As the year draws to a close, one thing is clear: generative AI has moved from a theoretical talking point to a practical tool within compliance teams. Over the past twelve months, firms have shifted from cautious experimentation to real-world deployment, driven by growing regulatory complexity, resourcing pressures, and the need for greater consistency across jurisdictions.
But as adoption has accelerated, a more difficult question has followed. How do compliance teams capture the efficiency gains of AI without abdicating responsibility?
From our work with clients and ongoing conversations with regulators this year, the answer is less about the technology itself and more about how it is deployed.
Treating AI Output Like Third-Party Work
One of the most effective mental models we have seen emerge is treating generative AI output in the same way compliance teams treat work produced by a third-party provider.
In practice, this means the level of scrutiny should be proportionate to the risk of the task. Where firms are comfortable accepting a third party’s conclusions without full transparency for low-risk activities, similar standards can apply to AI-generated output. Where decisions require precision, defensibility, or regulatory justification, higher levels of oversight remain essential.
It is also important to be realistic about how large language models operate. LLMs do not reason through a process in the way a human does. They generate statistically likely outputs based on patterns in data, rather than understanding that A leads to B leads to C. For many compliance tasks, this limitation is manageable. But for anything that requires extreme accuracy, AI output should always be closely scrutinized and validated.
Human-in-the-Loop Has Become the Default for Good Reason
This year has seen increased focus on hallucinations, guardrails, and the risks of over-automation. The reality is that current generative AI technology is not mature enough to fully eliminate harmful errors without human involvement.
As a result, the most effective implementations we have seen are those where humans remain firmly in control of high-stakes decisions, using AI as an assistant rather than a decision-maker. Keeping a human-in-the-loop allows a firm to keep processes in the hands of people who can deeply understand the compliance needs of a process. Ultimately, accountability continues to sit with people at a firm and not with the models powering parts of a compliance process.
Regulators Are Open but Expectations Are Rising
One of the more notable shifts this year has been regulators’ stances on AI-assisted compliance. Rather than rejecting it outright, there seems to be a growing openness to solutions that promise greater consistency and operational efficiency.
At the same time, there is a rather clear expectation that if compliance becomes easier, standards will rise. Firms will be expected to produce better documentation, clearer audit trails, and more robust explanations than before.
Importantly, this higher bar will not be limited to firms actively using generative AI. We anticipate that as the technology becomes mainstream, regulators will expect all firms to operate at a level that reflects what is now realistically achievable.
Governance & Bias: Lessons from Live Use
Another challenging aspect of AI adoption this year has been balancing productivity gains with governance. What has become apparent is that generic firm-wide policies around AI governance rarely work on their own.
Instead, governance is most effective when applied at the task level. Across different implementations, we have seen firms rely on subject matter experts embedded in AI workflows, periodic review committees, and structured sampling of outputs. In lower-risk scenarios, some firms have accepted AI output with minimal additional oversight.
Bias from the models remains more difficult to manage. Unless a firm is building or fine-tuning its own models, there is limited control over how underlying systems evolve over time. In practice, the only reliable mitigation is ongoing monitoring: tracking outputs, reviewing outcomes, and reassessing performance regularly. While this is reactive rather than proactive, it allows for a process to be monitored over a longer timeframe, and generally, you can catch potential issues long before they become serious.
Looking Ahead: Efficiency Without Abdication
If this year has taught us anything, it is that automation through generative AI does not, and should not, get rid of accountability in any compliance process.
Generative AI can make compliance faster, more consistent, and more scalable. But it does not remove the need for a deep understanding of regulatory requirements or the risks attached to each compliance task. Responsibility ultimately remains with the firm.
As investment management firms look ahead to the coming year, the most successful will be those that adopt AI pragmatically. Start with clearly defined, well-bounded use cases, maintain human oversight where it matters, and build confidence gradually rather than all at once.
For many firms, that journey begins with lower-risk applications, such as the review of marketing materials, where AI can deliver meaningful efficiency gains while remaining firmly under legal supervision. Used in this way, lawyer-educated AI can support consistency, surface potential issues earlier, and free compliance teams to focus on more complex work.
In Summary
From the past twelve months, one conclusion is clear: generative AI is no longer a hypothetical future consideration for compliance teams. It is a present reality that can provide impact to firms of all sizes today. While it can deliver real efficiency and consistency, it does not replace accountability, judgment, or regulatory responsibility.
Efficiency and responsibility are not mutually exclusive, but achieving both requires deliberate design, continuous oversight, and a clear understanding of where human judgment must remain central.
