AI in Compliance: What CCOs Need to Know

“Artificial intelligence in compliance.”

If those words sent a shiver down your spine, you’re not alone.

Many CCOs feel they’re not up to speed on AI: what exactly it is, whether it’s a good thing, or how it’s changing compliance.

The general impressions you hear out in the wild are no help either. Despite being the most talked-about technological development of the decade, much of the rhetoric around AI is, like everything else these days, overheated and without nuance.

“AI is a disaster for anyone who has a job.”

“AI will bring utopia.”

“AI is already superhuman; anything you do today, one day AI will do better.”

It’s exhausting. And mostly, it’s empty noise.

That’s why Hadrius hosted a webinar session designed to cut through it.

‍

‍

AI in Compliance: What CCOs Need to Know is a non-technical, zero-hype overview of the role AI has to play in compliance automation. In the session, we cover:

• How to think about AI. What a model is, what training does, and what the application layer adds.
• How compliance AI works. Where it’s reliable, where it isn’t, and how transparency gets built in.
• Ways to start practicing. Simple places to begin using AI yourself.

Here are some of the most important takeaways from the session.

AI is the new steam power

Or at least, you can think of something like steam power or electricity to understand the effect AI will have on the way machines operate.

When a new technology arrives, peoples’ first inclination is to use it to do the old job better, faster, and cheaper. But true transformation takes place when the technology is harnessed to create something truly new.

Picture a steam engine hitched to a carriage. It works. It's faster than a horse. It is also a complete waste of what you have just been handed. The locomotive is the point, and the locomotive required rails, stations, timetables, and a continent's worth of capital before anyone got anywhere.

Plenty of compliance vendors are still running the carriage version. They keep the lexicon that flags a list of forbidden words, then bolt AI on afterward to clean up the false positives the lexicon generated.

“AI-native” means something that is built from first principles to do the work in light of the capabilities of AI — which, in this case, make lexicon review unnecessary. In Hadrius marketing, AI reads the piece top to bottom as the first step, for context rather than keyword matches. That cuts false positives, and it also catches true positives a lexicon would have waved through, because a phrase can promise a return without using any of the words on the list.

AI is also like steam power and electricity in that the promise lies not in the raw power itself, but in the structures that are engineered to capture that power and use it to produce something that could never have existed before.

That’s what Hadrius is building for compliance.

Agentic compliance is like running a team

A large language model is raw intelligence. It’s read an enormous amount of text but knows nothing about your firm, your manual, your risk tolerance, or the rep who keeps forgetting to log his outside business activity.

Getting from the LLM to something useful to an enterprise function like compliance takes two more steps: Training and resourcing, which is access to your systems and your data and your context, and an application layer, which is software that decides what the intelligence is prompted to do, what it is allowed to see, and where its output goes. That complete package is what agentic compliance infrastructure like Hadrius is.

Think about hiring a very sharp college graduate. Enormous talent, zero experience. You bring them into the office, you show them the systems, you give them a defined role, and you calibrate what you hand them to what they can actually handle. Agentic compliance works the same way. It is a team of agents doing the reading and the flagging and the cross-checking, reporting to you, a human.

Using agents, in other words, is like managing employees. What you trust the team with determines the work you give it.

Skip the hype by finding the limits yourself

A lot of the noise around AI comes from companies that need a world-historical amount of investment to keep flowing. When the message veers toward salvation or apocalypse, remember there’s a data center bill behind it.

The solution is to familiarize yourself with the technology. Once you personally hit the wall on what AI can and cannot do, a lot of the mystique burns off.

AI is very good at reading large volumes of text, which happens to be most of what compliance is. It’s competent at writing and still a poor choice for interfacing directly with a human on a sensitive subject. It finds patterns well and exercises judgment less capably than a human, since judgment involves innumerable considerations the algorithm has no access to. AI is a strong research partner and an unreliable authority that will absolutely hallucinate a citation with total confidence.

What’s challenging is that these limits change nearly every week. This means that staying current on AI’s strengths and weaknesses is now part of the job of compliance. Cheap ways to practice: run meeting transcripts through AI, use it as a thought partner on a question you're stuck on, and ask it directly how it would like to be asked. Never put sensitive data into a consumer LLM.

