That Tech Pod
Welcome to That Tech Pod, a podcast co-hosted by Laura Milstein, Gabi Schulte and Kevin Albert. Each Tuesday, That Tech Pod will feature in depth discussions about data privacy, cybersecurity, eDiscovery, and tech innovations with heavy hitters in the industry. Subscribe so you don't miss an episode! Visit thattechpod.com for more information.
That Tech Pod
Compliance Isn’t Paperwork. It’s Power. With Richa Kaul
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
This week on That Tech Pod, Laura and Kevin chat with Richa Kaul, founder and CEO of Complyance, for a blunt conversation about what governance, risk, and compliance actually are, and why so many companies pretend it’s something else.
Richa walks us through how she really landed in GRC, including the moment she realized compliance isn’t about forms or frameworks. It’s about power, incentives, and who takes the fall when systems fail. Drawing on her time in legal tech, enterprise systems, and AI, she makes the case that much of today’s compliance model is quietly broken, and that organizations know it, even if they won’t admit it. We dig into why GRC has such a credibility problem, the comforting lies companies tell themselves about being “compliant,” and whether compliance should be about control or trust, and why so many leaders default to the wrong one. Richa also weighs in on whether “move fast and break things” is actually gone, or just better disguised in the age of AI. We close with a forward-looking conversation on AI risk, including the uncomfortable questions boards avoid, why training alone won’t fix reckless AI use, and what organizations should be paying attention to next if they want governance that actually works.
Richa Kaul is the founder and CEO of Complyance, an AI-powered GRC platform helping enterprises navigate governance, risk, and compliance with ease. She previously held leadership roles in legal and compliance technology, including helping scale global solutions at ContractPodAI. Richa focuses on how companies can move beyond checkbox compliance to build systems that actually support better decisions, accountability, and trust as AI becomes more embedded in the enterprise. She is passionate about the future of compliance, the role of AI in governance, and the challenges of scaling a company in enterprise tech. Her innovative approach combines deep technical expertise with strategic business acumen, making her a sought-after thought leader in the GRC space.
Hello and welcome to that tech pod where we discuss all things e-discovery, cybersecurity, data privacy, and tech innovations. I'm Laura Milstein.
SPEAKER_00And I'm Kevin Umbert.
SPEAKER_02And each week we bring on heavy hitters from the industry to help us break down these topics. And today, Kevin, who are we talking to?
SPEAKER_00Today we're talking to Richa Kall. She is the founder and CEO of Compliance, an AI-powered GRC platform helping enterprises navigate governance, risk, and compliance with ease. She previously held leadership roles in legal and compliance technology, including helping scale global solutions at contract pod AI. She focuses on how companies can move beyond checkbox compliance to build systems that actually support better decisions, accountability, and trust as AI becomes more embedded in the enterprise. She is passionate about the future of compliance, the role of AI in governance, and the challenges of scaling a company in enterprise tech. Her innovative approach combines deep technology expertise with strategic business acumen, making her a sought-after thought leader in the GRC space. Richa, welcome to the show.
SPEAKER_01Thanks so much. Kevin, thanks for having me.
SPEAKER_02Richa, I'm pumped for you to be here, even though you only thanked Kevin for having you. I'm still here. And I'll remember that. But I'm excited to have you here. So let's skip the whole like LinkedIn version of who you are. What's the real story? Like, how did you end up in governance, risk, and compliance? Tell us more.
SPEAKER_01Happy to. You know, the real story, if you think past the resume bullet points, and all of that, actually probably comes down to me being a huge data privacy nut. I am kind of morally against companies or governments having more of my data than they actually need. And I'm the one who's at parties with my friends telling them how to put on better privacy configurations on their phone. Like that's how much I care about it. And so I think I got to a point where I realized that the most efficient way to protect consumer data is actually to help secure the enterprises who keep the world's data safe. And that is how compliance with a why was born. And by the way, that's the why behind compliance.
SPEAKER_00So was there a moment in your career where you realized compliance isn't just paperwork? It's actually about who has the power and who doesn't and who gets the blame when things go wrong.
SPEAKER_01I think it was when I actually had to manage SOC 2 and different standards for the first time and look at getting my previous organization FedRAMP ready. And I was doing this work to get prepped, and I was working with consultants and auditors. And it felt like the paperwork that I was doing was very different from the spirit of why we were doing it. And that disconnect felt like it needed to be solved because the people who go into GRC and compliance don't do it so that they can chase people on email to give them evidence and prep for audits. They do it because they feel the mission of keeping an organization safe, reducing risk. But the work kind of materializes in this admin busy work. And what I wanted to do is build a company that helped those folks get away from that and be able to focus on their mission of protecting consumer data.
