanism for replacing employees. Authority will remain with named people, access will remain permissioned and important decisions will remain reviewable.

Built to scale judgement—not replace it

Building the hub internally allows its vocabulary and controls to develop alongside RCDEN’s real work. That creates a durable company capability: less time searching across disconnected records, stronger continuity as the team grows and a clearer path from commitment to evidence.