Compliance Teams Not Verifying AI Nearly 3x as Likely to Report Fines

Compliance teams that never verify AI-generated regulatory guidance reported a regulatory fine 37% of the time, against 13% for teams that do, according to an October 14 survey of 273 multinational companies.

The gap makes AI governance for compliance teams a question of verification, not adoption. It is a finding that audit committees and boards will read alongside what supervisors already expect of firms that use models.

The survey is a single data set and cannot show that skipped checks cause fines. It does give compliance, risk and audit leaders a number to test against their own controls, at a time when 76% of respondents run AI across the whole compliance function or fully autonomously on at least one core task.

What the AI governance compliance teams survey found

The research comes from Enhesa’s State of AI in Regulatory Compliance report. Enhesa sells an AI-powered regulatory intelligence platform to large multinationals, so it has a commercial interest in the finding.

It surveyed senior compliance, risk, environment, health and safety (EHS), legal and sustainability decision-makers at companies with 5,000 or more employees operating in two or more countries. The survey ran in August 2026, and 51% of respondents are vice president level or above.

Beyond the headline ratio, the results describe a verification gap:

• 40% act on AI-generated regulatory guidance always or often without expert review. Their top reasons are speed and efficiency pressure (47%), confidence in AI accuracy (42%) and deadline urgency (34%).
• 56% have faced a negative outcome from unverified or incorrect AI output. In the past 12 months, 30% reported incorrect filings, 21% regulatory fines, 20% missed deadlines and 18% failed audits.
• Of the 37% running fully autonomous or agentic AI on at least one task, 71% reported a negative outcome, against 47% of everyone else.
• 64% put sensitive material into personal or non-corporate AI tools in the past year. Those teams reported negative outcomes at 82%, against 9% for teams that entered nothing.

Respondents also set out what they want from AI outputs. In all, 91% call source citation critical before acting, and 88% want a full audit trail. Only 32% are very confident their team can defend the logic behind an AI-driven compliance decision.

What the fine figure does and does not show

The “nearly three times” figure is the ratio of 37% to 13%, or about 2.85 to 1. The survey does not define “fine”. It does not say whether the term covers monetary penalties only, how large the penalties were or which regulators imposed them.

The data is also self-reported. Respondents who skip checks may differ from those who verify in ways the survey does not control for, such as the regulatory intensity of their sector or the volume of filings they make.

The sample leans toward product and environmental compliance rather than banking. IT products and services make up 44% of respondents, pharmaceuticals 26%, healthcare 15% and chemicals 7%. Some 99% operate in North America and 65% in Europe.

Enhesa’s release gives a second cut that does not match the first. Teams that rarely or never skip expert review reported a fine at 7%, against 27% for everyone else. The two comparisons use different groups, and the release does not reconcile them.

The survey’s preferred remedy also aligns with the seller’s product. Asked what they want over the next 12 months, 43% chose AI paired with expert human counsel, 39% chose AI tools alone and 4% chose expert counsel alone.

AI governance for compliance teams under supervisory rules

Whatever the weight of the survey, supervisors already treat verification of model outputs as a control. The Prudential Regulation Authority’s supervisory statement SS1/23 took effect on May 17, 2024. It sets five principles for model risk management, including model identification and risk classification, validation and ongoing performance monitoring.

The statement applies first to banks, building societies and PRA-designated investment firms with approval to use internal models for regulatory capital. The PRA said its concern was that senior executives and boards are not fully aware of how far models drive management decisions. Firms outside that scope can still read it as the supervisor’s view of good practice.

The Financial Conduct Authority has said it will apply existing frameworks to AI rather than write AI-specific rules. Among them is the Senior Managers and Certification Regime (SM&CR), under which named executives carry personal accountability for the areas they oversee. A filing built on unchecked AI output is therefore a question of who signed it off.

In the EU, Regulation (EU) 2024/1689, the AI Act, requires human oversight of high-risk AI systems under Article 14. Article 4 has required providers and deployers to ensure staff have sufficient AI literacy since February 2, 2025.

The high-risk obligations are being pushed back. A provisional agreement reached on May 7, 2026 would move the duties for standalone high-risk systems to December 2, 2027, and for AI embedded in regulated products to August 2, 2028. Firms preparing for them can use RegTech Post’s EU AI Act high-risk pack.

In the US, the Securities and Exchange Commission has pursued firms over what they say about AI. On March 18, 2024, it settled charges against Delphia (USA) Inc. and Global Predictions Inc. over false statements about their use of AI. Delphia paid $225,000 and Global Predictions $175,000, a total of $400,000. Global Predictions could not produce documents to substantiate its claim to be the “first regulated AI financial advisor”.

Those cases concerned marketing statements, not AI outputs used in compliance work. They show the same principle: a firm must be able to evidence what its AI does.

What verification of AI outputs looks like in practice

Read together, the supervisory texts describe a common set of controls. SS1/23 expects a model inventory, risk tiering, independent validation and monitoring of performance after deployment. Article 14 of the AI Act expects people with the competence and authority to oversee, interpret and override a system’s output.

Those expectations map onto the survey’s own markers. Source citation lets a reviewer trace an output to the rule it relies on. An audit trail records who checked it and when. A named reviewer is the person who can defend the decision to an examiner.

For boards, the question for AI governance and compliance teams is where verification sits in the three lines of defence. First-line teams that use AI to draft filings or monitor rule changes are the ones the survey measures. The second line and internal audit would test whether checks on those outputs run and leave evidence. RegTech Post’s AI governance and board report pack and model risk management pack set out reporting structures for that work.

The survey’s shadow AI result bears on data protection as well. If teams enter sensitive material into personal tools, a verification step on outputs does nothing about what has already left the firm. That is an inventory and access question that sits upstream of any review.

Vendors of compliance software are building verification into products. Greenboard’s AI harness for SEC and FINRA compliance teams is one example aimed at US broker-dealer and adviser workflows. Buyers can ask any vendor how its outputs are cited, logged and reviewed.

What to watch on AI governance for compliance teams

The 37% to 13% split is a prompt for internal testing rather than a benchmark. A firm can measure its own rate of incorrect filings, audit findings and regulator contact against how often AI outputs are reviewed, and report the result to the audit committee.

The next fixed date is in Europe. Under the provisional agreement, the AI Act’s human oversight duties for standalone high-risk systems would apply from December 2, 2027.