SPEAKER_02I like that. I think that's a good mission. My favorite is just like compliance and the why in compliance. And I just want to go back to address that because uh I do love it. So you've moved through legal tech, AI, and enterprise systems. At what point did you start thinking this whole model is broken and we're pretending it's fine?
SPEAKER_01I think to some extent that's always the case. I think that when it comes to legacy enterprise tech in almost any area, there's a lot of room for improvement and recalibration of what we should expect out of our tech. And I think that more recently only, in the last couple of years, maybe, we've been able to actually make so many strides in that because of AI and actually create more usable tech that creates value, actually reduces manual work and kind of lightens the load for those teams that are just so pressed. And that's what we're seeing. And so I suppose it's been a it's been a journey to get here. But from the moment that I started compliance, I knew that that was the vision. In fact, Laura, I was actually just looking at my old pre-seed and seed round pitch decks last week. I had just found them, the little end of your reflection I was doing. So I pulled up the old decks and I was laughing at the vision and how it looked from then compared to how it's actually materialized. Like it was just an amazing thing to see the seed of thought that the company was going to be and now what it is, and feeling grateful for the journey.
SPEAKER_02Do you have any regrets? Do you look at that slide deck at all and you're like, oh man, we did it wrong. We should have. I'm just kidding. I think it's great when you look and just see like such progress from where you were to where you where you go.
SPEAKER_01I love it. I think there's two threads that I would take from looking at those old pitch decks. The first one is that I was surprised at how much the seed and like the real core of what the vision was was actually still today, exactly what the vision is. That was one. But the other thing is I was kind of like laughing at how quickly I thought I could get there. And looking at some of those numbers and what we said we were gonna do in the next 12 months. And I was like, dude, I gotta build an enterprise software first. And that is what, you know, that's what you learn when you're doing it is that, you know, enterprises have a really high bar. And I think GRC teams, compliance risk teams, they have a really high bar. And there's no fooling them. If you don't have good tech, they're gonna know it. And so making sure that we had set a really, really high bar for our tech internally and then met it before we went to market was actually one of the most important things for me when the journey actually started versus when I was dreaming big.
SPEAKER_00So for me, I my problem is with this when somebody starts talking about GRC, like I just medally check out. This seems like one of the most boring topics in the world. Does GRC have a branding problem?
SPEAKER_01You know what, Kevin? I think that GRC isn't super sexy to most people. But I think the reality is that people who love GRC are quite nerdy and we wear it as a badge of honor. And I think that without us, people who think GRC is fun and sexy, the world would be less safe. And for whatever that's worth, you know, like we j, I mean, we're talking about it now. And I know, like for us, you know, we focus a lot on cybersecurity. But if you just think about, you know, the food that you buy, the toys that you buy for your kids, why do you trust them? You trust them because there's compliance behind it that actually makes them, you know, meet a certain standard so that you're allowed to buy them and that you feel comfortable buying them. And so, yes, I know regulation and and compliance codes are not super sexy, but they also actually are kind of the fabric of our society. And if you think about it that way, then us focusing on information security is kind of the evolution of you know material good compliance all the way now to more like security, software compliance. And I think that without it, we would live in a very different world.
SPEAKER_00That's fair.
SPEAKER_01That's totally fair.
SPEAKER_02So, what's the most comforting lie that companies tell themselves about being compliant?
SPEAKER_01That compliance is security. Now, compliance is not security. And I think that folks who are, again, GRC nerdy, they fully understand that. Anybody who actually knows and loves GRC, they are very clear on the fact that compliance is not security. Actually, compliance is a happy byproduct of a good security practice and good security posture. But I think that actually executives who are not in GRC, even boards, I think they tell themselves that if we are SOC2 compliant, if we are ISO 27001 compliant, NIST, whatever else, then oh, so we're secure. But that's not true because compliance is just point-in-time checks on an otherwise living, breathing security posture that you have to live every day in order to make it truly secure. And so that is actually why we are called compliance with a why, because again, like compliance is a happy byproduct of the whys, which is security risk reduction and everything that actually matters around protecting consumer data.
SPEAKER_00Do you think we finally move past the move things and break things? Like, is that officially dead, or do you think we just know now know how to hide that better?
SPEAKER_01Okay, that's a very interesting question, Kevin. So when I hear about move fast and break things, I think about that in terms of the growth style of a company, right? And so when you think back, is that how you were asking that question?
SPEAKER_00Yeah, for sure.
