BUDGET SEASON IS HERE

Unless you're living under a rock—or, better yet, have been on a digital-free retreat—the conversation about AI and its risks is everywhere.

Its even trending in elementary school, at least according to my 5th grader.

There is no question that AI introduces real risk. And deploying it without appropriate guardrails introduces even more.

But sitting on the sidelines poses a risk too.

I keep coming back to this as organizations enter budget season:

Technology doesn't have to generate revenue to create value.

Reducing the cost of Risk and Compliance, increasing coverage, identifying risk earlier, and freeing talented professionals from manual work all contribute to the bottom line.

And increasingly, I think we need to consider the opposite: What is the cost of not investing?

When control functions are left behind with end-of-life technology, manually monitoring increasingly sophisticated and AI-enabled business processes, and failing to keep pace with their business partners from an AI-IQ perspective, they're not just missing an opportunity to create value.

The capability gap itself becomes a risk.

A Compliance function cannot effectively monitor an environment that is changing faster than its ability to understand, analyze, and test it. That doesn't mean handing compliance monitoring over to AI. Human judgment, oversight, and intervention remain critical.

But we can start in lower-risk, practical places.

Use AI to compare policies and procedures for conflicting language and guidance. Validate regulatory references in governing documents against current sources. Review committee materials for consistency in messaging, clarity, and data accuracy. Identify anomalies and areas that warrant human review.

Think about the hours highly skilled professionals spend doing those things manually.

Now translate those hours into capacity to support a new product launch. A jurisdictional expansion. A changing regulatory requirement. Or an emerging risk that actually needs their judgment and expertise.

Start conservatively. Build the AI-IQ of your practitioners. Learn where the technology works—and where it doesn't. Then expand thoughtfully.

Over time, the opportunity gets much bigger: moving Compliance Monitoring from periodic, manual reviews toward more continuous, proactive risk identification.

So, back to the budget.

Identify the tools. Build the business case. Invest in the people and their capabilities. Make sure your control functions aren't trying to oversee tomorrows business with yesterdays technology.