8 Minutes - Read Now 
Every time an ethics and compliance team takes something an AI tool produced and builds on it, someone has signed off on that output. Most people never think of it that way. If a regulator or your own board asks you to explain the decision, though, “the AI generated it” won’t carry you far.
I recently joined Ethisphere Chief Strategy Officer Erica Salmon Byrne and Editor in Chief Bill Coffin for a webinar on this subject, and the audience poll framed the problem well. Nearly 79% of attendees said their teams use AI to help draft core E&C documents such as the Code of Conduct, and that their use is growing. Only about 14.5% said they were very confident they could walk a regulator through an AI-assisted policy provision by provision.
That 14.5% gave me pause. I don’t doubt those teams can defend their work, but will they defend it successfully? In my experience, the organization that says “nothing to see here, ladies and gentlemen, carry on” is usually the one with something hiding under the carpet. Policy drafting is a narrow use case. Most organizations don’t build their own sandboxes, though, and without one, it’s highly unlikely you know what each employee is doing with AI.
Too many teams assume that if AI generated something, it must be right. Regulators don’t want to hear that. They want to know how you reached a conclusion and how you decided to sign off on it. Before you take any AI output further, ask yourself whether you’re comfortable putting your name on it. Then ask whether you could replicate it, and whether you understand how the tool produced it.
An Inequality of Arms
Through Mitratech’s strategic advisory work with thousands of organizations, I seldom come across one with people dedicated to AI accountability and traceability. Compliance teams usually know this work matters. What they lack is power. From the top comes an incredible push to adopt AI as much, as soon, and as broadly as possible. Meanwhile, the compliance manager runs to catch up with a pen and a piece of paper (or, if they’re really sophisticated, an Excel sheet).
To level the playing field, compliance has to work closely with the teams that have the technical knowledge to identify risks. Those teams can build in the accountability logging that the law increasingly requires, and compliance should be checking in with them on a regular schedule. Very few organizations I see take that cross-functional approach to AI governance. Fewer still build traceability into it.
Getting Past the Plausibility Trap
Obviously wrong answers get caught. What slips through is the plausible, polished answer that rests on assumptions nobody in your organization ever examined.
Reliability comes down to prompting. AI is keen to please you, and it needs firm prompting to understand that pleasing you means challenging you. I tell my tools to be my thought partner, not my thought leader. I’m the thought leader (or at least I pretend to be), so challenge me on every statement, and give me a primary source.
I also use two models that don’t communicate with each other and check the output of one in the other. When I find errors, I help the AI remember them so it doesn’t repeat them.
You still need a human in the loop who asks the annoying questions, even if that slows the system down. Read AI output with an almost academic eye. If there’s no footnote pointing to an existing primary source you can check, don’t trust it. The discipline is about actually opening the source and reading it, as “primary sources” may seem plausible, but can be hallucinations. We all learned that discipline at university. AI has made the work faster and far more massive, and the fundamentals haven’t changed much.
What Belongs in the File
If a regulator asked to see how you built an AI-assisted policy or Code of Conduct, here is what I would want in that file:
- Every input, shown consistently, so nobody has to guess where something came from
- Evidence that the model delivers consistently each time you use it to create or update a policy
- Where the data is stored and who has access to it
- A clear statement of what the AI should and shouldn’t decide
- Human reviewers with real authority to override it
- An audit trail, the piece I find missing most often
All of it depends on AI traceability (documenting its decision chain), with an ultimate goal of developing robust AI explainability (how it made the decisions it made). However complex the process became, can you break it into small steps and explain how the outcome was generated? That’s the whole job, and it’s much harder than it sounds.
Outside counsel makes a useful comparison. Your outside lawyers trained for years, passed the bar, and work within an external system of checks and balances. What they do produces a high level of trust. Many AI agents, however, are built in-house by people with little ethics and compliance background, or little technical background. Everyone can build an agent nowadays. Even if I were technically capable of building a rocket, I would never sit in one I built myself, so why would I trust an AI I built myself? Nobody comes in from outside to check your model.
ISO/IEC 42001 offers one route to the independent review that in-house builds lack. It specifies requirements for an AI management system, and certification involves an audit by an accredited third party. The certificate attests to the management system and says nothing about the accuracy of any individual output, so it supports the file without replacing the review of each use.
None of this puts compliance work off-limits for AI, but it does call for judgment. For one whistleblowing case a year, I wouldn’t build an agent. I’d rely on trained people who know whistleblower protection law. For high volumes or hyper-complex cases, AI can make your life much easier.
Don’t Wait for the Big Stick
AI regulation has become politicized. Europe still treats the protection of personal data as a basic human right. The U.S. leans toward letting the industry regulate itself. China puts protecting the state first. Those worldviews collide, and Europe has watered down and postponed its own rules through the omnibus proposals.
As with so many topics in GRC, the presence or absence of a regulator’s big stick shouldn’t drive your AI governance. There’s already a big stick, and it’s the collapse of your own organization. A vendor could set it off, or an employee, or a risky use of AI, including whatever you’re uploading to the third-party providers of those fancy AI tools.
We’ve seen smaller cases where AI-generated work cost a firm its reputation. We haven’t yet seen the big catastrophe at a major organization that pushes AI governance forward. When it comes, the profession will learn from it, and the organization at the center of it will pay the price.
Prove a Reasonable Effort
Let me be pragmatic. You should strive to explain every AI output, but you’re unlikely to get all the way there. The almost ancient GRC approaches still apply, and the question they ask is whether you can prove you made a reasonable effort to keep things from going wrong. That means AI literacy work you can prove and a map of where AI is used that you can prove. It also means constant oversight of what the AI generates and what people do with it.
The Evaluation of Corporate Compliance Programs, which the US Department of Justice Criminal Division uses to assess compliance programs, addresses AI directly in its September 2024 edition. Prosecutors are directed to ask how a company governs AI in its business and in its compliance program, which controls monitor the reliability of the technology, what baseline of human decision-making is used to assess it, and who is accountable for its use. They are also asked how quickly the company can detect and correct AI-driven decisions that conflict with its values. The guidance describes its questions as neither a checklist nor a formula, which makes it a standard of demonstrable process.
For organizations within the scope of the EU AI Act, the literacy work described above has a legal anchor. Article 4, as replaced with effect from 27 July 2026, requires providers and deployers of AI systems to take measures that support the development of AI literacy among their staff and the people operating AI on their behalf, in proportion to their knowledge, role and context of use. The text states that no specific level of literacy has to be guaranteed for any individual. The legislator has therefore defined the duty as one of effort, which is the standard this article recommends compliance teams plan to evidence.
Everything you learned in your ethics and compliance role applies to AI governance. I’d be surprised if the question in court is “how was this outcome generated?” Far more likely, it will be “what did you do to prevent things from going wrong?” Make sure you have an answer, and the file to back it up.
To hear the full conversation, including Erica Salmon Byrne on the verification tax, compliance agents, and privilege risk, watch If a Regulator Asked You to Defend Your AI-Assisted Work, Could You? on demand.
Author Bio
Jan Stappers | Executive Vice President, GRC Solutions Strategy, Mitratech, Guest Contributor
Jan Stappers is Executive Vice President, GRC Solutions Strategy at Mitratech, a global leader in AI-powered governance, risk, and compliance software trusted by more than 8,300 organizations across 75 countries. He is an authority on governance, compliance, whistleblowing, and risk program design, and he contributed to the development of ISO 37002, the international guidance for whistleblowing management systems.
