AI in Compliance Is Moving Closer to the Decision

AI is edging toward the compliance decision, and most programs have no way to prove who made it.

S-RM, a corporate intelligence and cyber security consultancy, surveyed 225 professionals across compliance, procurement, supplier management and third-party risk. It published the results in its 2026 report, From Screening to Decision-Making: The Next Phase of AI in Compliance. The headline is less the climb in adoption than the shift in what AI is being pointed at.

Today’s use is concentrated in screening. Planned use leans toward diligence. Screening finds a signal, and diligence decides what the signal means, which is a different job with a different liability profile.

For a CISO or a chief compliance officer, that shift moves the question. Speed stops being the test. The test becomes whether you can reconstruct, for an assessor or a regulator, what the tool saw, what a person concluded, and what data moved between the two. Kiteworks secure data exchange sits on the last link in that chain, the governed movement of documents and the governed access AI assistants get to them, and this post covers where the evidence must come from. One caution before the numbers. S-RM sells its own AI-driven diligence product, and every figure here is self-reported by 225 respondents, so read them as directional.

Key Takeaways

1. Broad adoption hides thin scale.

S-RM’s 2026 survey found 68 percent of respondents have deployed AI in compliance, but only 20 percent report extensive deployment across multiple processes.

2. The next wave sits next to judgment.

Planned AI use shifts from adverse media and sanctions screening toward third-party due diligence, customer due diligence and enhanced due diligence, where a person must decide what a finding means.

3. Humans stay accountable, so their work must be recorded.

Only 12 percent of respondents expect AI to run most due diligence with limited human oversight, which makes analyst challenge and sign-off the evidence worth keeping.

4. Confidence outruns maturity.

A separate Schellman survey found 74 percent say they could pass an AI compliance audit while only 27 percent call their governance fully mature, and that gap is where audit findings come from.

5. Defensibility is a data problem.

A decision record is only as good as the trail behind the documents, the AI access and the reviewer actions, and that trail must live in one auditable place rather than across inboxes, shared drives and a vendor dashboard.

Deployment Is Broad and Scale Is the Exception

S-RM found that 68 percent of respondents have deployed AI selectively or extensively across their compliance processes, while the other 32 percent are still running pilots or proofs of concept. Only 20 percent report extensive deployment across multiple processes. That leaves 48 percent in the middle, with AI running in selected processes.

Selected is doing a lot of work in that sentence.

Call it the deployment mirage. From a distance, two thirds of compliance teams look like they run on AI. Up close, one in five runs on it across more than a single process, and the rest have AI attached to the established screening activities that dominate current use.

That distinction matters more to evidence than to technology. A fully manual process produces a file a person wrote. A fully automated one, if it ever exists, produces a log a machine wrote. A hybrid produces both, in different systems, with a handoff in the middle that nobody documented. Programs that run AI in selected processes are hybrids, and the handoff is where the record goes missing.

Picture a regulatory inquiry landing on one diligence decision. The analyst remembers what happened. The tool’s output sits in a dashboard. The email that tied the two together is in somebody’s inbox, and the owner of that inbox has changed roles. Nothing was hidden. Nothing was assembled, either.

The Budget Is Running Ahead of the Controls

Nearly four in five organizations expect to increase investment in AI-enabled compliance and due diligence technology over the next two years, according to S-RM. Its Figure 2 splits that into 22 percent who expect a significant increase and 56 percent who expect a moderate one, against 18 percent expecting no change and 4 percent expecting a moderate decrease. Average annual spend is forecast to grow by around 24 percent.

Money is coming. The question is what it buys.

Tooling gets a budget line because tooling has a vendor and a demo. The decision record rarely has either, and nothing in S-RM’s budget findings suggests any of that 24 percent is earmarked for it. A team can double its AI diligence spend and still be unable to answer the first question an assessor asks, which is how a given conclusion was reached and by whom.

The same pattern shows up in AI data governance programs generally. Spending follows capability, and governance trails by a budget cycle or two. A trailing control has one weakness. The audit does not wait for it.

Where AI Is Used Today and Where It Is Headed

S-RM’s Table 1 is the most useful exhibit in the report because it shows direction of travel. Current use is concentrated in established screening. Planned use points somewhere else.

Read down the right-hand column. Third-party due diligence, customer due diligence, enhanced due diligence, investigations and case management. Every item on that list is a place where a person must weigh evidence and decide.

