ChatGPT Prompts for Compliance: 12 for Policies and Audits

ChatGPT prompts for compliance help you organize the work around a rule: gap lists, control checklists, policy drafts, evidence requests, and training outlines. Paste the obligations exactly as the rule or your counsel lists them, plus your real policies and proof, and ask ChatGPT to quote its sources and mark what is missing. The 12 prompts below are drafting aids for compliance teams and small businesses, not legal advice; counsel makes the final calls.

Find the gaps

1. Gap list against a rule

Here are the obligations from [rule and citation] [paste] and our policy text [paste]. For each obligation, mark Met, Partial, Missing, or Unclear, quote the policy line, and state the gap in one sentence.

2. Evidence check

For each control we claim [list], tell me what proof an auditor would expect to see, and mark whether this evidence [paste] is enough or what is missing.

3. Scope questions

We are a [type of business] with [size, records, systems]. List the questions I should ask counsel to confirm which parts of [rule] apply to us. Do not answer them.

Fix and track

4. Remediation tracker

From this gap list [paste], build a tracker with action, owner from [people], due date within [window], and the evidence that will show each item is done.

5. Policy clause drafts

Draft short policy clauses for these missing items [list], in plain English, each marked "draft for counsel", using only the requirements I pasted from [rule].

6. Control checklist

Turn this policy [paste] into a monthly checklist for [role] with one line per control, how to check it, and where to record the result.

Audits and reviews

7. Audit evidence request list

An audit of [area] starts on [date]. From these controls [paste], write the evidence request list by owner, with what to collect and the date to have it ready.

8. Vendor review questions

We share [type of data] with [vendor type]. Write ten security and privacy questions for the vendor, and list the contract terms our policy [paste] says we need.

9. Policy change log

Compare these two versions of our [policy] [paste both] and list every change, what it means for staff, and which controls or trainings need an update.

Training and reporting

10. Training outline

Write a 30-minute training outline on [policy] for [audience], with three real scenarios from our work [describe] and a five-question check at the end.

11. Report to leadership

From this tracker [paste], write a one-page update for [owner or board]: status counts, items late, risks, and decisions needed, in plain language.

12. Incident first steps

From our incident response plan [paste], write a one-page first-hour checklist for staff: who to call, what to preserve, and what not to do. Use only steps in the plan.

Run a full gap review in one prompt

The flagship Compliance Prompt: Policy Gap List From Your Rule Checklist maps your policies and evidence to each obligation, counts the results, builds a remediation tracker with owners and dates, drafts clauses for counsel, and lists the scope questions it cannot answer. Its example tests a tax preparation firm against counsel's checklist for the FTC Safeguards Rule (16 CFR 314.4) and finds 5 of 10 items missing.

Use it safely

Quote the rule from the official text or counsel's checklist, not from memory, and never paste client data or confidential details into a public AI tool. Treat every result as a draft: counsel decides what applies and whether a control is enough. Not legal advice.

Related prompts

For security frameworks, use the NIST CSF policy gap notes. For privacy records, see the GDPR ROPA from a process inventory guide, and for staff training, the HIPAA Privacy Rule training outline. To plan research before you write, try ChatGPT prompts for legal research.

Find more in the Legal category, look through Browse, or post your own on Share.