Artificial intelligence has long moved beyond the realm of curiosity and has become part of the daily work of Compliance and AML teams.

More and more professionals and consultants are using AI to draft policies and procedures, prepare training materials, screen clients, analyse KYC/KYB and transaction monitoring cases, prepare opinions, conduct regulatory research and create content.

However, the main conclusion from our practical experience is relatively simple – AI is a good tool for accelerating and enhancing work, but a poor substitute for professional judgement.

The observations below are based on our actual work with the paid versions of ChatGPT and Claude. We do not claim that this is a universal assessment of all AI tools. Rather, this is our practical view of where these tools genuinely help us, where we still do not fully trust them, and what boundaries we have set for ourselves when using them.

Drafting Policies, Rules and Procedures

This is probably one of the first applications that comes to mind. You provide a topic, a few requirements and, within minutes, receive a document that would otherwise take hours to draft from a technical perspective.

And this is precisely where the first major advantage of AI lies – speed.

With a well-formulated assignment, the text can gradually be adapted to a specific business model, process or regulatory requirement. The tool is particularly useful for structuring already developed content, harmonising terminology, editing, formatting and translation.

The problem starts when the initial draft is treated as a finished product.

References to specific articles, regulations, guidelines and other regulatory sources are often inaccurate. The generated document frequently resembles a combination of widely used templates and general best practices which may be reasonable in themselves, but may have very little to do with the specific organisation.

The result is a document that looks professional, contains the right headings and terminology, but does not describe how the business actually operates.

In our view, this is also one of the reasons why the “AI style” is gradually becoming easier to recognise. The problem is not that a text has been edited or supported by AI. The problem arises when long, generic and template-like wording creates the impression that the document was prepared simply “to have it in place”, without anyone checking whether the processes described actually exist in practice.

Our approach is to use AI only after preparing a very specific assignment and giving clear instructions for the individual parts of the document. The result then always goes through a professional review – both from a regulatory and a process perspective.

There is another risk that is easy to underestimate. Once a particular part of the document has been validated, a subsequent instruction to AI may lead to the “optimisation” of content that has already been reviewed. The model may shorten a paragraph, change a term or even shift the meaning without this having been explicitly requested.

For this reason, we find AI very useful for reducing operational workload – drafting, structuring, formatting, editing and translation. However, we would not trust a policy generated entirely from scratch and adopted without significant human involvement.

Training and Presentations

The situation is similar when it comes to training.

Within minutes, AI can suggest the structure of a training programme, individual slides, practical cases and ideas for exercises. It can help with design and adapt already developed content to a different audience.

This is convenient and saves a significant amount of time.

However, when we have tried to generate complete training programmes from scratch, the result has usually remained too basic. The information is properly structured, but often at a level that can easily be found among the first few results of a standard internet search.

It is also difficult to achieve the appropriate local terminology and style of expression, particularly when the training covers a specific regulatory topic.

The same applies to presentations. AI can very quickly create a visually complete set of slides, but without expert editing they often look template-based and remain superficial in terms of substance.

That is why we prefer to develop the expert content ourselves and use AI to enhance it – by adding examples, practical cases, ideas for exercises, better structure or improved design.

In practice, in many cases it takes us less time to create the core training content ourselves than to correct a basic AI-generated version.

LinkedIn, Blogs and Expert Content

AI is extremely tempting in this area.

Within seconds, it can write an article, a LinkedIn post or a comment on almost any topic. The text is usually grammatically correct, well structured and convincing.

The problem is that it often says very little.

Without significant human involvement, content gradually starts to sound the same. There is a good introduction, several logically structured arguments and a reasonable conclusion, but no real position, personal experience or genuine added value.

This is particularly visible in expert topics.

AI allows someone to write a convincing-sounding article on a subject they do not actually understand. To a reader without experience, this may look impressive. To a specialist in the relevant field, however, the lack of depth is usually very easy to recognise.

We use AI for ideas, editing, formatting, titles and improving the wording. We do not use it as a substitute for our own position.

Ultimately, if an expert article does not contain the author’s conviction, experience and perspective, it may look good but is unlikely to provide real value to the reader.

Client Screening

This is one of the areas where, in our view, AI already works quite well.

For open-source research and adverse media checks, the tool can quickly consolidate information from different public sources, work with materials in foreign languages and help identify links between separate pieces of information.

We use it and can clearly see the improvement in quality as the models continue to develop.

But we do not use it as the only source.

AI can still miss relevant information, confuse people with similar names, or present outdated or incorrect information with excessive confidence.

That is why, when it comes to screening, we see it as an additional tool for open-source research rather than as a substitute for Google, official sources and specialised PEP, sanctions and watchlist screening solutions.

In this area, AI has real value in our view, but only when it forms part of a broader review process.

Support with KYC/KYB, Transaction Monitoring and More Complex Cases

This is probably one of the most interesting applications of AI for Compliance and AML professionals.

When provided with sufficient context, the model often suggests a reasonable course of action. It may identify additional red flags, suggest questions for the client, propose documents that could be requested, or simply provide a different perspective on the case.

