AI in Compliance — Use It, But Know Where It Bites

I built an AI/LLM governance framework for a health-tech company. I also use AI tools in my own compliance practice every week.

So this isn't an anti-AI post. It's a "here's where AI will quietly wreck your audit" post.

Where AI is genuinely good at compliance work

• First drafts of policies and procedures
• Mapping controls across frameworks (SOC 2 ↔ HIPAA ↔ ISO 27001)
• Summarizing auditor requests and organizing evidence
• Accelerating security questionnaire responses

But here's where the failure modes show up in real audits

The policy-reality gap

AI writes beautiful, comprehensive policies — describing controls your company doesn't actually run. Auditors don't grade your prose. They test whether you do what your documents say. A gorgeous AI-written policy that overpromises is worse than a plain one that's accurate, because now every gap is a finding.

Questionnaire overcommitment

Teams point AI at a 300-question security review and ship the confident-sounding answers. Those answers become contractual representations. "Yes, we perform quarterly access reviews" is a legal commitment, not filler text.

Hallucinated specifics

Control IDs that don't exist, framework requirements misquoted, citations to outdated versions of standards. If nobody on your team can verify the output, you shouldn't be shipping it to an auditor.

Data leakage in the workflow

Pasting risk registers, pen test findings, or customer contracts into consumer AI tools with no enterprise agreement in place. Your compliance workflow shouldn't itself be a vendor risk finding.

No human on record

When the auditor asks "walk me through how you made this risk decision," someone has to actually own the answer. "The tool generated it" is not a governance posture.

The pattern underneath all five: AI compresses the writing, but it can't compress the knowing. Compliance documents are only valuable because they represent something true about your organization.

AI can help you say it faster. It can't make it true.

My rule for clients: AI drafts, humans attest. Every policy, every questionnaire answer, every piece of evidence gets reviewed by someone who can defend it in an audit room — because eventually, someone will have to.