Agentic Compliance
Agentic compliance is an approach where AI agents perform much of the work required to build, operate, maintain and evidence a compliance program, while humans retain leadership and accountability.
AI-managed. Human-led. Independently audited.
What SOC 2 looks like for an AI-native companyFrom company context to independent assurance.
- 01Company context
- 02Compliance Brain
- 03AI agent
- 04Compliance program
- 05Independent audit
Six ideas that shape the model.
- 01Agentic Compliance
- AI agents perform much of the work of building, operating and maintaining a compliance program, while a human compliance leader stays accountable and an independent auditor provides assurance. AI-managed. Human-led. Independently audited.
- 02Compliance Metadata
- The company-specific variables (what you sell, who your customers are, what you have promised, your data, systems, risks and operating choices) that materially influence how your compliance program should work.
- 03Compliance Brain
- A structured representation of a company’s compliance metadata that gives an AI agent the context it cannot know on its own, so it can build, operate and maintain a compliance program that fits the company.
- 04Agent-native compliance
- A compliance model where activities stay in the systems where the work already happens and an AI agent is the primary coordination and intelligence layer, so the teamwork between humans and AI happens in the company’s existing tools rather than a dedicated compliance application.
- 05Compliance Shapes
- The most consequential design decisions about how a company’s product, service and organisation operate that determine how its compliance program should work in practice.
- 06Compliance Skills
- Practical instructions that tell an AI compliance agent how to perform recurring work, including the objective, context, systems, steps, evidence, permitted actions and escalation conditions.
Start with your question.
Can AI run my compliance program?
Yes. AI can already run a significant part of a compliance program, and for some companies it can perform much of the role traditionally performed by a compliance manager. But there is an important distinction: AI can be your compliance manager. A human still needs to be the compliance leader. Execution can move to AI. Accountability cannot.
Read the answer →Do I still need a compliance platform?
Agentic compliance can provide the knowledge, coordination and automation across the systems you already use. For some companies, this reduces the need for a dedicated compliance platform. But platforms still offer valuable out-of-the-box functions, and your agent can operate within them. The biggest question is where humans and AI do their teamwork: inside a compliance platform, or across the other tools your company already uses.
Read the answer →How do I give an AI agent enough context to manage my compliance program?
Give AI the context it can’t know on its own. AI already knows compliance; what it doesn’t know is your company. Capture your compliance metadata (what you sell, who your customers are, what you’ve promised, your data, systems, risks and operating choices) in a Compliance Brain. 20–30 of the most important pieces is often enough to start.
Read the answer →Who can audit an agentic compliance program?
In principle, any appropriately qualified audit firm can audit an agentic compliance program. Using AI agents doesn’t create a different category of SOC 2 audit. But being technically capable differs from being well suited: auditors who understand how agents are instructed, given context, access and authority, escalate and leave evidence will audit you more efficiently and intelligently.
Read the answer →How do you build an agentic compliance program?
To build an agentic compliance program, give an AI agent a defined compliance role, enough context to understand your company, access to the systems where work happens, clear skills and responsibilities, bounded authority to act, rules for when to escalate, and an accountable human leader.
Read the answer →What are Compliance Shapes?
Compliance Shapes are the most consequential design decisions about how a company’s product, service and organisation operate that determine how its compliance program should work in practice.
Read the answer →How to run your compliance program with AI: connectors, browser agents and a human in the loop
Most of what a compliance platform does, such as collecting evidence, tracking controls and connecting the tools where compliance actually happens, can now be done directly with AI. There are three methods: connectors, browser agents and a human in the loop. They differ in reliability, coverage and how much human involvement they need, and most programs will use all three.
Read the answer →