# How to Build a Compliance Check with Copilot in SharePoint Skills > Two Copilot in SharePoint skills check every new document for required sections, log gaps to a list and only mark it Ready to Send once the gaps are closed. - URL: https://www.danielanderson.io/articles/copilot-skill-compliance-check-sharepoint/ - Author: Daniel Anderson, Microsoft MVP (https://www.danielanderson.io/) - Published: 2026-07-18 - Updated: 2026-10-25 - Video: https://www.youtube.com/watch?v=sCuesNasVs0 ## Key takeaways - Two Copilot in SharePoint skills can act as a compliance gate: one checks new documents for required sections and logs gaps to a list, the other re-checks flagged documents and marks them Ready to Send. - A Status column on the library lets each skill pick up only the documents it should check, such as New for the first review and Review Before Sending for the re-check. - In my demo, the first skill reviewed 13 Statements of Advice, set 12 to Review Before Sending and one to Ready to Send, and wrote 12 gap rows to the tracking list. - Copilot in SharePoint can create the tracking list itself from a prompt that names the columns and choice values. - Test the check as a prompt on one document first, then turn it into a site skill so everyone on the site runs the same check. You can build a document compliance check in Copilot in SharePoint with two site skills and a Microsoft List. The first skill reviews every document marked New for the sections it must contain, writes any gap to the list and sets the document's status, and the second re-checks the flagged documents once they're fixed and moves them to Ready to Send. I built it for Statements of Advice in the video above with no code and no Power Automate. The two sections I checked were the disclosure statement and the authority to proceed, across a library of 13 SOAs. Copilot in SharePoint has been rolling out to general availability since 30 September 2026, and it was in preview when I recorded this. ## What do you need before you start? - **A Microsoft 365 Copilot licence** for Copilot in SharePoint. - **Edit permission on the site.** Anyone with Edit can create a site skill, and anyone with View can run one. The person running these skills also needs to be able to edit the library and the list, because skills only do what the person running them already can. - **A library with a Status choice column.** Mine had New, Review Before Sending and Ready to Send. If your SOAs are sorted into folders instead, add the column first, because the skills use it to decide which documents to check. - **A SHAREPOINT.md file** for the site, ideally. Copilot loaded mine while it built the skill, so it already knew the site's libraries and terminology. [What SHAREPOINT.md is and what goes in it](https://www.danielanderson.io/articles/sharepoint-md/) covers setting one up. If you haven't built a skill before, start with [what SharePoint skills are and how to build one](https://www.danielanderson.io/articles/sharepoint-skills/). ## How do you build the compliance check? 1. **Create the tracking list with Copilot.** In Copilot in SharePoint I asked it to create a list called SOA Compliance Gaps on the site with columns for the file name, the missing clause, the date identified, a status choice column and the owner. I used single line of text for the owner, though a person column works too. Copilot created the list with the choice values in place, and I coloured them so open gaps show yellow and resolved gaps green. 2. **Test the check as a prompt on one document.** Select an SOA and ask Copilot to review it, check whether it includes a disclosure statement section and an authority to proceed section, and if either is missing, add or update a row in SOA Compliance Gaps with the file name, the missing section, today's date, a status of Open and the owner if one is named in the document. On my test SOA it found a missing section and wrote the row, with the owner taken from the document. (My demo SOAs were markdown files.) 3. **Turn the prompt into the first skill.** Open a new chat from the library and ask Copilot to create a skill that reviews Statements of Advice in this library, only where Status is New. If either section is missing, set the document's status to Review Before Sending and add or update the gap row. If both are present, set it to Ready to Send. End with "Do not touch anything else." Copilot used its built-in skill creator and saved the skill to the site's Agent Assets library. 4. **Run it across the library.** I asked Copilot to "review statements of advice documents", which matched the skill's description. It reported 13 reviewed, one Ready to Send, 12 Review Before Sending and 12 gap rows opened or updated, and the list showed the 12 new rows. 5. **Create the second skill as the verification gate.** Same pattern, different filter: only check documents where Status is Review Before Sending. If both sections are now present, set the document to Ready to Send and mark its gap row Resolved. 6. **Fix a document and run the gate.** After I updated one SOA, the second skill passed it, moved it to Ready to Send and set its gap row to Resolved. ## What I'd lock down before a team relies on this 1. **Restrict who can edit the skills.** By default anyone with Edit permission on the site can change a site skill, and changing the condition in one line changes what passes. Break permission inheritance on the Agent Assets library so only the compliance owner and a backup can edit the skills and SHAREPOINT.md, while everyone else can still run them. 2. **Keep the "do not touch anything else" line.** It stops the skill tidying other columns while it's in there. Each skill filters on one status as well, so running the first one again won't reset a document someone has already cleared. 3. **Be clear about what the check proves.** My skills check that two sections are present. A reviewer still has to confirm the disclosure itself is right for that client, and the gap list is where that review starts. 4. **Back the status with a real control.** Ready to Send is a column value, and anyone who can open the file can still email it. If nothing may leave before it's cleared, put that rule in permissions, a view your advisers send from, or your send process, and use the status to drive it. 5. **Hang the gate off metadata.** With folders, each skill would need rules for where documents sit and move, and every new folder would mean updating both skills. 6. **Keep the list as the record.** Each gap row keeps its date, owner and status after it's resolved, so the list shows which SOAs were flagged and when each gap closed, and version history on the document shows what changed in between. 7. **Add new checks one requirement at a time.** When the compliance team adds a required section, update both skills with the same wording, then test on one document before running the library. If the two skills describe the requirement differently, the re-check can clear a document the first skill would still flag. ## What to watch for - **List and column names.** The skill writes to the list by name, so check the prompt uses exactly the name you created. - **Statuses that don't match.** If a document's Status is blank or spelled differently, neither skill will pick it up. Set a default of New on the column. - **Owner extraction.** The owner comes from whatever the document names. If your SOAs don't name an adviser consistently, use a person column on the library and set it when the SOA is uploaded. ## Frequently asked questions **Where are the skills saved?** Each site skill is a SKILL.md file in its own folder at Agent Assets/Skills// in the site's Agent Assets library. You can open and edit it there, as long as the file's structure stays intact. **Can a skill update a list in SharePoint?** Yes. Microsoft's own example is a skill that adds a document's name to an Invalid Contracts list. Skills can't connect to external systems or run custom code, so a check against your CRM or advice software needs a plugin. **Can I run the check automatically when a new SOA is uploaded?** In my demo someone runs them from a chat. Copilot in SharePoint can also run skills inside scheduled AI automations, which are billed separately through Copilot Credits, so cost it out before you schedule a check across a large library. **How do I know the right skill ran?** Copilot shows a skill indicator card in the chat naming the skill it loaded, and you can expand the reasoning to see each step and the items it plans to update.