Banks, lenders, insurers and pharmaceutical manufacturers are starting to use AI for some of their most document-heavy work: finding the right clause in a policy, comparing a procedure against a requirement, assembling evidence before an audit, preparing a first draft for review. The potential is real. Much of the time spent in these teams goes into locating and assembling information, not judging it.
But in regulated work, an output rarely stays internal. It can end up in front of an auditor, an inspector or a regulator, and someone in the organisation has to stand behind it. That changes what “good AI” means. Capability is necessary. It isn’t sufficient.
The question for regulated organisations is no longer only: “How capable is this AI?”
It is also: “Can we show where it ran, what it relied on, what it was allowed to do, and who approved the result?”
Why the stakes are rising
Three shifts are making this question more urgent.
AI is moving from answering to acting. Early tools summarised and answered questions. Newer systems can retrieve records, fill in forms and trigger steps in other systems. The more AI can do, the more it matters who decided it could.
Use is spreading faster than governance. In many organisations, employees are already using AI tools that were never formally approved, often with internal documents. The question isn’t whether AI is being used on sensitive work. It’s whether anyone decided how.
Accountability doesn’t transfer. When an AI-assisted assessment is wrong, the organisation that relied on it is accountable, not the model provider and not the software vendor.
Six questions every AI initiative in regulated work should answer
- What work will this support, and how is it done today? Name the task, the people who own it and the current effort, so improvement can be measured rather than assumed.
- Which sources may it use? Confirm they are the approved, current versions, and that the AI respects who is allowed to see what.
- Where does information go? Follow it through every path: model requests, storage, logs, error reports, monitoring, support access and software updates.
- What can it do on its own, and what needs a person? Define where AI may only suggest, and where a named professional must approve.
- How will a reviewer check the result? Every finding should point to its source passage, and anything the AI couldn’t find should be stated, not hidden.
- What happens when the model changes? Agree how a new model is tested against the organisation’s own examples before it reaches real work.
Our view: bring AI to the evidence
In regulated industries, the evidence that matters lives inside the organisation: policies, procedures, records, inspection files and past decisions. Rather than moving that evidence out to wherever an AI service happens to run, AI should operate where the evidence already lives, under rules the organisation sets.
Three principles follow.
Keep accountability with the professionals
AI is well suited to preparation: retrieving approved material, comparing documents, flagging inconsistencies and drafting for review. Judgement stays with the people accountable for it. A sensible starting point is AI that prepares and a professional who decides. Its authority can grow only after its performance and safeguards have been demonstrated. Each workflow should have an owner, an approved use, agreed evaluation criteria, a change process and a tested way to stop it.
Make missing information visible
In compliance and quality work, a confident answer that hides a gap is more dangerous than no answer at all. Useful AI shows what it found, where it found it, and what it could not find. A reviewer should spend their time judging the evidence, not searching for what was left out.
Treat model changes as controlled changes
Regulated organisations already control changes to procedures, policies and validated systems. A change of AI model deserves the same discipline: test it against the organisation’s own examples, approve it, and record when it went live. Models will keep improving. The process for adopting them should be the organisation’s, not the provider’s.
Start narrow, expand on evidence
The goal isn’t to deploy AI everywhere. It’s to build a controlled foundation that new uses can join once they’ve earned their place.
That starts with one bounded workflow: a clear task, a measured baseline, agreed acceptance criteria and a defined boundary. Measure both the quality of the output and the effort it takes to review. Expand only when the value and the controls have both been demonstrated. Each workflow built this way leaves the organisation with something lasting: organised knowledge, tested rules and a clear record of what works.
Conclusion
Regulated industries have always required discipline: clear ownership, documented evidence, controlled change and accountable decisions. AI doesn’t replace that discipline. It raises the stakes for it.
The organisations that will put AI to work on their most important tasks won’t simply be the ones with the most capable models. They’ll be the ones that decided how their AI operates: where it runs, what it can see, what it can do, and when a person must approve.
Your enterprise should decide how its AI operates.