The most useful adoption number for the compliance and risk function comes from Thomson Reuters: 53% of compliance teams are piloting or using generative AI, primarily for regulatory horizon scanning, policy summarisation, and audit preparation. The Anthropic Economic Index corroborates the picture from a different angle, naming compliance analysts as one of the highest-Claude-usage professions in the dataset.
In a function that has historically been late to new tooling, the pace is striking. The reason is not enthusiasm. It is regulatory volume.
The volume problem AI is actually solving
The job of horizon scanning, reading every relevant regulator, every consultation paper, every enforcement action across the jurisdictions a business operates in, has been mathematically impossible for a single team for years. Most compliance functions ran on a triage of subscriptions, vendor newsletters, and the hope that the lawyer reviewing the quarterly bulletin would catch what mattered.
Generative AI is changing this in a specific way. Tools from Thomson Reuters CoCounsel, LexisNexis Protégé, and a category of newer compliance-specific platforms (Norm Ai, Greenlite, Hadrian, Themis) ingest regulatory feeds, statute changes, and enforcement actions, then surface what is relevant to a particular business in language a compliance officer can act on. The volume that used to be unprocessable has become processable. The compliance team’s job has shifted from “did we miss something” to “we caught the change, now what is our response.”
Policy summarisation is the second category that has moved fast. Compliance teams produce a lot of internal artifacts (policies, procedures, training documents, FAQs) that get long, redundant, and difficult to maintain. AI is genuinely good at compressing these into accurate, role-specific summaries. The use case is unglamorous but it is one of the most consistent productivity wins in the function.
Audit preparation, the third leg
Audit prep has historically been the worst part of the compliance year. Pulling evidence, mapping controls to frameworks, writing narratives that explain what the team did and why, drafting management responses to findings. The work is high-volume, repetitive, and demands precision.
The teams that have integrated AI into audit prep most effectively are using it for three specific subtasks. Drafting evidence narratives from raw control logs, where the AI converts a list of system events into the prose explanation an auditor needs. Mapping new controls to multiple frameworks at once, so a SOC 2 control gets cross-referenced to ISO 27001, NIST, and an internal taxonomy without the analyst doing it by hand. Drafting management responses to findings in a tone that is consistent with prior years, which sounds trivial but used to take significant senior time.
The failure mode worth naming, because it has happened to enough teams that auditors are now watching for it: AI-generated narratives that read fluently but contain control claims the team cannot actually substantiate. An auditor who asks “show me the evidence for this statement” and gets a blank stare is going to find a lot more next time. The teams that get this right have a strict workflow where AI drafts, a human verifies against the source data, and nothing reaches the auditor that has not been ground-truthed.
Why this profession’s AI rollout is different
Most professions adopting AI run into the “model is confidently wrong” problem and accept some level of error in exchange for speed. Compliance and risk cannot. The whole function exists to prevent confidently-wrong outputs from reaching customers, regulators, and shareholders.
This produces a different shape of adoption. The teams that have moved fastest are not the teams using the most adventurous tools. They are the teams that have built tight verification workflows around conservative tool choices. They run AI inside a sandbox, with human review at every step that touches an external party, with an audit trail of every prompt and output. The compliance leaders who have written this discipline into their team’s standard operating procedure are reporting real productivity gains. The leaders who let staff use public AI tools with no governance have either had a near-miss or are about to.
The regulatory pressure is now pointing in the same direction. The EU AI Act, US state-level requirements, and sector-specific guidance from the SEC, OCC, FCA, and APRA are all converging on the same expectation: an organisation using AI in a high-stakes function needs to be able to show what the AI did, why, and who reviewed it. Compliance teams are sitting at the centre of this. They are both users of AI and the function responsible for governing it across the business.
Where the function’s role is expanding
AI is making compliance work more strategic, not by reducing the workload (regulatory volume keeps going up) but by changing where the working hours land. The compliance officer who used to spend most of the week on horizon scanning and policy maintenance now has time to spend on advising business units on real risk decisions, designing controls into new products before they ship, and engaging with senior leadership on strategic risk questions.
The role is also expanding to absorb AI governance itself. Most large organisations now have an AI policy, an AI risk register, and an AI use approval process, and most of them sit in compliance. This is durable scope expansion. AI is not going to retreat from the business, the policy and oversight footprint around it is only going to grow, and compliance and risk are the natural owners.
The professionals best positioned in 2026 are the ones who can both use AI as a tool inside their own work and govern AI as a category for the rest of the business. That dual fluency is rare today and increasingly central to how the function is hired into.
What changes through 2027
Three shifts are visible in the pipeline.
Regulatory tooling consolidates. The market for compliance-specific AI tools is currently fragmented across point solutions for horizon scanning, policy management, transaction monitoring, and KYC. The 2026 to 2027 period is when the larger vendors absorb the categories into integrated suites, and compliance teams will be making platform decisions rather than tool decisions.
Audit and exam expectations harden. The major audit firms and regulators have been giving compliance teams a soft landing on AI use during 2024 and 2025, asking questions but not penalising bad answers. The pattern in regulator behaviour suggests this leniency is ending. Teams that have not put governance on their AI use during the soft period will feel the difference.
The career path bifurcates by AI fluency. The compliance officers who can both work with AI and govern it will continue to move up. The ones who cannot will find their roles compressed back to the parts of the work that are mechanical and increasingly automated. This is the same bifurcation showing up in many professions, but in compliance the regulatory direction makes it move faster than most.
The function is not going away. It is concentrating into fewer, more capable teams, doing more strategic work, with AI as both a tool and a thing to govern. The compliance professional who builds AI fluency in 2026 is positioning for the version of the role that exists for the next decade.