1 New realities in compliance

Most of the work in compliance departments today is largely organized manually, at least on the surface. The reality, however, is different: Many employees are already using AI-powered tools at their own discretion and without uniform guidelines. This leads to noticeable individual time savings and, consequently, to higher individual productivity in day-to-day operations.

At first glance, the use of AI appears to improve the quality of the content produced - and in many cases, this is indeed true. At the same time, however, a countervailing effect is evident: users tend to scrutinize AI-generated content less critically and place greater trust in its plausibility. In research, this phenomenon is described as “automation bias” - that is, the tendency to place too much trust in automated results and to scrutinize them insufficiently. In practice, this means that subtle errors - such as inconsistent terminology, redundancies, or statements of questionable content - more often go undetected, as they appear plausible upon superficial review. [1]

At the same time, the volume of texts and documents required to meet the wide range of regulatory requirements is growing. Given the limited quality control, this also increases the potential vulnerabilities for auditors. As the amount of information increases, so does the likelihood of duplicates, contradictions, and ambiguities within the document repository.

Compounding the issue is the fact that auditors are also increasingly using AI in their work. Simple prompts based on the content to be reviewed, combined with the relevant regulations, are sufficient to uncover a range of likely deficiencies. This has far-reaching consequences: inquiries and follow-up questions are on the rise, as auditors no longer need to limit themselves to individual focus areas but are able to systematically work through the entire scope of documentation. This semi-automated process also takes significantly less time. As a result, the pressure on the compliance department increases considerably.

This development is not an isolated case but rather reflects an industry-wide trend. A global survey conducted by the market research firm IDC among more than 1,000 professionals in auditing and accounting shows that two-thirds (66%) of auditors are already actively using AI - whether in pilot projects, in specific application areas, or as part of their firm’s strategy [2]. Expectations for the technology are also clear: In a PwC study of finance and accounting executives, 76% of respondents expect AI to bring about massive technological changes to financial statement audits in the coming years; just as many believe that audits can be at least partially automated as a result [3]. The profession itself has also responded: In February 2025, the Chamber of Public Accountants published its first catalog of questions and answers on the use of AI in public accounting practice, intended to professionalize the handling of the technology and raise awareness of the associated risks [4]. At the same time, regulatory pressure on the compliance side is also growing noticeably: In the first year alone under the Digital Operational Resilience Act (DORA), over 600 serious ICT incidents were reported to BaFin - a reporting volume that is significantly higher than the figures under the previous PSD2 regime [5]. This development is thus unfolding simultaneously on multiple levels: auditor tools, professional standards, and regulatory regimes are shifting in parallel - and narrowing the window of opportunity for compliance departments to catch up.

Figure 1: Market Indications of an AI Transformation in Auditing

A specific example from a client illustrates this trend: As part of a DORA-specific information request, an external auditor sent what initially appeared to be a routine inquiry to the compliance department of a financial institution. In response, a comprehensive set of documents was provided - consisting of guidelines, process descriptions, risk analyses, and supporting documentation spanning multiple regulatory areas. Within just three hours, targeted follow-up questions were raised: The auditor identified missing documents that were explicitly referenced in the submitted materials, pointed out terminological inconsistencies between individual guidelines, and questioned version numbers that did not match the change history documented. What had formally begun as a limited request for information resulted, through the AI-supported comparison of the documents, in a nearly complete review of the written compliance framework (sfO) - a scope that went far beyond the original request and caught the compliance department completely off guard. Tasks that would have taken an auditor days to complete in the past were finished in a fraction of the time. Such a precise and rapid response drastically reduces the margin for error and puts the compliance department on the defensive.

This blog post examines how the balance of power between compliance organizations and their auditors is fundamentally shifting due to the mutual use of AI. It analyzes the structural risks of uncontrolled AI use in document generation, highlights the changing dynamics on the auditors’ side, and poses the central question: How must a compliance department position itself to thrive in an environment where speed and audit depth are no longer limited by human capacity constraints?

2  AI as a Tool for Auditors

Consulting practice shows a clear trend in which auditors are increasingly using AI-powered tools in their audit work. This trend is reflected in typical patterns: They specifically reference particular paragraphs, systematically compare documents with one another, and identify inconsistencies across various documents. Given the volume of data and lessons learned from past audits, this approach clearly points to the use of AI. The result: answers and follow-up questions are not only provided more quickly, but the scope of content analyzed is also significantly broader - rather than being limited to selected focus areas, as was previously the case.