For an experienced professional, this can be very useful – a kind of “second pair of eyes”.

For an inexperienced employee, however, the same tool can become a double-edged sword.

The first problem is that AI can be overly conservative or overly liberal depending on how the question is framed.

The second is that models tend to follow the context we provide. If the user has already decided that certain behaviour is suspicious and frames the question accordingly, AI may gradually start confirming that assumption rather than challenging it.

The third and, in our view, most serious issue is the confidence of the response.

AI can provide a very convincing recommendation even when there is insufficient information or when the conclusion is debatable.

An experienced person will usually recognise this. An inexperienced one may simply accept the answer.

This also creates a longer-term risk – the employee may gradually stop developing their own analytical habits. Instead of analysing the client or transaction first, they begin to mechanically ask AI the question and then mechanically follow the suggested answer.

In our view, the correct approach is the opposite.

First, perform your own analysis. Then use AI to challenge, validate or enhance it.

This way, the tool works for the professional, rather than the professional working for the tool.

There is another critical issue in this area – the information entered into the model.

We would anonymise personal data and confidential information before analysing any real client or transaction case through AI. And the issue is not limited to GDPR. Contractual confidentiality, trade secrets, client restrictions and internal policies must also be taken into account.

Uploading KYC/KYB documents, transaction data or CDD/EDD materials into an AI tool without a prior assessment is, in itself, a compliance risk.

Regulatory Research and Regulatory Changes

AI is also extremely useful for regulatory research.

When dealing with a lengthy piece of legislation, guideline or consultation paper, it can quickly identify the main topics, compare different versions of a document or indicate which changes are likely to be relevant to a particular business.

This saves a significant amount of time during the initial analysis.

However, the boundary here must be very clear – AI can show us where to look, but it should not replace the regulatory review itself.

The model may use an outdated version of a document, overlook an exception, misinterpret the applicability of a particular rule or provide an incorrect legal reference.

That is why, when preparing a final opinion, the original source must always be checked.

AI reduces the time required for searching and initial orientation. The final decision remains with the professional.

What Else Concerns Us in Practice

Alongside the useful applications, we also see several ways in which AI is being used that, in our view, create very real risks.

One is providing opinions “on autopilot”. A question is entered into AI, the generated response looks good and is sent directly to a client, colleague or partner. Without a regulatory review. Without fact-checking. Sometimes without even being read carefully.

Another problem is using AI as a substitute for expertise. Professionals give opinions on topics where they have not checked the regulatory framework or relevant best practices because the model has already “explained” the issue. The result may be an impressively written text with a completely incorrect conclusion.

The third issue is sensitive information. KYC/KYB documents, transaction data, CDD/EDD materials and other client information should not automatically be copied into AI tools simply because it is convenient.

Before an organisation allows such a practice, it should clearly define which tools may be used, for what purposes and what type of information may be entered into them.

Conclusion

We use AI and are convinced that its role in Compliance and AML will continue to grow. But we use it as a tool to enhance our expertise, knowledge and experience, rather than as a source of a final product.

In our view, the biggest mistake would be for a Compliance/AML professional to gradually replace their own judgement with automatically generated responses.

Instinct, professional scepticism, experience and the ability to understand context are precisely the qualities that make a professional valuable.

AI does not make a good Compliance/AML professional redundant. Rather, it increases the difference between a strong professional and a weak one.

In the hands of an experienced person, it saves time, offers additional perspectives, helps analyse large volumes of information and reduces operational workload.

In the hands of someone without sufficient knowledge, it may simply produce a well-presented mistake more quickly.

We see particularly strong potential in data analysis – for example, in transaction monitoring, where AI can very quickly identify relationships, patterns and connected information.

And that, in our view, is where its real value lies – helping us become faster and more efficient without replacing human judgement and thought.

How Compliance Navi Can Help

At Compliance Navi, we occasionally use AI as part of our daily work, but always in combination with human expertise, professional judgement and control.

Increasingly, we see that the real question for organisations is no longer whether employees use AI. In many companies, they already do.

The more important question is how they use it and what data they enter into it.

That is why we can help organisations first understand how AI is actually being used across their teams – which tools are in use, for what tasks and what type of information is being provided to those systems.

On that basis, practical internal rules can be developed – what is permitted, what is not, in which cases human review is required, and how personal data, client information, KYC/KYB documents, transaction data and other confidential information should be handled.

A separate topic is the review of the AI solutions themselves from a Data Protection and confidentiality perspective – what data is processed, where it is stored, under what conditions the provider uses it, and whether additional contractual, technical or organisational measures are required.

For Compliance and AML teams, we can also develop specific practical rules for the use of AI in regulatory research, policies and procedures, screening, KYC/KYB, transaction monitoring and the preparation of opinions.

Training employees is equally important. It is not enough simply to tell them “do not upload personal data”. They need to understand both the risks and the correct way to use the tool so that it saves them time without replacing their professional judgement.

At a broader level, a comprehensive AI & Data Protection Compliance Review can also be carried out – covering the AI solutions being used, the data flowing through them, the associated risks and the controls required.