What examiners actually ask about AI

Who decided?

The first question is attribution. In a compliance program, outcomes carry names: a judgment call (approve, reject, escalate) is recorded with the analyst’s identity and reasoning, and an outcome set by policy traces to the human-approved rule that produced it. The moment an outcome traces to neither, attribution breaks; there is no one to put in front of the question.

Attribution is also how an examiner tests everything else. An institution that cannot say who decided usually cannot say what was reviewed either. The two failures travel together, and both surface in the first hour of an exam.

That is why the human gate has to be structural rather than aspirational. A review step that can be configured away eventually will be, under volume pressure, by someone optimizing a queue. On Compliance AI, human-approved policy governs every outcome, cases that require judgment route to named analysts, and the gate cannot be configured away: there is no setting in which the AI approves, rejects, or closes a case on its own.

A review gate that can be configured away eventually will be. The boundary has to be structural.

What does the AI not do?

The second question is scope, and the credible answer is a boundary list, written down and enforced. Four boundaries do most of the work:

• No decisions. It never approves, rejects, or off-boards a customer; outcomes follow human-approved policy, and judgment calls go to named analysts.
• No filings. It never files SARs or any other regulatory report; analysts prepare and file, backed by the documented case.
• No hidden actions. Every step it takes is logged in the case file, visible to the team and to examiners, attributable after the fact.
• No policy changes. It operates inside written, human-approved policy; it does not set thresholds, change rules, or expand its own scope.

Boundaries like these do double duty. They tell an examiner exactly where the AI’s authority ends, and they tell your own analysts what they remain accountable for. Ambiguity about scope is what turns a helpful system into an examination finding.

Show me the record

The third question is evidence. An examiner working an AI-assisted case should see the complete file: every document, every screening result with its source and timestamp, every AI-prepared item labeled as such, and the named analyst or approved policy behind each outcome, with the full trail exportable.

Two details in that sentence carry the weight. AI-prepared work is labeled, because an examiner needs to distinguish what the machine assembled from what the human concluded. And every step is attributable, because “the system did it” fails the same way “the model decided” does: someone must be able to reconstruct what happened, in order, after the fact.

What speed is allowed to mean

None of these questions reward slowness. Reviews are judged on completeness and documentation, not duration: a thirty-day review that misses a beneficial owner fails, and a two-day review with a complete, attributable file holds up.

That reframes what the AI is for. When agents assemble the case (screening run, documents processed, ledger history pulled, every item cited to its source), the analyst opens a complete file instead of building one, and reviews that ran roughly thirty days manually close in one or two. Where a case needs judgment, it is the same human judgment. It just stops waiting on the paperwork.

That is the version of AI in compliance that holds up in the exam room: not a model making calls, but a system that gets a named human to a defensible decision faster, with the record to prove it.

Frequently asked questions