SPEAKER_01Yeah. So that move fast and break things kind of approach was extremely popular, I believe, until basically the end of COVID. And I say that because the whole market, including investors, were rewarding companies moving fast and breaking things and spending a ton of money and throwing efficiency out the window. I'm sure you've both read or at least heard a little bit of Blit Scaling, that book, the famous book about growing fast and how do you scale a company? And the reality is that blitz scaling is defined at growth at all costs. But I think things have changed in the last few years, from an investor perspective, they reward efficiency a little bit more. I think that what they reward is a little bit more sustainability. Of course, growth is still the end all be all, but I don't think that it's growth at all costs anymore. I think it's actually growth with some consideration to reality, reality, sustainability, and actually building a good business. And that actually works well for a founder like me. I have been about that actually from day one. I think sometimes to the dislike of some of our investors, I always want to make sure that we're building a really, really solid, stable business. And I don't think about growth at all costs as the way forward. And so for me, I guess regardless as if of if we are past it as a as a software society, I'm past it.
SPEAKER_02Well, if you're past it, I'm past it. What's been more painful? Building the technology or getting large organizations to admit they need to change.
SPEAKER_01Building the technology to a standard that gets organizations to want to change is my answer to that, Laura. Because I think building the technology, first of all, is a joy. And again, I told you already I'm a GRC nerd, so you know it. I'm I mean it when I say that. It's a joy and like a bit of a privilege. Because I think for me, I'm so wrapped up in the mission of what our company and our product can actually achieve that getting to spend my time like really thinking about what this product can do, speaking to clients and helping them understand like where the AI can help them, you know, what workflows they can actually remove from their from their workplace, uh it feels to me like a true joy and a privilege. And so I don't find that to be challenging so much as truly an opportunity. That sounds very cliche when I'm saying it back to you, but for what it's worth, that's actually how I feel. I think that what gets hard is that we know that our tech is so good, but how do we get it out there in a way that makes sure other people know how good it is? And maybe I'm just showing myself as a little bit of a marketing novice, which I am. And so I think that's maybe what's harder for me personally. Once they see the tech and once they use the tech, they're fully convinced. And so that part's easy. But it's about, you know, how do you convince them to give us a chance? I think sometimes that's harder than it may seem. Maybe not for you guys, you probably in marketing, but I'm I'm not.
SPEAKER_00Well, do you so you think compliance is more about control or is it more about trust? And why do so many organizations basically pick the wrong one?
SPEAKER_01I think it's two sides of the same coin. I think it's controlling your internal environments, and then when you are evaluating others or when you are trying to position yourself externally, it's about how that control becomes trust. So whether it's you using the control to convince others to trust you, or whether it's you trusting others because they are in control of their environments. I actually think it's two sides of the same coin, Kevin.
unknownOkay.
SPEAKER_02Yeah, Kevin, sit down. You're not in this anymore. What's the most like uncomfortable question that boards should be asking about AI and risk, but they don't ask it, or they don't usually ask it.
SPEAKER_01Unfortunately, Laura, I'm not so sure that we are even at a level of fluency right now in the business society at the moment that I feel like boards are asking many of the right questions related to AI right now. But I think some of the questions that they need to be asking is around the privacy of the AI tooling that companies are actually employing and asking about like, look, do you have a grasp on whether or not our data is being used in ways that we don't know about? Like, are we 100% sure that our organization's data is not being used to train LLMs? And how do you know that? Because in reality, at a lot of decentralized organizations, there are individuals that are just out there who are just signing up for GPT, putting company data into LLMs. They don't know to turn a toggle on or off to say that, hey, do not use this data to train anything. And if they're not using kind of like company-sponsored tech, which happens, as we all know, then there could be seriously points of leakage. And I do think that that's important when you think about actually protecting your IP and protecting your company's data.
SPEAKER_00I mean, so you bring up a good point. I mean, obviously individuals are gonna be individuals, they're gonna just do stuff that make their jobs more just to get their jobs done and not necessarily have to think about the compliance side of it. Is this really like a training issue, or do we have to just sort of re-educate everybody across the board? I mean, because I agree with you. I I definitely fear that my company, that people are just dropping things into Chat GPT and have no idea what where that is going on the other side and what how much of that's being intermingled and intermixed with all kinds of stuff.
