AI in compliance: a capability, not the product

R002APPLIED AI · FINANCIAL SERVICESFenori Technologies, August 2026

Every compliance technology conversation now arrives at AI within minutes. The pressure on institutions is real: boards want an answer, vendors lead with it, and the volume of information a compliance function must understand has outgrown what any team can read.

Our view is deliberately unfashionable: AI is a capability, not the product. It belongs in an institution’s compliance operation exactly where it makes the institution more capable, and nowhere else.

Where AI genuinely makes institutions more capable

There are compliance problems where AI is not an enhancement but the only realistic answer. Understanding information at a scale no team can process manually (transaction narratives, adverse media, customer files, regulatory change) is the clearest case. Connecting context that today lives in a dozen disconnected systems is another: the value is not that a model reads one document well, but that the institution’s full context can finally bear on a single decision.

AI also earns its place removing work that should never have required people: the repetitive assembly, summarizing and cross-referencing that consumes skilled analysts, and supporting complex decisions by putting the relevant history, policy and precedent in front of the person who must decide.

Where it does not belong

Where AI does not improve the outcome, it does not belong.

A model bolted onto a workflow to satisfy a roadmap slide adds risk without adding capability. And there are places where the question is not whether AI performs well, but whether it should be deciding at all. The exercise of institutional judgment (risk appetite, regulatory interpretation, the decision to file, to exit, to escalate) is the institution’s alone. Technology should make that judgment better informed, faster, and easier to evidence. It should not quietly become the judge.

The governance test

For a regulated institution, the practical questions that matter are governance questions, and they are answerable in plain language:

Who decides where AI is permitted? The institution, not the vendor’s defaults. The institution determines where AI is permitted, what it can access, and where human authority remains absolute.

Where does the data go? For consequential systems, the credible answer is: nowhere. Serious institutional AI should be designed to operate inside the institution’s own environment, using models the institution has approved, so that data, identity and permissions remain governed by the institution.

Can outcomes be explained afterwards? Decisions, inputs and actions should be preserved so consequential outcomes can be reconstructed: for the second line, the auditor and the supervisor. An AI capability that cannot support that reconstruction has no place in a regulated process.

None of this is a Fenori invention. Article 14 of Regulation (EU) 2024/1689, the Artificial Intelligence Act, requires that high-risk systems be built so that natural persons can effectively oversee them, and places on the deployer the duty to give those persons the competence, training and authority to do it. Article 12 of the same regulation requires that such systems record events over their lifetime to a degree appropriate to their purpose. The NIST AI Risk Management Framework (AI 100-1, January 2023) arranges the same obligations under a GOVERN function that sits above measurement rather than beside it: who is accountable is settled before what is measured. NIST’s later TEVV-Athlon framework (AI 200-2, initial public draft) extends the same posture into how systems are tested and evaluated.

Whether a particular compliance system falls inside the AI Act’s high-risk classification is a question for the institution and its counsel, not for a vendor. The governance position above is worth holding either way.

Capability, not theater

The institutions that will benefit most from AI in compliance are not the ones that adopt it fastest, but the ones that adopt it most deliberately: grounded in their own data, deployed inside their own environment, scoped by their own governance, and aimed at outcomes they have defined themselves.

That is harder than buying an AI feature. It is also the difference between adding software and becoming more capable.