Oct 30, 2026
Where does AI fit in?
The real question for a compliance program is no longer whether to use AI, but where on the spectrum each control belongs. Firms are being pitched everything from “add a chatbot to your policy library” to “fully autonomous surveillance,” and the instinct to pick a side (all in, or stay away) is understandable but costly.
Staying fully manual means volumes of trades, communications, marketing and third-party data outgrow the team. Going fully automated means handing judgment, and accountability, to a system that cannot be examined or cross-examined the way a person can. Regulators have been clear that the firm remains responsible either way, and that claims about AI use must be accurate.
Our thesis is that the most effective programs approach AI as a risk-based continuum, matching automation to the volume, potential harm, judgment, and verifiability associated with each control. We call this deliberate middle ground strategic compliance AI.
The AI continuum
Automation in compliance runs along a spectrum with five practical stages, and not necessarily with a clear on/off switch.
Moving to the right can increase speed and coverage, but it does not automatically improve control effectiveness. Nor should every workflow inexorably march toward total autonomy.
The appropriate position depends on the use case. A control may also occupy different positions at different stages. AI might collect evidence and rank exceptions, while a person determines significance, approves remediation, and communicates with regulators.
Human review is not, by itself, an adequate safeguard, oversight needs to be designed into the control, with the information, monitoring and escalation routes to catch errors, rather than resting on a single reviewer. (We look at what meaningful oversight requires in practice in AI Can Flag the Risk, But Who Owns the Decision?)
Where AI really adds value
AI tends to be most useful where work is high-volume, text-heavy, or pattern-driven, and where outputs can be tested against reliable sources. Some examples might include:
| Application | AI role | Required human or control role |
| Communications and marketing review | Identify and rank material that may conflict with rules or policy | Decide on exceptions and sample unflagged items |
| Surveillance alert management | Score, group, and prioritize alerts | Validate thresholds, false negatives, and escalations |
| Regulatory change monitoring | Summarize publications and map them to policies or obligations | Confirm applicability and approve changes |
| Document and evidence extraction | Extract fields from contracts, filings, and due-diligence materials | Validate exceptions and material fields |
| Testing and examination preparation | Draft test steps, collect evidence, and organize response materials | Approve methodology, findings, and representations |
| Policy and procedure support | Answer questions using approved internal sources | Maintain source material, review logs, and handle ambiguity |
These use cases are stronger when:
- AI narrows attention rather than concealing decisions.
- Outputs can be checked against authoritative evidence.
- Performance can be measured, including false negatives.
- Overrides, exceptions, and changes are logged.
- A named owner remains responsible for the control outcome.
Any use case that lacks these characteristics probably belongs further left on the continuum – manual or rules-based operation are appropriate until stronger safeguards exist.
The non-AI approach
Manual and deterministic controls remain valuable. They can provide clear decision paths, stable criteria, and direct accountability. They may be preferable for low-volume, highly sensitive, novel, or judgment-intensive matters.
Their limitations become more visible as scale increases. Sampling may become thinner, reviewers may apply criteria inconsistently, and static keywords or thresholds may produce excessive false positives while missing context-dependent issues.
The cost is not only operational. When skilled staff spend most of their time reading, sorting, and re-keying information, less capacity remains for risk assessment, testing design, challenge, and business advice.
However, “manual” should not be equated with transparent or accurate. Human decisions can also be inconsistent, poorly documented, biased, or difficult to reproduce. The appropriate comparison is therefore not AI against an idealized human process, but AI against the actual control environment and measurable baseline.
The all-AI approach
Broader automation can increase coverage, consistency, and speed. It can also create risks that are less visible than manual errors:
- Explainability: A result that cannot be meaningfully explained may be difficult to challenge or defend.
- Accuracy: Models can generate plausible but incorrect outputs or miss issues without producing an obvious warning.
- Automation bias: Reviewers may defer to a system rather than exercise independent judgment.
- Change and drift: Performance may change because of new data, prompts, configurations, or vendor updates.
- Data governance: Confidentiality, privilege, data location, access, retention, and permitted use must be addressed.
- Third-party dependency: Firms may have limited visibility into vendor models, updates, subcontractors, or incident handling.
- Bias and consumer impact: Aggregate accuracy may conceal poorer outcomes for particular groups or vulnerable customers.
- Operational resilience: Firms need fallback arrangements and plans for failures, degradation, and unavailable services.
- Representation risk: Claims about AI capabilities must match what the system actually does.
The FCA expects firms to consider AI across its lifecycle and to integrate material AI dependencies into operational-resilience arrangements. It also stresses that firms remain responsible for consumer outcomes delivered through AI-supported products, communications, and services.
In the United States, misleading statements about AI can trigger marketing and antifraud concerns. Current practitioner analysis also emphasizes verifying AI-generated research, protecting client information, maintaining required records, and ensuring that descriptions of AI use are accurate.
Placing a control on the continuum
For each workflow, firms should ask:
| Question | Supports greater automation | Supports greater human control |
| What is the volume? | High-volume, repetitive work | Low-volume, bespoke matters |
| What is the potential harm? | Limited and recoverable | Investor harm, breach, or reportable event |
| How much judgment is required? | Clear criteria and repeatable patterns | Intent, context, relationships, or competing duties |
| Can outputs be verified? | Efficiently checked against evidence | Verification requires reperforming the work |
| Can performance be measured? | Reliable test sets and meaningful metrics | No accepted benchmark or sparse outcomes |
| Can the process be evidenced? | Inputs, versions, outputs, and overrides are logged | Reasoning or system changes cannot be reconstructed |
| Is there a safe fallback? | Manual or alternative process is available | Failure would interrupt a critical control |
These questions should be assessed together. High volume does not justify extensive automation when the consequences of error are severe or outputs cannot be validated.
A defensible starting point is to deploy AI in a bounded, assistive role; compare it with the existing process; test accuracy, false negatives, bias, and operational resilience; and expand its authority only when the evidence supports doing so.
This aligns with the voluntary NIST AI Risk Management Framework, which applies risk management across the design, development, use, and evaluation of AI systems rather than treating validation as a one-time exercise.
Conclusion: Autonomy should be earned
The objective is not to deploy the most AI or the least. It is to use the appropriate level of automation for each control and to adjust it as risks, evidence, regulations, and technology change.
Three principles follow:
- Decide by use case, not by enterprise slogan. Assess volume, harm, judgment, verifiability, evidence, and resilience for each workflow.
- Design accountability, not merely human presence. Named owners need sufficient information, authority, competence, and time to challenge the system.
- Earn autonomy through evidence. Begin with bounded assistance, benchmark performance, retain evidence, and expand only when results justify it.
A practical first step is to inventory high-volume manual processes, identify a workflow with checkable outputs and manageable consequences, establish performance criteria and escalation thresholds, and run the AI-supported process alongside the existing control before relying on it.
