Regulatory compliance services

A prospect will not sign until you send a SOC 2 report. A regulator has published a rule that takes effect next quarter. An investor's checklist asks how you protect patient data. Each of these lands on someone who already has a full-time job, and that person starts looking for regulatory compliance services.

Here is what years of building software for healthcare and fintech clients taught me: compliance is three jobs, done by three kinds of people. Someone decides what a rule means for your business: your counsel or your compliance officer. Someone checks that you meet it: an auditor, an assessor or a regulator.

And someone makes your systems do what the rule asks, every day: record who opened a file, keep data only as long as allowed, collect the proof. That third job is ours.

I have been building software for 18 years. Since 2017 my team of 70+ specialists has delivered 150+ projects across healthcare, fintech, logistics and e-commerce, among them a compliance platform for the pharmacy benefit industry. This page is the map I would want on your side of the table: which service fits your situation, who signs what, how the work goes, what drives the price and what stays with you at the end.

Regulatory compliance services: the short version

Which compliance service do you need

Start from your situation, not from the name of a law. Most companies need one or two of the services below, rarely more.

Healthcare, financial, HR, tax, environmental and AML rules have their own pages in the list of compliance services below this article. For them, industry-specific compliance solutions start with the systems that hold the records: the tax engine wired to your store, the HR tool that collects the right forms, the tracker that knows every permit's deadline. If you cannot tell which line is yours, our regulatory compliance consulting services start by answering exactly that, together with your counsel.

Who signs what: a map to forward to your team

The most expensive misunderstanding in compliance is about who signs. No software company, us included, can certify you or declare you compliant: in every framework that word belongs to someone else. In October 2026 I checked who certifies and who signs against the official sources: HHS, the AICPA, ISO, the PCI Security Standards Council and the Defense Department's CMMC program.

Industry rules: the same split

Industry rules divide the work the same way: the advice and the signatures stay with a specialist, and we build the systems that specialist relies on.

• Tax: advice and any signature stay with your CPA; we connect a tax engine to your store, billing and accounting.
• HR: employment questions go to your employment lawyer; we set up the HR tools that collect the right forms and delete records on schedule.
• Environmental: technical studies and sampling stay with licensed specialists; we build the tracker for permits, inspections and reporting deadlines.
• AML: decisions on suspicious activity stay with your AML officer; we connect identity checks and screening and keep case records with a full history.

Two habits worth keeping from this map. Ask any provider who promises a certificate which accredited body will issue it. And date anything you read about CMMC: its first phase began in November 2025, and its second was suspended in July 2026.

IT compliance solutions from a software company

Much of compliance lives in systems, so the team that changes your systems decides whether a control is real. A policy can say that access is reviewed every quarter; the system either produces a record of the review or it does not. A retention rule on paper has never deleted a single old record.

This is where many business compliance services stop: at the document. Our IT compliance services start there, because our engineers, designers, QA, DevOps and managers build and change the systems themselves. A control we put in place leaves its own evidence:

• Who can see what: roles that match the job, access reviews that are scheduled and recorded, and access removed when someone leaves.
• What gets logged: who opened, changed or exported a record, and when.
• How long data lives: retention and deletion that run on schedule, not on someone's memory.
• What survives a bad day: backups tested by restoring them, and logs that show what was touched.
• What the auditor sees: evidence collected as the work happens, not rebuilt in the week before the audit.

Off-the-shelf regulatory compliance management solutions cover the common frameworks well. When one fits your stack, I recommend it, and we set it up and connect it. When the systems are your own, regulatory compliance solutions have to be built into them, and that is software work.

How the work goes

Every engagement runs through the same four steps; what changes is how many rules and systems are in scope.

1. Scope. Your counsel confirms which rules apply, and we map which of your systems, data and vendors each rule touches. If you need an NDA, we sign it before you share details.
2. Gaps. We compare what exists with what each rule asks of your systems and rank the gaps by risk and by what an auditor checks.
3. Controls. We put the technical controls in place and write down how each one works, so your team can run it and your auditor can test it.
4. Proof. Records, logs and evidence stay current between audits, not only before them.

On your side: one person who decides, read access to the systems in scope, and your counsel on call when a question turns legal. When the work means building or changing software, it runs in two-week sprints, each ending with a demo of what changed.

