What an AI agent for compliance can do, and where it must stop

The short version

• An AI agent for compliance earns its place where the rule is already written down and the work is finding and checking evidence against it.
• The moment the agent has to interpret an ambiguous rule it is guessing, and the guess arrives in the same confident tone as a correct answer.
• Grounding an agent in your own policies reduces fabrication, it does not remove it.
• Compliance work gets audited, so the log of what the agent read, which rule version it applied and who approved the output is the real deliverable.
• If the rule can be written as code, write the code: a scheduled query is cheaper and easier to defend than an agent.

What work does an AI agent for compliance take on?

It gathers and it checks. The work an agent does well is collecting evidence from the systems that hold it, comparing a document against a requirement somebody has already written down, noticing that a control has no evidence attached this quarter, drafting the first version of a questionnaire response, and routing an exception to the person who owns it.

What makes this an agent rather than a report is that it takes steps in sequence and chooses the next one. Read the control description, query the asset inventory, notice four machines are missing, check whether an exception was approved, open a task for the owner. Each step is small and each step is checkable. The chain is where the time goes, and the chain is what you are buying.

The constraint is that the rule has to exist in writing before the agent starts. An agent can tell you which of 300 laptops have disk encryption on and which do not. It cannot tell you whether your retention schedule satisfies a regulator who has published no view on your situation. If nobody in the organisation can state the rule, the agent will state one, and it will sound exactly as certain as the real one.

Where do AI compliance agents fail?

At the point where the rule stops being explicit. Compliance questions arrive looking like lookups and turn out to be judgements: whether this counts as a material change, whether that vendor is a processor, whether a control is operating or merely documented. A language model answers all of those in the same register it uses for the easy ones, which is the problem.

Grounding the agent in your own documents helps and does not fix it. Stanford's RegLab and HAI benchmarked three commercial retrieval-augmented legal research tools against more than 200 open-ended legal questions and found hallucinations in at least one in six queries. That work was published in 2024 as a preprint and the products have moved since, but the mechanism has not changed: retrieval reduces fabrication, it does not remove it.

The second failure is quieter. Regulations and internal policies change, and the agent's copy of them does not change by itself. An agent that was right in March and is still giving March's answer in November is worse than no agent, because by then somebody has started to trust it.

The third is that the agent is right and you cannot prove it. If the record does not say which version of which policy it compared the evidence against, what you have is an opinion with a timestamp on it.

Do you need an AI agent, or just a scheduled check?

Most of what gets sold as AI agents for compliance would work better as a scheduled query, and saying so early saves money. If the input is structured and the rule is a yes or no, write the query and put it on a timer. It will cost less, it will return the same answer every time, and nobody will ask you how it works.

An agent earns the extra complexity when the input is unstructured and the path is not fixed. A 300-page vendor security pack that has to produce answers to 60 questions. An inbound stream of policy exception requests that have to be read, classified and routed. A set of contracts where the clause you care about is phrased differently in every one. Those are jobs where the branches are too numerous to enumerate in advance, which is the one thing an agent is genuinely for.

The test is to write the decision down in one sentence and ask whether you could express it as code. If you could, do that. If you could not, you need a model somewhere in the loop, and you need a person reading what comes out of it.

Which compliance tasks suit an agent, and which do not?

How do you make an AI compliance agent auditable?

By recording the inputs, not just the conclusions. For every judgement the agent produces, the log should hold the version of the rule it applied, the evidence it actually read, the model and prompt version that produced the output, the time it ran, and the name of the person who accepted it. That record is the deliverable. The answer on its own is worth very little.

Citations have to point at something a reviewer can open. A summary of a policy section is not a citation, because checking it means redoing the work. A reference to the clause, in the version current when the check ran, is.

Two separations matter structurally. The agent reads only what the person it acts for is entitled to read, enforced before retrieval rather than filtered out of the results afterwards. And the agent cannot approve its own work: the step that marks a control as satisfied belongs to an account a human holds.

Who is accountable when an AI compliance agent gets it wrong?

The same person who was accountable before it was installed. No regulator, auditor or counterparty accepts 'the model said so' as the reason a filing was late or a control was missed. An agent changes who does the typing, not who signs.

This is the part that lags in practice. Compliance Week and konaAI surveyed 193 compliance, ethics, risk and audit leaders and found adoption of AI tools running ahead of the governance and controls around them. Just over half of those respondents were at companies with fewer than 5,000 employees, so this is not a picture of small firms struggling with something the large ones have solved.

What closes the gap is unglamorous. One named owner for the agent. A written statement of what it may do without a human in the loop. A defined escalation path for the cases it must not decide. And a sample of its output reviewed on a schedule by somebody who would notice if it were wrong.

Where is the safest place to start with a compliance AI agent?

On work that is high volume, low consequence and already read by a person. Evidence collection for controls you already have. Expiry monitoring for certificates, policies, training and insurance. First drafts of questionnaire answers. A list of the places where a policy says one thing and the system does another. In all of those the agent's output is an input to somebody's day, not a decision.

The pressure behind this is real rather than manufactured. LegalZoom's December 2025 survey of 1,000 US small business owners reported compliance weighing on them going into 2026. The SBE Council's February 2026 survey of 517 small employers with 2 to 99 staff found 82% had adopted at least one AI tool, with owners saving a median of five hours a week. A further LegalZoom survey of 1,000 founders and owners in January 2026 landed on the sharper version: people reach for AI to move faster, then turn to human guidance when the risk is real.

That instinct is a good design rule, not a hesitation to engineer away. Keep the first version boring. An agent that attaches the right evidence to the right control with a citation is less impressive than one that writes opinions, and considerably more likely to survive its first audit.