Compliance AI is not generative AI

Generative AI is probabilistic. It guesses, it is opaque about its process, and it produces things that did not exist before. That is the wrong instrument for a function that has to survive an exam.

Compliance AI is AI that has been trained on your firm and lives in an application layer that makes the guessing safe to use. Compliance AI is deployed conservatively, asked to replicate precedent rather than invent, and required to show its work every time. When Hadrius flags an email, it tells you what it flagged and which rule the flag attaches to. When Branches proposes a control test, it links back to the section of your manual it came from. Everything is evidence, and it is handed to a human who decides. AI is never the last word.

Compliance AI is not ChatGPT and it is not a chatbot. It is an application layer sitting on a firm-specific deployment of a frontier model, built to be trusted with data. We run zero data retention, so nothing goes back to the model vendors.

Compliance is getting more important

When a function gets better tools, it doesn’t shrink. It grows, moves up the org chart, and takes on the work that was always more valuable than the busywork. Accountants got Excel and became even more in-demand than they were in the days of slide rules and paper ledgers. Radiologists were supposed to be the first casualty of AI, and today it’s one of the most recruited fields of medicine.

The routine reading and flagging is going to be automated. Compliance, we believe, will become something like the owner of firm integrity, and that is a bigger job than the one most compliance teams are doing today.

‍

‍Watch the full webinar session here and see the full session transcript below.

‍

Transcript

Presented by Leonard DeFranco (Editorial Lead, Hadrius)

Hello and welcome to AI in Compliance: What CCOs Need to Know. My name is Leonard DeFranco, and I’m the editorial lead here at Hadrius, the agentic compliance infrastructure for financial services firms.

What we're covering today is a fairly non-technical overview of a framework that compliance officers can use to understand what AI is and how it's going to help them do their jobs. 

The reason we're doing this session is that we've had a lot of conversations with compliance officers who feel there's something intimidating about AI. Something mysterious, maybe something threatening. There's a lot of discourse around what it is. As someone who works inside a vendor built around AI, and as someone who uses AI extensively, what I often wish is that we could strip away the discourse and focus on the transformative power it has as a tool. That's what we're focusing on today.

The theory we're operating under in this presentation is that compliance AI is essentially a team you employ. What I want to talk about is what you need to know to be a good boss of that team.

A quick word on Hadrius. We’re agentic compliance infrastructure for financial services firms. We're based in New York City, and our product covers the full compliance lifecycle for SEC- and FINRA-regulated firms.

How to think about AI

The first thing I want to talk about is how to think about AI. We all know that ChatGPT and Claude mean the computer can talk to you now, but what is actually going on?

Artificial intelligence is a loose term. It's been theorized for decades, arguably longer. It's really only in the last 15 years that, thanks to things like neural networks and then the famous transformers paper Google published in 2017, we've been able to unify what used to be called big data — some of you will remember when that was the next big thing — met processing power and gave rise to machine learning. At some point in the last five years, after the launch of ChatGPT, this technology turned into a very powerful consumer-facing tool. And for the last few years we've had agents that are much better than the original ones at reasoning.

What's important to understand about artificial intelligence as an evolution of automation is that software can now prompt itself to do things, and it can write itself. That's a big difference. In some ways, as we'll talk about, AI is simply the progression of automation; now it can converse with you. But the real step change is that it can create itself and it can task itself to do things. That's very important.

Like any technology, it goes through a lifecycle. This is the Gartner hype cycle, and it applies very well to the adoption of any technology. Right now we're probably still on the ascent. But as the famous line goes, the future is here; it's just not evenly distributed. 

There are a lot of people who have already massively transformed their workflows with things like Claude Code. AI is a huge part of the work we do here at Hadrius. In addition to packaging it, we also use it a lot in our own work. But no matter how revelatory it was the first time — for me it was the moment I saw a letter written by a computer and thought, ‘Wow, I can't believe this is possible now!’ — like any technology, it very quickly gets to what I call the “why is this stupid thing not working” stage. You start to discover the technology’s limitations, and you want it to do more than it can do. This is a natural thing.

In the conversation we’re having today, it’s essential to understand that there are very tangible limits to what AI can do. What makes it difficult to keep track of is that those limits are always changing. The models are getting better. Things it wasn't good at before, it will get good at in the near future. Making predictions about where this is going is pretty futile. But the principle has to be established: you can sense the limits of AI when you actually work with it. One of the things I want to advocate for at the end of the session is that everyone on this call do their own work in getting to know AI and understanding what it can and can't do.