Auditors have a structural advantage here: Their task is to identify anomalies, and even a random sample is sufficient to formulate objections. This exact task can be easily accomplished with today’s standard AI tools such as ChatGPT, Claude, or Gemini - no specialized tools are required.

The barrier to entry is remarkably low as standard access to one of the aforementioned tools, a well-crafted prompt, and the documents to be reviewed are all that’s needed to achieve structured results within a few hours.

In practice, this means that the regulatory framework and the relevant sections of the written policies are fully fed into the tool. With a targeted prompt, inconsistencies or the degree of compliance with individual requirements can be identified quickly. While this does not guarantee the detection of all findings - that is not the goal anyway - a well-founded sample is sufficient for the auditor to make effective determinations.

This creates a fundamental imbalance for the compliance department: While auditors can conduct audits much more effectively with minimal effort, the opposite goal - complete, consistent coverage of all regulatory requirements - cannot be achieved using the same methods. The following chapter explains why this is the case.

3  No Out-of-the-Box AI for qualitative compliance work

Compliance work differs fundamentally from the work of an auditor. While an auditor need only identify anomalies in a sample, the compliance department is responsible for ensuring complete coverage across all regulatory levels. Every requirement must be addressed correctly and appropriately - the department bears the responsibility and risk for any findings. Or, in short:

The auditor looks for a needle in a haystack. Compliance must ensure that there isn’t one. With AI, however, the auditor no longer searches just with the naked eye, but with a magnet.

Any regulated (financial) institution that fails to actively address this problem will inevitably find itself on the defensive.

Generally speaking, AI excels at purely text-based tasks - comparing target values against actual values, formulating instructions and guidelines, identifying inconsistencies, and so on - which is precisely what compliance work largely entails. However, as complexity increases (in terms of problem size and interdependencies), so does the inaccuracy of the results. This applies above all to dependencies between various regulations and documents within the written framework, as well as to implicit knowledge and established procedures that are not explicitly documented but remain essential for technically correct processing - such as well-established coordination processes or context-dependent prioritization. Human employees are familiar with these organizational and technical workflows; for AI, they must first be modeled. Compliance work is therefore not a task that can be solved with standard, out-of-the-box AI functionality.

Figure 2: AI Advantage for Auditors vs. Compliance Lag

This results in a noticeable imbalance because the auditor’s AI tools are significantly more accessible and require no time-consuming customization, while the compliance side relies on specialized solutions to achieve a similarly strong effect through technological leverage.

To resolve this imbalance, AI functionality in compliance must be designed to understand implicit structural information in regulations and written policies and to map out technically correct working methods. This is achieved through targeted modeling of the regulatory structure, the corporate context, and the control architecture. To this end, AI structural models, taxonomies, rulebooks, and contextual data are made accessible. Only specialized tools built on such a foundation can reliably and precisely handle compliance tasks and ensure the required completeness and consistency.

This fulfills a necessary, but not yet sufficient, condition because specialized AI tools address the qualitative gap in compliance work, but do not solve the overarching problem of growing audit pressure. This requires a holistic vision that goes beyond individual tools.

We have already discussed this issue in detail in our previous blog post "An innovative approach to automate compliance work".

4  The path to an integrated compliance vision for restoring balance

Compliance work ranges from designing processes and content based on regulatory requirements, through their implementation, to ongoing monitoring. It is a system that must be viewed holistically, as only the interaction of all levels provides a complete response to regulatory requirements.

Figure 3: AI use cases within the framework of policy management (written policy framework)

AI can automatically map individual work steps within this system. However, this does not apply across the board to all activities, but exclusively to those that have been precisely modeled and implemented from a technical standpoint. The goal must therefore be to define a target state in which work steps that can be supported by machines are specifically mapped by AI, information flows and is stored seamlessly and traceably, and transparency regarding status and process is maintained at all times. Only then will end-to-end work along the entire process chain be possible - within an integrated system landscape.

