AI Is No Longer Just a Tool for the Compliance Team
AI promises compliance teams something irresistible: the ability to analyse vast datasets, detect suspicious behaviour and automate work that once consumed thousands of human hours. Yet the same technology is creating governance risks almost as quickly as it solves old ones. In the EU, the AI Act now sits alongside the General Data Protection Regulation (GDPR) and sector-specific obligations, adding another layer to organisational oversight. The UK, meanwhile, continues to favour a more principles-based approach implemented through existing regulators. The real question is whether AI strengthens compliance or merely pushes risk into places organisations struggle to see.
From Rulebook to Radar
Traditional compliance systems ask whether a transaction has broken a rule. AI can ask a more interesting question. Does this behaviour look wrong even when no rule has yet been broken?
Machine learning can examine transactions, customer behaviour, communications and relationships simultaneously, identifying anomalies and networks that fixed thresholds may overlook. The Financial Conduct Authority (FCA) acknowledges that sophisticated technologies can take a broader view of customer behaviour and use AI to detect suspicious activity or triage alerts. Its 2026 Supercharged Sandbox goes further, with participants testing AI and agentic systems against sophisticated financial crime.
This points towards a self-learning compliance function. Dynamic risk scoring, network analysis and behavioural indicators could allow controls to adapt as new patterns emerge rather than waiting for the next annual risk assessment. EU supervisors are moving in a similar direction. The European Banking Authority (EBA) reported in 2025 that SupTech can strengthen anti-money laundering (AML) and combatting the financing of terrorism (CFT) supervision through technology-enabled oversight.
There is, however, a catch. An anomaly is not evidence of wrongdoing. Predictive compliance therefore creates a difficult question. When AI sees around the corner, when is an organisation justified in acting on what it thinks it sees?
When the Compliance Tool Becomes the Compliance Risk
The danger begins when compliance stops questioning its cleverest tool. Generative AI can produce polished regulatory interpretations, investigation summaries and due-diligence conclusions that are confidently wrong. Hallucinations are only part of the problem. Biased or poor-quality data can distort outcomes, while model drift can gradually make yesterday’s reliable system tomorrow’s liability.
Automation bias makes this more dangerous. Staff may defer to an apparently sophisticated recommendation rather than challenge it. FCA research on AI-assisted credit decisions found that different explanations affected consumers’ ability to identify errors, illustrating how explainability can influence effective challenge. Meanwhile, confidential customer or investigation data fed into AI systems can create separate privacy and security exposures.
The EU AI Act responds with requirements for high-risk systems covering risk management, data quality, logging, accuracy and human oversight. In Britain, the FCA remains deliberately principles-based, relying on existing frameworks including the Consumer Duty, SM&CR and governance requirements rather than creating AI-specific rules.
Compliance teams therefore need to test AI outputs, monitor models and preserve meaningful human judgement. A faster compliance decision is not an improvement if nobody can establish why it was made.
Who Signs Off on the Algorithm?
AI creates an awkward question for compliance. When a sanctions-screening tool clears a customer or an AML model downgrades an alert, who signs their name beneath the decision if it proves wrong? Responsibility can easily dissolve between compliance, IT, data scientists, senior management and the technology provider.
That is why firms increasingly need an AI register recording each system, its purpose, the decisions it influences, its owner, its provider and the human controls surrounding it. The EU AI Act makes the principle tangible. For high-risk systems, human oversight must be effective and proportionate, while deployers must assign oversight to people with the necessary competence, training and authority.
In the UK. the FCA says it does not intend to create additional AI rules, relying instead on existing frameworks including Consumer Duty and the SM&CR. Yet the accountability problem remains. A Bank of England and FCA survey found that only 34 per cent of firms reported a complete understanding of the AI they use.
Ultimately, “human-in-the-loop” is meaningless if the human merely clicks approve. Meaningful oversight requires meaningful challenge.
The Shadow AI Problem
Shadow AI may be harder to govern than systems on an organisation’s official AI register. Employees can use consumer tools to summarise investigations, translate correspondence, analyse spreadsheets or interpret regulations, often without telling compliance or IT.
Microsoft research published in 2025 found that 71 per cent of UK employees surveyed had used unapproved consumer AI tools at work.
The risks go beyond data leakage. An employee might accept a fabricated regulatory reference, make an undocumented AI-assisted judgement or build a personal agent that quietly becomes part of a compliance process. Samsung demonstrated the danger when employees reportedly uploaded sensitive source code and meeting material to ChatGPT, prompting restrictions on generative AI use.
But simply banning AI is unlikely to solve this. Organisations need discovery mechanisms, approved environments, data controls, usage monitoring and permissions proportionate to risk. Above all, employees must understand when AI becomes dangerous. That makes AI literacy a compliance control, not merely training. Article 4 of the EU AI Act requires providers and deployers to support AI literacy among staff using AI. The greatest AI exposure may therefore be the system nobody officially deployed.
AI Versus AI
Financial crime is becoming an algorithmic contest. Generative AI can produce persuasive phishing messages, synthetic identities, forged documents and deepfake voices at extraordinary scale. The Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, reported increased suspicious activity involving deepfake media, particularly fraudulent identity documents used to circumvent verification controls.
The threat is accelerating. Interpol’s 2026 Global Financial Fraud Threat Assessment warns that agentic AI can autonomously plan and execute fraud campaigns. Similar capabilities could help criminals construct transaction narratives, coordinate laundering networks or disguise links to sanctioned entities. This is machine-speed financial crime, where tactics can change faster than static rules or annual control reviews.
Compliance therefore needs machines on its side. Entity resolution can connect disguised identities, graph analytics can expose hidden networks, behavioural monitoring can identify unusual activity and AI-assisted investigations can help analysts join the dots faster.
The next frontier may be stranger still. AI agents could increasingly transact with AI-controlled systems, reducing direct human involvement on both sides. The strategic question is no longer simply whether compliance uses AI. It is whether its controls can learn, adapt and challenge as quickly as the threats they face.
The Compliance Advantage
AI is neither compliance’s saviour nor its inevitable disaster. Its real significance lies in changing the speed, scale and autonomy of decisions. Rules are becoming prediction, automation creates reliance risk, human responsibility is becoming algorithmic accountability, approved technology is being joined by Shadow AI, and criminals increasingly have AI tools of their own.
Regulators are responding. The EU AI Act embeds risk management, traceability and human oversight, while the FCA continues to emphasise safe, responsible and well-governed adoption within existing frameworks.
The winners, therefore, will not necessarily deploy the most AI. They will know where it operates, what it decides, when it fails and, crucially, who remains accountable.
And what about you…?
- Which compliance decisions should never be delegated entirely to AI, and what level of meaningful human challenge should remain?
- As criminals increasingly use AI for fraud, deepfakes, synthetic identities and financial crime, can your organisation’s controls adapt quickly enough to keep pace?