Why can't we treat this like a tool?

Let's get into some of the mystique. The first question I want to ask is, why can't we treat this like a tool? Because in some ways it is just a tool, even if it's an incredible one.

The first reason is that it challenges our ideas of thinking. We have a pretty clear understanding of how anatomy works. We have a pretty clear understanding of how chemistry works, and Newtonian physics. 

We don't really have a good idea of what knowledge is. What is thinking? What is thinking versus what is calculating? Could some AI get so powerful that it could reliably predict the outcome of a football game, because there are few enough variables? Or is there some inherent limit to how knowable the universe is that superintelligence will discover for us? We don't know these things, and they raise very interesting questions. 

A lot of the discourse around AI is immersed in this. I don't want to call it sci-fi, because it is here, and I think these are important questions to ask. But we could stand for a bit of a reality check.

Is a calculator good at math? I'm not necessarily saying human thinking is vastly different from computer thinking. That's a widely ranging debate. But we know a calculator is a machine that deterministically does arithmetic better than you can. Does that mean it knows what math is? Does it mean it can solve engineering problems better than a human? No.

There's this idea of a global model, which some AI companies are attempting to develop right now. The idea that intelligence is much more diverse and flexible and global than the current AIs we have. So while we're looking at a future where we have superintelligence, or powerful AI, or AGI, depending on who you ask, it's important to understand that we already have superintelligence in much more targeted domains, like doing math on a calculator.

I have a picture here of an event some of you will recognize: Garry Kasparov losing to Deep Blue in 1997. It was the first time the best human player in the world lost to a computer. I have a blog about this up on the Hadrius website. It's an interesting moment in the development of superintelligence, because at the time it provoked something of a crisis. A lot of people thought, if a computer is better than a human at chess, what is chess for, and what are we for? Is it all over?

What ended up happening was that chess became more popular than ever, precisely because the computer was better than a human. It allowed humans to learn more easily. It allowed humans to watch grandmaster-level games with a scoreboard, because the computer, which was better than either player, could tell you how good each move was. That wasn't possible before. 

‍

Yet here was a domain where superintelligence at its first dawning caused a gigantic crisis of conscience. People didn't know how to think about it. I like that in this picture you can see the little American flag next to IBM's computer. We'd never think of that nowadays. We'd never think of IBM as an American playing a Russian. We just think of it as: the computer can do this, and it allows humans to do what we like to do better.

The hype problem

One reason this gets obscured is that a lot of the discourse we see around AI is being driven by LLM companies selling a speculative thesis. They need the money tap to be turned on. The graph at right shows how much is being spent on data centers. I'm sure you've heard about this. Some of the companies producing the most frontier models are fronting this bill, and they need the investment to continue. They need optimism to stay high.

One outcome of being that capital-hungry is that they're selling a story that, in my opinion, veers into religious territory. In October 2024, Dario Amodei, the CEO of Anthropic, published an essay called "Machines of Loving Grace," which is a fairly measured outlook on what happens if AI goes right. But it started a lot of hand-wringing about how this is going to be the salvation of humanity. Some people think it's going to be the downfall of humanity. The rhetoric, like a lot of things in our culture, has just been turned up to the point where it's hard to see through it.

Keep in mind when you hear these things that some of these messages are coming from companies that want you to believe this is an inevitable next step of human evolution. I think it's probably pretty similar to something like an industrial revolution. Let's let it be that. It doesn't have to be an ascent into some afterlife.

Steam power and the meaning of “AI-native”

If you think about steam power or electricity, that's what I think AI is. And that's the way we're building our product at Hadrius. It's as transformative for us as those powers were. And like those powers, they're most powerful when you build something around them to harness them.

On the left here I have a horse and buggy. It's all analog. When AI first came out, and some of our legacy competitors are still doing this, there was the idea that you could use AI to do the same type of work. That's essentially this second image, a steam engine pulling a carriage. You're just doing the same thing, but cheaper.

