AI pays first in compliance and reporting work on the reading and assembling: tracking regulatory change, keeping an obligations register current, collecting evidence, listing gaps and drafting reports from structured data. Every statement must point to a clause or a source figure. Interpretation, conclusions, sign-off and anything lodged with a regulator stay with qualified people.
This is general information, not legal advice.
Key takeaways
- Start with reading and assembling: regulatory change, the obligations register, evidence, gap lists and first drafts.
- In compliance work, an AI error is the product's error, so every statement must cite its clause or source figure.
- According to Stanford RegLab and HAI, general-purpose models hallucinated on 69% to 88% of specific legal queries in 2023 testing.
- New obligations keep arriving, including AUSTRAC's tranche 2 reforms from 1 July 2026.
- One owned, versioned register of obligations and approved interpretations is what every person and AI should read.
Where does AI pay first in compliance and reporting?
It pays first on high-volume reading and assembly that a qualified person can check against a source. That means summarising regulatory updates, proposing changes to an obligations register, gathering evidence, pre-filling questionnaires from earlier answers and drafting reports from structured data. The judgement stays with people.
| Job | What AI prepares | What the person checks |
|---|---|---|
| Regulatory change | A summary of each update and the obligations it may affect | Whether it applies, and how |
| Obligations register | Proposed new or changed entries, each citing its clause | The interpretation |
| Evidence collection | Documents gathered and matched to controls, with gaps listed | Whether evidence is sufficient |
| Questionnaires | Answers pre-filled from approved earlier responses | Accuracy for this client |
| Report drafts | Text and tables built from structured data | Every figure against its source |
Each job is frequent and checkable, because the source sits right beside the draft. That is the test for any first workflow, and compliance work passes it more often than most.
Why must every statement cite a source?
Because in compliance and reporting the output is the product. A wrong figure or a misread clause is not a typo; it is a failure of the service a client paid for. A draft in which every statement cites its clause, document or data cell can be checked quickly, and a draft without citations cannot.
General AI tools are confident and often wrong on precise regulatory questions. According to Stanford RegLab and HAI, state-of-the-art language models hallucinated on 69% to 88% of specific legal queries in their 2023 testing. Those were general-purpose models without a firm's own sources, which is exactly why citations matter.
The deeper risk is output that looks right. A report with clean formatting and plausible numbers invites a quick read rather than a check. The guide to plausible output explains why that is more dangerous than obvious errors, and why the check has to be built into the workflow.
What should stay with people?
Keep interpretation of the law, the conclusion or opinion a report reaches, sign-off, anything lodged with a regulator, and advice to clients. AI can assemble the evidence, draft the analysis and flag inconsistencies. A qualified person decides what the rule means for this client and signs what goes out.
The National AI Centre's guidance points the same way. According to its Guidance for AI Adoption, published in October 2025, organisations should decide who is accountable, test and monitor their AI, and maintain human control. For a compliance business those three practices map neatly onto named owners, checks against source, and sign-off.
Clients often ask whether AI did the work. The honest answer is that AI prepared it and a named person checked and approved it. Keep a record of who approved what and when, so the answer can be shown rather than asserted. The guide to AI audit trails covers what to record.
Which regulatory changes create the most work?
New regimes create waves of reading, mapping and reporting, which is exactly the work AI handles well. Recent Australian examples include AUSTRAC's tranche 2 reforms and APRA's operational risk standard. Each brings new obligations to interpret, new evidence to gather and new reports to prepare, usually against fixed dates.
According to AUSTRAC, from 1 July 2026 anti-money laundering obligations apply to certain services typically provided by lawyers, conveyancers, accountants, real estate businesses and dealers in precious metals and stones. Each newly regulated business needs an AML/CTF program, a compliance officer and customer due diligence.
Prudential rules have moved as well. According to APRA, CPS 230 has set "minimum standards for managing operational risk", including business continuity and service provider management, for all APRA-regulated entities since 1 July 2025.