Three ways to work with us

The work does not end with a passed audit, because the evidence has to keep coming. There are three ways to work with us:

• A project: ready for one audit, one client review or one new rule, with the scope and the price fixed in the contract before work starts.
• Ongoing compliance management services: reviews, records and updates month after month, as your systems and the rules change.
• Software: a system that tracks requirements, tasks and evidence for you, or compliance features built into your own product.

As for compliance outsourcing solutions, the honest line is this: you can hand us the routine, never the accountability. Decisions stay with you and your compliance officer, and we keep the systems and the evidence in order.

What the price depends on

Compliance work with us is priced by an individual estimate, because two companies under the same rule can need very different amounts of work. The first call and the rough estimate are free, and the price is in the contract before any work starts. Five things move it:

• How many rules. One framework is a project; three that overlap are a program, although one control often serves several.
• How many systems. One cloud account with mainstream tools takes less work than in-house applications, old databases and a long list of vendors.
• What already exists. Controls that work and only need evidence cost less than controls that have to be built.
• Platform or custom. Setting up a compliance platform you already pay for costs less than custom software; custom pays off when your workflow is your own.
• Once or ongoing. A push before one audit, or the routine kept running every month.

When the answer turns out to be an application, our published starting price is $5,000 for a first version, and a specialist from our team can join yours from $35 an hour, depending on the role. Every published price is on our pricing page.

Before writing this, I read the nine company pages Google showed me in October 2026 for this search and for compliance consulting firms. Not one published a price, not even a starting one. Nine pages are a small sample, so take it as a reason to ask early what drives the number, not as a statistic.

Our work: two systems built for regulated work

PBM Source: a new law becomes a task. Pharmacy benefit managers answer to a steady stream of laws, regulations and guidance, and finding what applied to one line of business meant weeding through bills by hand. For PBM Source we delivered a compliance platform where each new requirement arrives as a task with a summary, a jurisdiction and a date, marked by line of business: fully insured commercial, self-insured, Medicare or Medicaid.

The hard part was precision: a team has to see only the rules that concern it, or the tool turns into one more inbox to skim. Updates arrive daily, and the dashboard sorts the work by topic, jurisdiction, compliance date, adoption date or assignee. The case: PBM Source.

RxPhoto: one patient record, one log. Clinics in dermatology, aesthetics, plastic surgery, vein treatment and wound care photograph patients at every visit, and the photos have to match from visit to visit and stay protected. On RxPhoto we worked on the backend, the web front end and the API behind the mobile app, including custom patient reports that export to PDF, JPG or PowerPoint.

Each patient's photos, forms and notes live in one record on a secure portal, and an audit log lets administrators follow every user action. Per rxphoto.com, the platform stores more than 80 million before-and-after photos. The case: RxPhoto.

Clients rate our work 5.0 on Clutch from 26 verified reviews, as of September 2026, and not one review is negative.

What stays with you at the end

Compliance work that lives on a consultant's laptop leaves with the consultant. With us, four things stay with you:

• The controls, in your own systems and accounts.
• The evidence, stored where your auditor can reach it without us.
• The code we write for you, which is yours once it is paid for.
• A written list of the accesses and services we set up, so changing providers is a checklist, not an investigation.

When you do not need us

Some compliance questions are not software questions, and I would rather say so before the first call.

• The question is legal: does this law apply to us, what does this clause mean. Start with counsel; we pick up when the answer becomes a change in your systems.
• You need a certificate or an attestation: it comes from an accredited body, an assessor or a CPA firm. We prepare you for it and never issue one.
• Your compliance lives on paper: a small office without systems of its own needs good procedures more than engineers.
• A platform already covers your stack: keep it. We help only where it does not reach.

Compliance consultancy services that end with a report are the right buy when you have engineers who will carry the report out. When you do not, the report waits.

Where to start

Tell us which rules you face and which systems hold the data. Bring what you have to the first call; none of it has to be polished:

• The trigger: the client's request, the rule or the audit date, and the deadline it sets.
• The rules you think apply, and anything your counsel has already said about them.
• The systems that hold the data: cloud accounts, applications, databases and the vendors that touch it.
• What exists: policies, the last audit report, a security questionnaire you could not finish.
• One name: the person on your side who decides.

On weekdays, 9:00-18:00 Miami time, we answer new requests within 30 minutes. The first call and the rough estimate are free, and you will know the price before any work starts.

By Michael A., Founder and CEO of 26 Lines of Code, 18 years in software development. Updated October 6, 2026.