But what's interesting about steam power is not being able to do what you did before, better. It's being able to build something entirely new around the new power. Like the locomotive right there. If you ran a transportation company in the horse-and-buggy era, and all of a sudden you were granted steam power and the locomotive debuted — another technology that required massive investment in infrastructure and changed the face of the continent — you'd be able to transport a lot more. The idea of going somewhere would change. The idea of how many people could come with you would change. It's not doing the same thing faster or better. It's a step change toward imagining a different way to work.

When electricity becomes harnessable, what's interesting isn't the electrons moving back and forth. It's being able to build the thing around it, the transistors that can use that force.

This is what we mean at Hadrius when we say we're AI-native. It means the product is built from first principles to leverage the powers of AI.

Onboarding your team of agents

I want to talk a little about how AI works. I'm not going to go into the technical details of how LLMs train, but there are three stages to developing an AI for a role.

On the left you have a large language model, which is a system trained on so much text that it can respond to a prompt by predicting which word comes next. It's raw intelligence, and it knows nothing about any particular firm. This is what you interact with when you talk to ChatGPT or Claude. When you hear that new models are getting better, this is what's getting better. It's a formless power that needs to be put into something in order to be most useful for enterprise use.

Then there's training and resourcing. This is giving it access to more specific data, access to your systems, and providing context, so that this pattern-matching algorithm can start matching to your preferences and your context.

Finally there's an application layer. This is what Hadrius is. Software that scaffolds the intelligence and controls what it's prompted to do, what it sees, and where its output goes.

It's difficult to talk about this capability in terms of old-style automation. It really is a different kind of automation. What "agentic" means is that this technology operates like an employee. It's like a team of employees helping you do your work. And for an employee to help you at your office, you need to bring them to your office. You need to bring them into your systems. You need to provide training. 

A large language model on its own might be brilliant, but it's like a brilliant high school or college kid. They don't actually know how to do this job yet. They need to be trained, they need a clear role to play, and their responsibilities need to be calibrated to what they're able to do. It's the same with AI.

So I have this tag on the far right side: compliance AI. This is what Hadrius offers, and it's the core answer to how something that's good at guessing becomes suitable for something that has to get it right.

What is compliance AI?

To draw the line a little sharper: generative AI needs guardrails, and compliance AI builds the guardrails.

Generative AI is probabilistic. It guesses. Compliance AI is deterministic. (Deterministic means you know what you're going to get when it spits something out.) With compliance AI products like Hadrius, we do our best to ensure everything is transparent, and it's a deployment of AI that's as conservative as possible.

In neural nets we often don't really know what's happening, so AI is inherently opaque. But it can be prompted to show its work, and that's what compliance AI does. Generative AI is fundamentally creating new things, whereas compliance AI, the way it's deployed inside the system, is only being asked to replicate things that have already been done. It's very conservative. It's audit-ready, because it's showing its work. And all of it is served up to human judgment, which right now, and for the foreseeable future, is the only intelligence capable of actually doing compliance.

That's what Hadrius is: compliance infrastructure built from first principles to leverage the power of AI. These are our six modules. We're a system that's always looking for new ways to use the powers of AI to do the work compliance has to have done. Compliance is a job function with a lot of repetitive work. Reading, flagging, communicating. AI could be doing that and freeing up your time.

To make a bold prediction: I think that how the rollout of AI goes in RegTech, our sector, is how it will go everywhere else. The reason I say that is that RegTech serves a compliance function that needs to get their work right. Because of that stricture on the nature of compliance work, it has to be audit-ready, it has to be correct, it has to stand up to scrutiny. This requirement puts a crucible around AI deployment that I think will be predictive of how AI transforms the rest of the economy. At the same time, AI has a very real role to play here, because so much of this work is repetitive. It's work you wish could be automated, and now it can be.

What AI is good at, and what it isn't

Let's talk about what AI can and can't do. This is at the core of how we build our product. 

For any CCOs on this call, getting to know intimately what AI is good at and what you don't quite trust it with is essential to using it as a tool.

It's good at reading a lot of text. Again, great for compliance. You have compliance manuals. You have a lot of emails to review.

I personally don't think it's good at writing. Obviously it can write. But generally you don't want it interfacing with humans. It's fine if a chatbot answers a quick question, and we have that in Hadrius. But if you're doing work where you need to chase someone down for an attestation, and it has to be a delicate political conversation, that's best done by a human. You have more context for it.

