AI in Risk and Compliance: Mind the Expectation Gap

As a lawyer who remembers practice before the internet and email, not to mention floppy disks and cassettes, I feel a degree of trepidation about the growing reliance by law students and junior lawyers on AI-assisted research.  Although the instantaneous collation and dissemination of information is impressive and indisputably useful, I am troubled that AI research is too surgical and risks diluting – or in some cases removing – the art of lateral thinking.

Please do not think me a Luddite – to the contrary, as a computer hobbyist in my teenage years (and fondly remembering my first computer, the mighty Sinclair ZX81), I have always been an enthusiastic proponent of technology.  However, experience has shown that technology is one area where you need to first learn to run before you can sprint, particularly when relying on AI to inform professional judgment or produce work on which others may rely.

A particular concern is that generative AI can produce convincing, but entirely fabricated, legal authorities.  This arose recently before the Royal Court of Guernsey in The States of Guernsey v Steven Terrance Ogier [2026] GRC030, a case in which the unrepresented respondent acknowledged using AI to assist with his submissions.

Referring to the growing problem of AI-generated “hallucinations” – where AI presents false or misleading information as fact – “infecting legal arguments”, the Royal Court emphasised that AI is neither authoritative nor an infallible source of legal knowledge. The Royal Court made it clear that the English Court’s guidance is that “all parties – represented and unrepresented – owe a duty to the court to ensure that cases cited in legal argument are genuine and provide authority for the proposition advanced is of indisputable importance for matters before the Royal Court of Guernsey.”

On the other side of the globe, however, a judge of the Federal Court of Australia made an order requiring the parties to explore the use of AI to slash “enormous” legal costs, stating that “our lodestar should be using AI to implement reforms allowing lawyers to spend more time exercising professional judgment”.  So, even the courts are grappling with the appropriate role of AI in the legal world.

Which brings me to the subject of this article – the increasing use of AI in risk and compliance.

AI in risk and compliance

I have watched the rapid emergence of generative AI products in the compliance world with interest, including promises to revolutionise customer due diligence (CDD) collation and assessment with reduced (human) labour costs.  I am aware that some large financial institutions have already implemented such systems to accelerate onboarding and manage the significant volume of new customers processed each week.

Last year, Moody’s conducted a global study on the real-world adoption of AI in risk-related compliance, and the results were interesting.  In particular:

• The use of AI in compliance had surged to 53%, up from 30% in 2023;
• Fintech, asset and wealth management, and professional services are the main adopters of the technology, while government and corporate sectors are approaching it more cautiously;
• 62% of those surveyed expect widespread AI adoption within three years;
• 84% of those surveyed agreed that AI offered significant strategic advantages, but only 30% of them had actually seen reality meeting expectations in practice; and
• The shift in the industry from speculative investigation of the use of AI to real world use.

The use of AI in risk and compliance often involves the use of software to perform analytical jobs using algorithms and data in short order, which would otherwise take us ‘mere’ humans many tedious hours to complete.  This covers a wide range of areas including customer CDD to identifying suspicious activity.

Of course, the use of software in compliance is by no means new.  It has been around for years, largely centring around the searching and collation of data.  For those of us on the receiving end of compliance reporting, especially those involving a large number of adverse media “hits” for an individual, the benefits of AI analysing that data to eliminate false positives and irrelevant data, and to highlight results which are of significant concern, is certainly appealing.

In my view, there is no doubt as to whether AI will be adopted widely in the risk and compliance sector, it is inevitable.  However, AI remains new technology, and, as with all new technologies, there are both known and unknown risks, including hallucinations, false positive and negatives, data protection and confidentiality breaches.

Another troubling issue with AI-driven compliance from a regulatory perspective is AI models making decisions in complex and obscure ways that humans cannot readily ascertain or understand, an issue known as the “Black-Box Problem”.  This creates a significant issue for businesses which may later have to explain or justify an AI-driven compliance decision to a regulator.

Moody’s report found that the majority of people surveyed recognised the need for human oversight, which is essential and unlikely to ever be removed, despite how advanced AI technology becomes.  However, the degree and form of human oversight raises more questions than it answers:  How much oversight is needed?  How often?  By whom?  Quality or quantitative or both?

ai and regulators

In stark contrast to the rapid advancements of AI technologies, regulators tend to move slowly by necessity. Consultation, research, and thorough decision-making processes are generally required before regulation can be introduced or amended. With AI evolving and being adopted by businesses at considerable speed, regulators around the world are inevitably playing catch up.

The Guernsey Financial Services Commission (GFSC) has demonstrated both a willingness and an ability to take a progressive approach to technology.  In July the GFSC issued a guidance note on the tokenisation of real word assets and published its response to its consultation on supporting digital finance growth.  However, it is yet to address the use of AI in risk and compliance specifically.

In January, the GFSC issued a policy statement confirming that its position on AI was to “encourage the adoption of various AI tools and new technological developments”, while making clear that it did not propose to introduce specific rules or guidance at that stage.  This was followed by a “Dear CEO” letter in July reminding regulated businesses that they remain responsible for ensuring their systems are capable of meeting the rapidly-changing technological environment.  Finally, at least for now, in August the GFSC announced that it had enhanced its website to make its content more accessible to AI-powered search and summarisation tools.

Whether the GFSC and other regulators globally can continue without directly regulating the use of AI in risk and compliance – and the software and providers involved – remains to be seen.  Given the pace and scale of adoption, it may be optimistic to believe the current position can be maintained for much longer.

In the meantime, businesses will need to take a pragmatic and vigilant approach to the use of AI in risk and compliance, while keeping their feet firmly planted in the reality of what AI may be capable of in future and what it can deliver now.  There is a reason why today is not tomorrow.

For more information please reach out to Simon or one of our other Guernsey lawyers here.