But before asking where, when, or how quickly can we deploy AI?, I'd suggest starting with a different question:
Where can AI create the greatest value for our organization?
I've written before about the importance of risk appetite, materiality, and directing finite resources toward the risks that matter most. I believe the same principles should guide how we approach AI investment.
Not every manual process needs to be automated. Not every opportunity delivers the same value. And not every investment needs to generate revenue to contribute to the bottom line.
Consider three opportunities:
Regulatory Change Management: Can AI identify changes earlier, reduce time spent on manual research, and improve coverage? Can we integrate human judgment more deeply where regulatory impact is greatest while allowing AI to handle more of the lower-risk work?
Monitoring & Testing: Can AI increase coverage, identify emerging risks earlier, and allow practitioners to focus their expertise on the most material exposures? Can it translate testing workpapers into draft management reporting, freeing management to focus on review, interpretation, and refinement?
Controls Mapping: Can AI suggest linkages between regulatory obligations, risks, key controls, and testing results, reducing manual effort? Can it identify outdated or inconsistent mappings and inactive controls or business processes that continue to appear in GRC tools?
These are just a few examples, but the point is broader.
The greatest value may not come from doing the same work faster. It may come from doing more meaningful work with the resources you already have.
And that requires understanding where your greatest risks, resource constraints, and opportunities exist before selecting and deploying the technology.
As organizations integrate AI into their Risk and Compliance programs, I'd encourage leaders to consider three things:
PRIORITIZE where AI can create meaningful value.
GOVERN its use with accountability and guardrails proportionate to risk.
OPTIMIZE performance to ensure the investment delivers results.
In my next post, I'll explore how we can GOVERN effectively—because the goal isn't simply to deploy AI.
It's to build a more effective Risk and Compliance function.