S-RM states the logic plainly. Screening is designed to identify potential risk signals, while broader due diligence and investigative workflows require teams to assess the relevance and credibility of those signals, establish context, determine their significance and decide what action to take. Then comes the line worth underlining. “AI is therefore moving closer to the point at which compliance judgements are made, even if it is not making those judgements itself.”

Read that again. Closer to the judgement. Not making the judgement.

The gap between those two phrases is where accountability sits, and it narrows every quarter the tools improve. Consider an AI summary that ranks a third party’s ownership structure as low concern. It does not decide anything. A reviewer who accepts that ranking in seconds, one item in a long queue, decides something. If the record shows only the ranking and the approval, an assessor cannot tell those two events apart, and neither can you.

Regulation Is Pushing Diligence Beyond the Match

S-RM ties the shift partly to a changing regulatory environment. It points to the EU Forced Labour Regulation and the Corporate Sustainability Due Diligence Directive, which it says are both due to come into force over the next three years. I am relaying S-RM’s framing and offering no legal reading of either instrument, and I have not checked their application dates against the primary texts. Your Legal team owns that interpretation, including what each one requires of your organization and when.

What S-RM draws from them is practical. Identifying a sanctions match, a politically exposed person or an adverse-media result may no longer be enough. Effective diligence can require a wider look at an entity’s ownership, activities, geographic footprint and business relationships, along with the context and credibility of the information found.

Now put that next to a number. Organizations in S-RM’s research monitor an average of 2,837 third parties.

Few teams can perform enhanced due diligence on 2,837 relationships by hand, and S-RM says as much, noting that AI has a role in bridging the gap with what was traditionally a manual and human-intensive enhanced level of due diligence. Scrutiny per third party goes up, the number of third parties does not go down, and automation is the obvious way to square the two.

That is why third-party risk management is the first place compliance leaders should expect AI to touch a decision rather than a screen. It is also why supply chain risk management programs will be asked to show their work, not just their conclusions, as regulatory compliance expectations around upstream relationships tighten.

Fifty-Eight Percent Say the Tools Struggle With Context

Ambition has a ceiling, and respondents can see it. More than half, 58 percent, told S-RM that AI-enabled due-diligence solutions struggle to assess the context, credibility or relevance of information.

The obstacles to full adoption deserve a close read, because none of them is about the model. Fragmented information across online sources was cited by 54 percent. Poor-quality or inconsistent underlying data was cited by 46 percent. Limited access to closed or private sources was cited by 40 percent. Every one of those is a complaint about the information AI is asked to reason over.

That makes this a data governance problem as much as a technology one. A diligence conclusion built on fragmented, inconsistent or incomplete inputs is only as defensible as your ability to say which inputs were used. Which sources did the tool pull? Which were unavailable? Which did the analyst add by hand after the tool came up short?

S-RM draws a clean line between finding information and determining what it means. AI can perform more of the initial, high-volume research. Human expertise matters most where evidence is incomplete, contradictory or hard to verify, and analysts interrogate ambiguous findings, assess source reliability, seek corroboration and decide whether the information changes the risk assessment.

Every one of those verbs should leave a mark. An analyst who seeks corroboration and finds it has produced evidence. An analyst who seeks it, fails to find it and downgrades a finding has produced something more valuable, a documented reason. If that reasoning lives in a chat thread or in someone’s head, it does not exist for an assessor.

The Five-Year View Is Human-Led, With a Catch

S-RM asked where AI-enabled due diligence is going over the next five years, and the answers refuse to line up behind either camp. Only 12 percent believe AI will perform most due diligence activities with limited human oversight as data quality and coverage improve. Forty-eight percent expect AI to perform many activities while human experts remain essential for complex decisions, judgement and high-risk cases. Thirty-three percent expect AI mainly to accelerate research and information gathering while people continue to lead most of the work. Seven percent expect AI to stay limited to screening and research support because data quality and availability will constrain broader use.

Add the middle two answers and 81 percent expect people to remain essential or in the lead. That sum is my arithmetic, not S-RM’s.