For a compliance or reporting business, each regime means many clients asking similar questions at once. AI can draft the common analysis once from the regulator's own text, then tailor it per client for a person to check.
How should a compliance business start with AI?
Start with regulatory change monitoring or evidence collection, measured against how long it takes today. Move staff onto business AI plans, keep client data in the business's own accounts, connect AI to document stores read only, and have a qualified person check every output for a month before widening it.
- Pick one job. Regulatory change summaries are a good first choice, because the source is public.
- Require citations. Every statement points to a clause, document or figure.
- Connect read only. AI reads the register and the evidence store; it changes nothing.
- Review everything. A qualified person checks each output against its sources for the first month.
- Measure. Track hours per update or per evidence request, and how often drafts needed correcting.
The six practices in the National AI Centre guidance make a useful checklist for this stage.
Why does a compliance business need one source of truth?
Because the firm's interpretations are its intellectual property and its risk. If each analyst's AI works from its own reading of a regulation, clients get different answers to the same question. One owned, versioned register of obligations and approved interpretations keeps every draft consistent and every change recorded.
That register holds each obligation, the clause it comes from, the firm's approved interpretation, its owner and the date it was last reviewed. When a regulator issues something that contradicts an entry, the change goes to the owner rather than being merged automatically. Method sits alongside it: how an evidence review is run, how a report is checked. Each client's own data stays in that client's workspace.
Skein builds a Company OS for compliance and reporting businesses: what is true about the business held in sets that are each canonical, sourced and owned, with anything contradictory sent to a person and nothing sent without a named person approving it; the Company OS page shows the three layers. That suits a firm of 10 to 200 people whose staff already use AI. A firm that wants AI to sign off reports, or one with its own AI platform team, is not a fit.
Frequently asked questions
How is AI used in compliance?
Mostly for reading and assembling: summarising regulatory updates, proposing changes to an obligations register, collecting evidence and matching it to controls, pre-filling questionnaires and drafting reports from structured data. A qualified person checks each output against its sources. Interpretation, conclusions and sign-off stay with people who carry the responsibility.
Can AI interpret regulations?
It can summarise and draft an interpretation, but a qualified person should decide what a rule means for a particular client. General AI tools still hallucinate on precise legal questions. Ask AI to cite the clause behind every statement, then have a person check each citation before anything reaches a client or regulator.
How do you stop AI errors in compliance reports?
Require every statement to cite its source clause, document or data cell, and check figures against the source before sign-off. Connect AI to data read only, keep one versioned register of approved interpretations, and record who approved each report. Clean formatting is not evidence of accuracy, so the check must be deliberate.
What is an obligations register?
An obligations register lists every regulatory requirement that applies to a business, the clause each comes from, how the business interprets it, which controls address it, who owns it and when it was last reviewed. Kept current and versioned, it becomes the source every person and AI reads for compliance work.
Where should a compliance business start with AI?
Start with one frequent job that has a public source, such as regulatory change summaries. Move staff onto business AI plans, connect AI to document stores read only, require a citation for every statement, and have a qualified person check every output for a month before measuring the time saved.
Related reading
- Stanford HAI. "Hallucinating Law: Legal Mistakes with Large Language Models are Pervasive." Stanford University, January 2024. https://hai.stanford.edu/news/hallucinating-law-legal-mistakes-large-language-models-are-pervasive
- Department of Industry, Science and Resources and National AI Centre. "Guidance for AI Adoption." Australian Government, 21 October 2025. https://www.industry.gov.au/publications/guidance-for-ai-adoption
- AUSTRAC. "AML/CTF obligations factsheet for tranche 2 reporting entities." AUSTRAC, updated July 2025. https://www.austrac.gov.au/sites/default/files/2025-07/AMLCTF_obligations_factsheet_for_tranche_2_REs.pdf
- APRA. "Operational risk management (CPS 230)." Australian Prudential Regulation Authority, accessed 30 October 2026. https://www.apra.gov.au/operational-risk-management