SPEAKER_01Thank you so much for asking that question, Kevin, because this kind of comes back full circle to one of the points I made initially. I think that what is required is something more than training. I think it's a security and compliance culture. And how do you make security and compliance sexy? I'll leave that to the training specialists. But I think that my role in it and our role as a company in it is to genuinely, genuinely let people get rid of that manual work that's like occupying all of their time right now so that they can even take time to think about the strategic questions of how do I build a security and compliance culture? Because let's be super honest. All of us have to-do lists upon to-do lists at work. And the strategic big picture things that don't have an urgency or a timeline are the ones that always slip to the back. And those are the ones we want to work on, but they're always pushed to the back because you have urgent burning, as I like to say, you have sharks closer to the boat. And so you got to deal with those sharks first. And if we actually have usable software and AI that actually deals with those sharks for you, you can suddenly get freed up to think about the things that actually matter, which are things like creating a security and compliance culture that works for your organization. I don't pretend to be an expert in that, but I sure as heck am an expert in making that work disappear from your plates that you can focus on that.
SPEAKER_02Wow. Rich a call. Let me tell you right now, 10 out of 10. You are so well spoken. You are so knowledgeable. I've really enjoyed you being on the show today. I was just like, how long can we extend this? I have so much more. But I I won't take up all of your time. I just want to say thank you. And then just one final question. I know everyone likes to think they're a psychic and say, where will the future be? And where do things go? And I think that's really hard to answer because I mean, if you go back in time, not even that long ago, what is it, like 14, 15, 15 years ago? And it's like, here's AOL, and now people are like, what's AOL? What no one recognizes that dial up sound anymore. And and things have changed so much that you're like, what? AI, I don't understand it. I don't know what the future is gonna be, but I'm curious from your perspective, if you have if you have any thoughts, if you have any ideas of what's to come next, whether it's for compliance, your company, or just just anything that we should all be looking out for in the tech space.
SPEAKER_01I think in the next few years, we're gonna see a redefinition of enterprise SaaS, of all SaaS, actually. I think that for enterprises, we get the benefit of being able to see what's gonna happen to SMB SaaS before it comes for enterprise. And I think that things are gonna change foundationally. And I'm not sure that people are fully ready for it yet. I think there's gonna be fewer winners. I think the winners aren't gonna be defined by the most AI if I'd they are. I think they're gonna be defined on a different set of metrics. I have some ideas on that, but I don't know if we have enough time to dive in. But I think, Laura, honestly, what's gonna happen is we're gonna see like a total rebuild of the SaaS market and whether that's gonna be in two years, probably not, three years, maybe, but four to five years, almost definitely. And think we're having very, very different conversations about how we win in SaaS then.
SPEAKER_02Well, thank you so much for being on the show today. 10 out of 10. Really, really mean when I say that, I mean it. So thank you.
SPEAKER_01Absolutely. Thank you both for having me. Thank you, Laura, especially.
SPEAKER_02Wow, thank you. Yep, bye, Kevin. It's about me. So, Kevin, we just spoke with Rich A Call, who is the founder and CEO of Compliance. What were your tech takeaways?
SPEAKER_00I mean, it's one of those things. Obviously, even she covered it. GRC kind of looks boring because we were sold as sort of like box checking, but it's obviously about more than that. It's about power and trust and who gets blamed and things get broken. And so I thought she did a good job explaining that. I I thought she was really good about sort of saying the interesting moment is when you stop treating it like paperwork and basically get involved. And so I think she did a good job turning me from just like a rolling my eyes anytime somebody is speaking about GRC to actually making it interesting. So I'm glad she was on. I thought that was a good pod overall. What about you? What are your tech takeaways?
SPEAKER_02Totally agree. I love anything cyber, and I'm always interested in where it's gonna go and how we talk about it. And I think it's such a broad topic that people, even just hearing compliance, to so many people they have different ideas of what that means. And she really honed in on her thoughts and her experience of all of that. And I thought she was great. I meant it when I said she was 10 out of 10. I would definitely bring her back on uh the pod. And I think she was, yeah, just just great all around, definitely well spoken and knows her stuff. And to me, that's what makes an excellent guest, and and that she definitely was. If you're interested in learning more about compliance with a why or that tech pod or anything cyber and have any questions, we would love to hear from you. Please feel free to shoot us a note at contact at thattechpod.com or uh go to our website, www.thattechpod.com, enter your email to subscribe. Go over to linkedin.com slash that tech pod, give us a follow. We might be on other social medias. Who's to say? Kevin, is there anything else our listeners can do?
SPEAKER_00Yep, go to Every Gear Pods, Apple Podcasts, Spotify, or what have you, and leave us a review, leave us a rating, let us know how we're doing. All that stuff helps us with the algorithms and gets us out there more, which is much appreciated. Thanks, everybody.
SPEAKER_02Thanks, everyone.