Block AI and you spend analyst time on retrieval, the work S-RM says AI does well, while the third-party universe keeps growing. Hand it the keys and you inherit a decision process nobody can explain, in a category where S-RM’s own respondents say the tools struggle with context. Neither extreme survives contact with an assessor. S-RM’s conclusion lands on the variable that does. Organizations should apply the right level of human assurance to the risk of the decision and produce outcomes that can be understood, trusted and defended.

Notice what that sentence demands. Human assurance proportionate to risk is a policy question. Outcomes that can be defended are an evidence question. Most programs have answered the first and skipped the second.

The failure worth naming is oversight theater. It looks like a human in the loop. It is a reviewer approving an AI summary with no record of what they examined, what they questioned or what they changed. The control exists on the org chart and nowhere in the file. When the finding is later challenged, the human in the loop turns out to be a checkbox, and the organization has paid for both the tool and the reviewer without being able to prove either did anything.

Governance Confidence Runs Ahead of Governance Maturity

S-RM is not the only survey finding organizations that believe they are further along than their programs show. Schellman’s 2026 State of AI Governance report surveyed 525 U.S. professionals at companies with more than 500 employees and at least $100 million in revenue. It found that 74 percent say their organization could pass an AI compliance audit today, while only 27 percent describe their AI governance as fully mature, meaning fully operationalized and continuously monitored. Schellman sells AI governance assessments and certification, and the sample is U.S.-only, unweighted and self-reported.

Those two numbers can both be true only if the audit is imagined rather than scheduled.

Confidence is cheap until someone requests the file. The distance between 74 percent and 27 percent is the distance between believing your GRC program covers AI and being able to produce the artifacts that prove it. Teams that live in that gap tend to discover it during an assessment, the most expensive time to find out.

On the third-party side specifically, the same Schellman survey found that only 36 percent said their boards or leadership had formally discussed third-party or vendor AI risk. That matters here because S-RM’s respondents include the people who manage those relationships. If the board is not discussing the risk, the diligence team is carrying it alone, with tools the board has not scrutinized.

A third lens comes from the security side. ISACA’s State of Cybersecurity 2026 report is based on 1,888 ISACA members and credential holders surveyed in the second quarter of 2026. It found that only 9 percent have a mature formal program for third-party AI risk, with AI-specific policies, assessments and monitoring, while another 17 percent rely on general third-party risk processes. That sample skews toward security professionals and is not a random draw of enterprises, so treat it as directional.

The 17 percent reusing the old process is the quiet number. A questionnaire built to assess a vendor’s firewall does not ask how that vendor’s AI scores your counterparties, and a review cycle built around annual SOC reports does not capture a model that changes quarterly.

Financial Services Shows What Operational AI Looks Like

S-RM breaks out its financial services respondents as a glimpse of where other sectors may be heading. The report does not give the subsample size, so read this section as directional.

Nearly one third of financial services respondents, 32 percent, report extensive AI deployment across multiple compliance processes, against 20 percent across the overall sample. A further 49 percent have deployed AI in selected processes, which means 81 percent of financial services respondents use AI operationally.

Their current use looks familiar and a little deeper. Adverse media screening sits at 51 percent, customer due diligence and KYC at 48 percent, sanctions and PEP screening at 48 percent, and transaction monitoring at 41 percent. The next frontier matches the full sample, third-party due diligence, where 59 percent of financial services respondents plan to introduce AI within 12 months against 48 percent of the wider sample.

For a compliance leader in another sector, the lesson is plain. The group that looks furthest along in the survey is not pulling back from AI in judgment-adjacent work. It is moving toward more of it. Whatever your industry, the question of how you will evidence AI-assisted diligence is coming on a timeline set by the leaders, not the laggards.

Sound data compliance practice here starts with building the diligence file as if an examiner will ask for it, from the first document received, rather than assembling it when the inquiry letter lands.

The Defensibility Gap Is the Real Risk

Put the findings together and a single gap emerges. Call it the defensibility gap. It is the distance between the decisions AI helped your team make and your ability to show, on demand, how each one was reached.

S-RM never uses that phrase, but its conclusion points straight at it. The organizations that benefit most, it says, will not necessarily be those that strive for all-out automation. They will be the ones that integrate AI into workflows, apply the right level of human assurance and produce outcomes that can be understood, trusted and defended.

Understood, trusted, defended. A vendor can ship you one of those as a feature. The other two are properties of your records.

