AI in compliance: the questions boards and buyers ask

The question behind the questions

Almost every question about AI in compliance is really one question: if a machine helped produce this, can I still stand behind it? That is a governance question, not a technology question, and the answer is the same as it has always been for consultants, templates and inherited documentation. Someone competent must review it, adapt it to how the organisation actually works, approve it, and be able to explain it under challenge.

Framing it this way defuses most board-level anxiety. Nobody asks whether a policy is acceptable because a consultant drafted it; they ask who approved it and whether it is followed. Hold AI-assisted work to exactly that standard and the conversation moves from permission to productivity.

Where AI genuinely helps

The strongest uses are high-volume, low-judgement tasks with a competent reviewer at the end. Drafting a policy from your actual context and control set. Turning a failed control into a plain-English explanation, an owner and a remediation plan. Answering the ninetieth security questionnaire from an approved answer library. Summarising evidence for a management review. Translating an auditor's finding into tasks a team can act on this week.

These are also the tasks that consume most of a compliance manager's week, which is why the productivity gain is real rather than marketing. The measure to watch is time-to-evidence — how long from a control failing to a documented, owned, dated fix — not how many documents were generated.

• Policy and procedure drafting from your real context.
• Remediation plans with owners, steps and suggested evidence.
• Questionnaire and RFP response drafting from an approved library.
• Control and framework mapping first passes.
• Meeting minutes, management review packs and audit summaries.

Where AI must stay out of the loop

Accountability cannot be delegated to a model. Risk acceptance, audit conclusions, nonconformity closure and any decision with legal effect on a person must have a named human owner who understands the reasoning. The AI Act calls this human oversight; ISO 42001 calls it accountability and competence; auditors call it common sense. Write the boundary into your AI acceptable-use policy so it is a rule rather than a habit.

There is also a data boundary. Personal data, client confidential material and regulated records should only pass through enterprise tiers with contractual retention and training exclusions. The fastest way to turn an AI productivity story into an incident report is a well-meaning employee pasting a customer list into a consumer chatbot.

• Risk acceptance and treatment decisions.
• Internal audit findings and conclusions.
• Nonconformity and corrective action closure.
• DSAR refusals and other individual-rights decisions.
• Any employment, credit or eligibility outcome.

How to evidence AI-assisted compliance work

Evidence is metadata. For every AI-assisted artefact record who reviewed it, who approved it, when, which version, and what changed from the draft. If a reviewer materially rewrote the output, that is a good sign and worth capturing. Where AI produced a mapping or an assessment, record the human confirmation step separately so the audit trail shows judgement was applied rather than assumed.

Publish your position externally too. A short statement covering which parts of your service use AI, which providers process data, what is retained, and where humans review, answers a whole category of buyer questions before they are asked — and increasingly appears in trust centres as a competitive differentiator rather than a disclaimer.

• Named reviewer and approver on every artefact.
• Version history showing what the human changed.
• Policy statement defining permitted and prohibited AI use.
• Training records showing staff know the boundaries.
• Public AI statement for buyers and partners.

Frequently asked questions