AI is good at finding patterns, but not as good at judgment. It's not smart enough. Everyone on this call is smarter than Claude. There are risk tolerances and a lot of other factors that fall into judgment. Even something that finds patterns very well mathematically, we wouldn't trust to do that.

AI is great at research. It's an amazing thought partner. I use it for research all the time. It's actually good at fact-checking, too, if it can link to external sources that are authoritative. But it's not the best at factual accuracy. We don't trust it to get something right on its own. AI hallucinates.

This goes into how we've built Hadrius. Because we're trying to use what it's good at and solve for what it's bad at, what the AI does is flag passages for review in your compliance manual, for example. Or, if you set a particular preference in your communications review module, an email a rep sent gets flagged, and it will show why it's flagging it and which rule that violation attaches to. It's not making assumptions. 

In Hadrius, in compliance AI, AI has to show you all of its work, because you're the one deciding whether it did it right.

Three examples from the product

Hadrius Marketing reads for context, not just keyword matches. This is a great example of being AI-native. Some competitors say their products use AI, and they do, but what they'll do is read a piece of marketing or communications for matches against lexicons. If any of the words on the no-no list appear, it throws a positive, and then they use AI after that to clean up the false positives. AI-native is having AI read it top to bottom as the first step. Not only does that reduce false positives, it increases true positives, because there might be something phrased in a way that a lexicon system would permit. AI is great at reading and parsing, so we use it in a function that requires a lot of reading and parsing.

Hadrius Branches proposes risks, controls, and tests for every section of your compliance manual. Compliance manuals are long and dense, and AI is good at reading long, dense text. This module pulls out pieces of your compliance manual, and then it's challenged to invent the test a CCO would create to prove that a control works. It proposes those tests to you, and it always links back to the text.

Interconnectedness. A big part of being AI-native is not just deploying AI in these different settings, but being a system of record that un-silos data and puts it into a repository where an agent can go and do better work. AI agents live and breathe context. The more they can see from more sources, the more powerful they are.

In this example I'm calling out different modules of Hadrius. Let's say a trade was executed that appeared to violate something, preceded by an issue or a contact. The agent can automatically go check what the data says in Communications. Oh, he got an email from that CFO. Let's take a look at this employee's U4, which lives in the People module. Oh, there's something worrying there. Connecting these dots makes AI much more powerful, and it makes it much easier to compile a complete audit trail.

This is what we mean when we say agentic compliance: the work of compliance performed by a team of AI agents that report to a human. It's compliance automation to the degree that compliance automation is possible. And agents need data, so putting all the data in one spot is what we're trying to do.

Pro tips for getting comfortable with AI

An agent is like any employee. What you trust it with determines the work you give it. If you have an employee, you want to understand what they can't do, not just that they're smart. Where does it start to break down, and where can it help you? 

Keep in mind these change all the time. Your job is to stay current with what it can't do. That's the principle I'm trying to articulate. Once you do that, a lot of the hype goes away. A lot of the fear goes away. A lot of the mistrust goes away. And you start to see possibilities.

Parse lots of text. A really great use of AI is generating meeting notes. See if it can transcribe what's said in a meeting and then generate a summary and action items. Any text you have a lot of is good to run through AI.

Use AI as a thought partner. We've all probably done "write this email more politely." Try to push it further. If there's an issue at work, an issue at home, a regulatory challenge, a lack of clarity with some rule, give it to AI. It can't hurt to see what it provides, and see how good its reasoning is. What I've personally found with generative AI, and with Claude specifically, is that it's very sycophantic. I wouldn't trust it to push back on me as much as I'd trust a domain expert if I said something that wasn't quite getting the gist right. So I know it can help me, but I don't trust everything it says.

Build something you want to exist that doesn't exist. They call this vibe coding. One of the biggest transformations AI has already produced is in coding, because coding is a fairly tightly defined domain. The idea that engineers are now more architects of software than typists of software has been revolutionary. This might be a bit far afield for some people, because there's still a learning curve to using something like Claude Code to build an app. But give it a shot. Chances are you'll be able to build something you wanted to exist just by typing regular English into the system.

