It is Thursday evening, and the new client wants a gap analysis on Monday. You have last year's Excel template, a Word folder of processing agreements from other engagements, and the uneasy knowledge that one of those files still carries another client's name in its footer.

Compliance consulting is won on turnaround. The firm that puts a sharp first draft in front of a client while the competitor is still collecting answers gets the engagement. This post is about the work that eats the weekend, and about handing it to agents.

Where the hours actually go

The gap analysis grind

It starts with hundreds of rows of controls mapped to articles, then days of chasing department heads for answers and tracking what was fixed. The sheet is out of date the day you hand it over, because it records one moment and not the work that follows.

Documents from templates

Processing agreements, DPIAs and records of processing are core services, and they are slow: find and replace, adapt, check the versions. An overlooked clause or an outdated fact in a template becomes the client's liability.

One portfolio, many silos

Each client has its own risk profile, its own vendors and its own state of paperwork. Separate spreadsheets for each make a portfolio view hard to build, and they scatter confidential client data across files and mailboxes.

What changes when an agent does the groundwork

In Marsstein every client gets an isolated workspace of its own. Your team signs in once and switches between clients, and nothing from one client's workspace reaches another's.

For a new client, the agent starts from the public website and the documents the client sends, and lists every page it used. The questionnaire you would have walked through in a kickoff call arrives prefilled, and the answers double as the gap check. From there come the drafts: the client's record of processing, the Article 28 agreements with its vendors, and where two parties share responsibility, the Article 26 joint controller agreement.

You walk into the first meeting with something to correct instead of something to ask. The advice stays yours. Is this legitimate interest, is that transfer safe: those judgment calls are what clients pay a consultant for, and your name goes on the result, so you are the one who edits it.

Four questions to ask any tool before it touches client work

Does it start from the client's facts? A template with a name swapped in is not a draft of this client's processing.
Is each client's data kept apart? Not by folder discipline, but by how the workspace is built.
Can a person overrule it? In your practice that person is you, and nothing should look final until you say so.
Can you see where an answer came from? Marsstein lists the pages the agent used, so each answer can be checked against its source.

Today this covers the GDPR. ISO 27001 and the EU AI Act are in preparation, so we would not ask you to promise them to a client yet.

Bring one engagement

Take one client you are about to start, or one you are behind on, and bring it to a first call. We will show you what the agents produce from that client's own website and documents. Talk to us, or see how the platform is set up for firms like yours on the consulting page.