Once the target vision has been defined, the AI components for the individual work steps have been designed, and they have been integrated in a way that achieves the desired goals, this results in fundamental advantages:

• Consistent assurance of accuracy across the entire text corpus

• Complete transparency regarding the status of compliance through dashboards and similar tools

• Significantly improved predictability when addressing findings - not just under the pressure of an impending audit

• Significant savings in resources spent on non-value-adding activities

Even today, specific functionalities can be reliably implemented with automated support, as the following examples show:

Regulation vs. Written Policies: A Side-by-Side Comparison

A key step is the target-to-target comparison - that is, the systematic comparison between regulatory requirements and written policies. This ensures three tests:

1. Consistency between the sfO and regulatory requirements

2. Consistency among the sfO documents themselves

3. Completeness of the written rules relative to regulatory requirements

The use of AI enables these tests to be performed continuously - not just shortly before an audit, but at any time. The results are presented transparently, for example via a dashboard, so that even non-specialists are informed of the current status at all times. This approach makes the problem manageable in the long term, reduces short-term workloads, and leads to continuous improvement in documentation quality. In the long run, this will relieve specialists of detailed tasks, allowing them to refocus on long-term strategic initiatives.

Figure 4: Continuous Testing and Dashboard Functionality

Another area is the technical target-actual comparison. The capabilities for an automated comparison between specifications and actual technical implementation are no longer a rarity today and are usually found as part of more comprehensive GRC tool suites. Based on technical standards such as the CIS Benchmark, sets of rules are defined that continuously compare implementation against the instructions by accessing the technical infrastructure and configuration. Technical target-actual comparison can therefore already be automated with a high degree of reliability today.

Organizational Target-Actual Comparison: Guidelines vs. Actual Practice

Organizational target-actual comparison, on the other hand, has not yet been implemented. Theoretically, an agent could be developed to extract evidence from unstructured information in systems and documents in order to determine the target-actual status at the organizational level. The basis for such a tool would be a curated and structured repository of instructions and system configurations, on the basis of which evidence could be collected and assigned. It is expected that this process will be at least partially automatable in the foreseeable future.

The examples show that AI in compliance is not just a promise for the future, but is already, in part, an operational reality. What is crucial, however, is that its use is not ad hoc or isolated, but rather embedded in a well-thought-out vision that clearly defines processes, data flows, and responsibilities. Those who begin today to lay the groundwork- structured documentation, clean process modeling, and an integrated system landscape -will not only be able to conduct audits more efficiently tomorrow but will also be able to manage compliance as a continuous, controllable process. The shift from reactive audit preparation to proactive, machine-supported compliance management is not a question of “if,” but of “when” and above all, “how.”

Figure 5: Two Paths to an Integrated Compliance Vision

There are essentially two approaches for concrete implementation. The bottom-up approach begins with a specialized AI tool for a clearly defined compliance task - such as the target-to-target comparison described at the beginning or the technical target-to-actual check. An integrated compliance landscape gradually emerges from several proven individual solutions. This approach offers a fast time-to-value, a clearly measurable ROI, a low barrier to entry, and early learning from concrete use cases, while also providing immediate relief from operational pressure. The top-down approach reverses the order: First, the integrated target architecture is designed with clearly defined data flows, reporting structures, and governance mechanisms, before the individual AI components for specific workflows are implemented within this framework. Its strengths lie in a consistent architecture that eliminates the need for retroactive integration efforts, end-to-end data flows, full leverage through synergies between components, as well as strategic clarity and scalability for future regulatory requirements. In practice, it is advisable to pursue both approaches in parallel, with the top-down target vision providing architectural guidelines, while the bottom-up implemented individual solutions create immediate benefits and continuously refine the target vision based on practical experience. This prevents the emergence of isolated siloed solutions without the organization having to wait for the added value of a well-thought-out overall system.

Start with an honest assessment of the current state and draft a rough vision for your compliance architecture, while simultaneously implementing a clearly defined use case as your first practical building block. In this way, you combine strategic guidelines from the top with quickly measurable benefits from the bottom and actively shape the shift to proactive compliance management, rather than having to catch up later under audit pressure.

Sources:

[1] Exploring automation bias in human–AI collaboration (Springer, 2025).

[2] IDC / Caseware, The Future of Audit and Accounting in the AI Era, February 2026.

[3] PwC, Künstliche Intelligenz im Corporate Accounting und Audit, May 2025.

[4] WPK, Fragen und Antworten zum Einsatz von künstlicher Intelligenz in der WP-Praxis, February 2025.

[5] BaFin / PPI AG, DORA Recap 2025.