Keep training it. LLMs are pattern recognition models, and they require a lot of feedback. They do improve with it. If AI isn't giving you the outputs you want, chances are you can train it by continually giving it feedback. If you ask it to generate an image, or anything else, and it isn't exactly right, tell it. Keep going back and telling it. If you use Claude, one of the things they've done really well is productize memory that carries across projects. Whatever it spits out first is not the totality of what it can do. It's guessing at what you want, so you have to keep telling it.

Ask AI how to use AI. One of the best prompting tips out there is to ask AI how it would like you to ask. Or give it a finished product and say, ‘What would I have to ask you in order for you to create this?’ AI is very good at telling you how it operates.

Beware its limits. When you put sensitive data into an LLM, that is not secure. So don't do it. And don't trust what it says without verifying. It hallucinates. It's an algorithm trying to guess the most probable next word, and it's very prone to hallucination. The point of all of this is to be in touch with those limits, and then know what you can trust it with.

Closing

This is the point: AI is a tool, but it's a new generation of tool. It's not a machine of loving grace. (At least I don't think so.) But it is going from horse and buggy to locomotive. Whatever modality change you want to name, it changes the possibilities of what you can do. So we have to stay on top of it, and we have to understand it. It's a transformative new technology where software can assign itself things to do, and you can be in charge of it while it works.

Don't get blinded by the hype. Agentic work is very much within your ambit, and it's going to help compliance do this work better.

Compliance AI is not ChatGPT. It's not Claude. It's not a chatbot. Compliance AI is an application layer that sits atop a trained, firm-specific deployment of a general intelligence model, purpose-built to be trusted with data. We have a zero data retention policy, so we don't hand any of your data back to the vendors of the models Hadrius uses. But within Hadrius, your data sits securely, and it helps the system train itself to perform closer to your preferences. Compliance AI turns a guessing algorithm into something you can trust. It harnesses it, the way an engine harnesses steam power, the way an internal combustion engine harnesses gasoline's propensity to explode.

A couple of points to close.

Compliance isn't the only function that has AI. You could look at all this and decide AI is simply not for you. That's fine. But you have to be aware that on both sides of compliance, these tools exist. Reps and advisors have them, which means there are far more marketing emails going out, and far more personalized ones. There's more text being sent out as marketing that possibly no one has even seen. And there are things like algorithmic trading, which we don't touch at all, but there's probably a lot of AI-driven trading happening in and around your firm. AI is being used by the people you have to provide oversight to.

At the same time, the SEC has it too. They know these tools are out there. There's this idea of “the era of total review” that we talk about here at Hadrius, which is that sampling is no longer going to get you through an exam. The SEC has been bullish on AI and permissive of its rollout. If you look at the exam priorities, their concern is mostly not about overuse of AI. It's that there's good governance of AI, and, maybe surprisingly, that if a firm claims to use AI it actually has to be using real AI. They don't want a Mechanical Turk — a human pretending to be AI to sound cool. But they have these tools too. They know you can read every one of these emails, and there are more emails now to read. There's more marketing to read.

So that's the problem. We're in a sandwich. Compliance has to have compliance AI.

The last thing I want to close with is that AI is a good development for compliance. Compliance is about to get more important. When a job function can accomplish more with more powerful tools, it grows in headcount, earns a better seat at the table, and takes on more valuable work.

The picture you see here is Jack Lemmon, from a movie. This is what a spreadsheet used to look like. I got this from a Benedict Evans blog post a couple of years ago. That man right there, that actuary, is what one cell of Excel does now. He spent his entire day in a room full of identical people using an adding machine to make calculations, and then he'd pass it along to a colleague. That's essentially how a spreadsheet works. If you showed this guy Excel, he'd say, “I'm out of a job.” And he probably would have had to change his job. But the job of accountancy didn't go away. Radiology didn't go away. Radiology was a field that a decade ago was thought to be the most exposed to AI, and there's actually more for radiologists to know than before. Engineers: there's new demand for engineers, and everyone thought Claude Code was going to do away with them.

Compliance is about to get more important. We at Hadrius like to talk about compliance as the owner of firm integrity, the way the SEC is the owner of systemic integrity. The SEC doesn't ensure systemic integrity by going into every firm all the time. They establish guidelines and operationalize rule-following so they can ensure the whole system is healthy. Our thought is that this is what compliance is going to become. There's a lot about brand reputation and firm health that can be taken on once the work that can be automated away, is automated away.