After a while you start noticing the same pattern everywhere. It didn't matter what sector I was in, the paperwork was rarely built around the actual job. It was a template with the company name changed, or something copied from the last similar job and lightly edited, often written up the night before because nobody had time to do it properly. This isn't because the people doing it don't care. Most of them care a great deal. It's because doing it properly, every time, for every task, takes a level of expertise and time that a lot of SMEs just don't have sitting in house. Most ten-person construction firms aren't going to have a full time EHS department. Neither is a small haulage company or a food producer.
I spent a decade seeing that gap from the consultant's side, usually getting called in after something had already gone wrong rather than before.
What changed things for me was watching what large language models were becoming capable of, not as a novelty, but as something that could actually be grounded in real source material, HSE guidance, UK legislation, ISO and BSI standards, and used to generate documentation that's specific to the actual site and task rather than pulled from a generic template. That was the personal case for it. The market case is just as strong. RAG systems have finally got reliable enough to trust with something as unforgiving as safety documentation, retrieving from HSE guidance and legislation before generating anything, rather than making things up with confidence the way earlier models did. At the same time, EHS teams are shrinking while enforcement tightens and insurers ask harder questions before they'll write a policy. Put those two things together and AI stops being a nice-to-have. It becomes the only realistic way a ten-person firm closes a gap that used to require a full EHS department it could never afford.
So, in March 2025 I set up Rivisio with my wife Mary, who runs the finance side as CFO. We bootstrapped it ourselves. Annie Game came on as CMO not long after, and we've been working with a development partner, AltLabs, to actually build the thing.
Before any of that building started, I spent the first six months just researching. Working out how AI could actually be trusted in a space where being wrong has real consequences wasn't something I was willing to guess at. That period is where the RAG architecture came from, and where I developed what became Rivisio's proprietary Hazard-Risk-Control model, a structured way of controlling every output so it maps back to legislation and ACOPs and is verified against that content rather than generated freely.
The way it works is the system pulls from a RAG architecture grounded in that HSE, legislation and standards content, so what it produces is tied back to something real rather than invented. On top of that it draws on a client's own historical documents and data, their past risk assessments, method statements and records, so every document it produces is specific to that client, that site and that task, not just generic to the sector. We've also built up our own library of hazards, risks and controls behind it, sector by sector. Generation is where we are now, risk assessments, RAMS, COSHH assessments, safe systems of work. Prediction is where we're heading, so a business can see where their next incident is likely to come from rather than just documenting the last one, and prescription is the step after that, telling a business what to actually do about it rather than just flagging that a risk exists.
We built it to cover the sectors I've actually worked in rather than picking one and staying there: construction, manufacturing, logistics and transport, utilities, oil and gas, chemical processing, waste management, agriculture, quarrying and mining, facilities management, arboriculture, food production, and healthcare and social care. Most of what's out there picks one sector, usually construction, and stops there. That matters commercially as much as it does personally. An SME rarely operates in just one of these categories, and a tool that only covers construction leaves the rest of a business's risk exposure undocumented.
None of that means much until it's actually tested against real work. Wilton Engineering has been our primary pilot partner. Bill Scott, their CEO, backed it from the start, though the hands-on testing was down to his team. Steve Oakden, their EHS Manager, put it through its paces properly, feeding in 89 risk assessments, 33 safe systems of work and 425 hazard records. Steve and the other pilot testers checked the output and confirmed the quality held up. That was the point I knew this wasn't just a nice idea. It actually works. That pilot is now moving toward a paying commercial relationship, and it's shaped how we've thought about pricing this for other SMEs in the same position.
Longer term, we want Rivisio to grow into a fully featured EHS management system, not just a document generator. That means the platform has self-training and feedback loops built in, so it learns from how it's actually being used and keeps improving over time, which lines up directly with the continual improvement requirement at the heart of ISO 45001. It also means document management fully integrated into the system, so audit trails are built in automatically and compliance stops being something a business has to chase and manage separately.
We've picked up some recognition along the way too, a finalist spot for Best Start-Up at the Tees Tech Awards and a place on the TVCA Stable Programme, both of which helped sharpen things. But honestly what matters most to me is much simpler than any award, and it's the same thing that got me into this in the first place. Every SME in a high-risk sector should have a safety management system that's actually about their work, not a template with the serial numbers filed off.
That's the whole reason Rivisio exists. It always was.