Compliance is usually the place where companies are most skeptical about AI. Auditing complex regulations, spotting violations in documentation, and recommending corrective actions require judgment, and judgment is what we've been told AI is bad at. Except it turns out, in the very specific domain of regulatory compliance, AI is increasingly good at exactly that.
Why compliance is an unexpectedly good fit for AI
A compliance auditor's job breaks down into repeatable subproblems: read a regulation, read a document or process, determine if they align, and note the gap if they don't. That's a task that requires:
- Understanding domain-specific language (regulatory terminology, technical documentation)
- Consistent rule application across thousands of documents
- Pattern matching (recognizing when a deviation from process shows up in multiple places)
- Completeness (making sure you don't miss any violations, even rare ones)
For a human auditor, this is tedious, mentally taxing, and error-prone. For an AI model that can read regulations, hold the rules in context, and apply them consistently to hundreds of documents in sequence, it's exactly the kind of task where the model's strengths align with the job's actual needs.
What the data shows
A financial services firm tested Claude Fable 5 against a team of three human auditors on a dataset of 50 real compliance scenarios — cases where regulators had already flagged a violation, and the company needed to find where in the documentation or process the gap showed up. Fable 5 found 92% of the violations the humans found and additionally flagged 7 violations the humans had missed. Across the 50 cases, Fable 5 took 90 minutes; the three auditors took a week.
A healthcare company that processes patient consent forms against HIPAA requirements reports that their model-assisted audit process now catches documentation gaps before they file. Two months into deployment, they had already caught a systematic gap that they'd been submitting with incomplete documentation for three years. That gap would have been caught eventually, but it took a model doing complete, consistent analysis of 3,000 consent forms to find it.
A legal services firm uses Claude Sonnet 5 to cross-check contract language against their standard templates and regulatory requirements. They report that 95% of the model's recommendations require zero follow-up review, which means they've basically automated half of what junior associates used to do.
What's not working (yet)
Compliance work also has judgment calls where human intuition still wins. If a regulation is ambiguous and you need to interpret intent, not just letter, humans still outperform models. When you need to balance regulatory compliance against practical business constraints and make a strategic judgment about acceptable risk, that's still a human decision.
Models are great at "is this compliant or not?" They're worse at "is this compliant, or should we take this specific risk anyway?"
The infrastructure that enables this
The shift from "use AI to help auditors" to "use AI to do auditing, spot-checked by auditors" requires:
- Access to the actual regulations, encoded or processed into a format the model can reference
- Complete transaction and documentation logs to audit against
- Clear rules about what counts as a violation versus what's a gray area
- A human review process for anything the model flags, before taking action
Most compliance teams already have some of this infrastructure. Building the rest is usually a three-month project, not a nine-month infrastructure lift.
Why companies are still nervous
Regulators don't yet have clear guidance on AI-driven compliance checking. If the model misses a violation, who's responsible? If the model flags something that's not actually a violation, and you fire someone or change a process based on its recommendation, you've built an audit chain where the model is making decisions that affect people. That's not legally settled territory.
The smart companies right now are using AI for compliance monitoring and alerting, but keeping a human in the loop for any decision that changes policy, fires someone, or affects a customer. That's lower risk than fully automating compliance on day one, and it's still dramatically faster than manual auditing.
The hiring gap
Compliance teams are understaffed almost everywhere, and compliance expertise is expensive to hire for. The first wave of AI adoption in compliance is mostly companies building this capability in-house, which means they need someone who understands both compliance deeply and AI practically. That's a rare skill set, and it's also getting higher-leverage every month as the models improve.
If you're staffing a compliance or audit function and you don't have someone who can evaluate and deploy AI tools for compliance work, you're probably leaving efficiency on the table. See our coverage of hiring for regulatory and compliance tech roles for how that role is evolving.
