A Tuesday afternoon in compliance: three policy reviews waiting, a vendor onboarding stalled because no one can agree on the right steps, and a request from legal for a summary of the current approval workflow, which currently lives across four documents and an email chain from March. You know what needs doing. The hours to do it well are not there.
The part of compliance work that rarely gets named is the structural effort around the decisions, not the decisions themselves. The drafting, the version control, the cross-team translation, the “we need this written up by Friday in a form legal will accept”. That is exactly where AI is changing the day for compliance and risk managers using it well.
Thomson Reuters’ 2025 Generative AI in Professional Services report puts compliance teams piloting or using gen AI at 53%, with horizon scanning, policy summarisation and audit prep as the leading use cases. The teams reporting real time savings are running structured prompts on the same chat tools their colleagues already have.
Where the hours actually go
The last time you built an internal workflow from scratch, or rewrote a process document with gaps, or tried to standardise something across a team doing it four different ways: each of those tasks asked you to hold a lot of context, translate it into clear written steps, anticipate edge cases, assign accountability, and make it legible to people who were not in the room. That is hard, skilled work. It is also the kind of work AI handles a meaningful share of, if you describe the problem to it properly.
Claude and ChatGPT are the right starting tools for individual contributors. For team-level GRC work where the document needs to live inside a control framework, LogicGate, AuditBoard, and Diligent ship AI features integrated with policy management, control testing, and audit prep. The workflow below uses the chat tools, because that is where most of the unblocking actually starts.
A workflow-drafting prompt that produces a usable first draft
Open Claude or ChatGPT and try this on a process you have been meaning to write up:
I am a compliance manager at a [SIZE + INDUSTRY] firm and we are establishing a documented internal process for [SCOPE, e.g. third-party vendor onboarding from initial risk assessment through to ongoing monitoring]. Build a detailed step-by-step workflow covering this end to end. For each step include: the step name, the trigger, who is responsible, who reviews and approves, what documentation is required, the approval criteria, the timing, and any compliance flag. Format as a numbered process with an accompanying table. End with: three places this process will most likely fail under load, a one-page senior-management summary, and a list of controls a future auditor would expect evidence of.
What comes back is not a finished document. It is a strong first draft that would have taken ninety minutes to produce from scratch. You adapt it to your firm, add the institutional knowledge only you hold, and put it in front of stakeholders. AI handled the skeleton. You provided the substance.
That distinction is what most teams get wrong. AI is not replacing compliance judgement. It is handling the blank-page problem so the judgement has somewhere to go immediately.
Reviewing what already exists
Compliance documentation drifts. Language becomes ambiguous, accountability gaps appear, processes get amended informally. Running an existing document through a critical-review prompt catches things human familiarity tends to miss:
I am sharing an internal compliance process document. Review it and identify: any step where accountability is unclear or unassigned; language open to more than one interpretation; any stage where required documentation or evidence is not specified; any logical gap where something could fall through; any section hard to follow for someone unfamiliar with our team; any section that would not stand up to sceptical auditor questioning. For each issue, give me the offending quote, a one-sentence explanation, and a concrete suggested rewrite.
The output is a structured critique you can work through in 20 minutes, the kind of review that in a previous workflow meant scheduling time with a peer who has the same workload and never quite gets to it.
Evidence summarisation, the audit-prep saver
The other category of hours that disappears is audit prep. AI is unusually good at the summary layer if you feed it structured material:
I am preparing an evidence pack for an internal audit covering [CONTROL OR CONTROL FAMILY]. Below are [NUMBER] documents that constitute the evidence: [PASTE OR DESCRIBE EACH]. For each document, produce: a one-paragraph summary of what it evidences, the specific control attribute it supports, any gap the auditor will likely raise, and a one-line note on compensating evidence to include. Then produce an executive summary the audit lead can read in two minutes, highlighting the strongest evidence and the two or three areas to expect questions on.
The auditor still does the audit. You walk in with a pack you have actually read recently, summarised in your own structure, and a list of the questions you should expect.
Documentation as the deliverable
Most compliance professionals treat process documentation as overhead. The ones AI is making most successful have inverted that, treating the document as the asset and AI as the tool that lets them produce and refresh it in a fraction of the time.
A worked example. A risk manager at a mid-sized financial services firm used the workflow prompt above to rebuild their third-party vendor onboarding process from scratch over a single afternoon. The output, after one revision pass and a 30-minute review with the procurement lead, replaced four legacy documents that had been disagreeing for two years. Three months later, an internal audit of the vendor process closed in two weeks instead of the six the team had budgeted, because the documentation matched practice and the evidence was already mapped to the controls.
The failure mode to watch for
AI confidently producing language that sounds compliance-correct while inventing a regulation, a section reference, or an obligation. The model will write “in line with [PLAUSIBLE-SOUNDING RULE], firms must [PLAUSIBLE-SOUNDING REQUIREMENT]” with no basis. In a document other people will rely on, that is an audit issue.
Two safeguards. Never let AI invent a regulatory citation. Provide the regulation text in the prompt and ask it to translate, or verify every citation against the source before publishing. Second, do not paste real personally identifiable information, account data, or client material into a general-purpose tool unless your firm has approved it with a data-handling agreement. The enterprise versions of these tools, or AI features inside LogicGate and AuditBoard that operate within your control environment, are where regulated material belongs.
The professional case for building this now
The compliance and risk professionals who will have the most capacity for strategic work over the next few years are the ones building these habits in their first-line work today. Not because AI will do their jobs for them. Because the people who have learned to delegate the structural work to a machine, while keeping the judgement work close, will be operating at a level that was not previously available to a single person or small team.
Knowing how to prompt well, what to delegate and what to retain, how to verify outputs against the regulation rather than the model’s confidence, and how to integrate these tools into a function that has to be defensible: that is a practical, learnable skill set. The Tuesday afternoon at the start does not have to look like that. It requires knowing where to start, and starting.