A defensible diligence record must answer five questions without anyone’s memory. What inputs did the process use? What did the AI output say? Who reviewed it, and what did they examine? What did they change, accept or escalate? And what happened to the underlying documents while all of that was going on?

The first two tend to live in the diligence platform. The third and fourth can live in tickets, spreadsheets or email. The fifth is the one nobody owns. Ownership documents, questionnaires and certifications travel to and from third parties and outside analysts through whatever channel was convenient, and the audit trail for those exchanges is scattered across tools never designed to produce one.

Here is the whole game. If your evidence is spread across several systems, assembling it takes weeks, and the regulator’s clock runs in days. An audit trail that exists but cannot be produced quickly, in one coherent view, is not evidence-quality. It is raw material.

The evidence gap is not a technology shortage. It is an architecture decision nobody made, because these processes grew up before anyone asked AI to sit next to the judgment.

Where Kiteworks Fits in a Defensible Diligence Workflow

Be precise about what any platform can and cannot do here. Kiteworks does not make a diligence judgment, and it cannot tell you whether an AI summary of a third party is correct. It governs the data that moves around those judgments and records who touched it.

Diligence runs on documents that travel. Ownership records, questionnaires, certifications and analyst reports move between your team, the third parties under review and outside specialists. Kiteworks secure data exchange governs that movement across secure email, secure file sharing, SFTP, managed file transfer and secure data forms, under one policy engine and one consolidated audit log. For the CCO, that single log turns the fifth question above, what happened to the documents, from a reconstruction exercise into a report.

AI assistants add a second path to the same content. The Kiteworks Secure MCP Server lets AI assistants such as Claude and Copilot work with content held in Kiteworks. Each operation is evaluated against the role-based and attribute-based access policies that govern the person using the assistant, and each is written to the same audit log that records that person’s other activity. People and AI assistants sit under one policy and one trail, which is the right model when the person remains accountable for the conclusion. Kiteworks Compliant AI describes how that governed access works at the boundary between your data and your AI tools.

The approach follows a zero trust data exchange principle. A request an assistant makes through the Secure MCP Server is authenticated, authorized against policy and logged, with no implicit trust for the AI tool itself. For a diligence team, the record of who accessed which third-party file, when and through which channel comes from the system rather than from an analyst’s reconstruction.

The limits are worth stating. A governed data layer does not capture an analyst’s reasoning, and it does not replace a decision record. You still need the reviewer’s rationale. What it removes is the argument about whether the underlying documents were handled and accessed the way policy says they were.

What to Do Monday Morning

Stop asking whether your AI diligence tool is accurate enough. Here is the question that matters. If an assessor asked you tomorrow to reproduce one third-party decision from the last quarter, could you?

Run that test on a single file this week, then fix what breaks. Four moves get you most of the way.

Map the decision points. List every step in your third-party diligence process where AI touches the work, then mark which steps produce a finding and which produce a judgment. S-RM’s data says your next wave of AI use concentrates in the second kind. Tier each step by what happens if it is wrong.

Set review thresholds before the tool sets them for you. Human assurance must scale with the risk of the decision. Write down which outputs a reviewer may accept, which require corroboration from a second source and which must go to a named person. Then write down what the reviewer must record each time.

Create a decision record that survives staff turnover. For each diligence outcome, capture the inputs used, the AI output, the reviewer, what they changed or questioned, and the rationale for the final call. If filling it in takes more than a few minutes per file, shorten the template until people use it.

Put the data trail in one place. Decide where diligence documents are exchanged and where AI assistants may reach them, then confirm your audit logs cover both. Where they do not, you have found the gap before an assessor did.

Then take the same test to your vendors. Ask any AI diligence provider, including the ones that sell the tools S-RM’s respondents are buying, to show you how a past output can be reproduced and what record they keep of the sources behind it.

To learn more about building a defensible evidence trail for AI-assisted third-party diligence, schedule a custom demo today.

Additional Resources

• Blog Post
  Zero‑Trust Strategies for Affordable AI Privacy Protection
• Blog Post
  How 77% of Organizations Are Failing at AI Data Security
• eBook
  AI Governance Gap: Why 91% of Small Companies Are Playing Russian Roulette with Data Security in 2025
• Blog Post
  There’s No “–dangerously-skip-permissions” for Your Data
• Blog Post
  Regulators Are Done Asking Whether You Have an AI Policy. They Want Proof It Works.