Compliance is challenging on multiple levels, but perhaps the most significant is scale. Once a business is processing millions of transactions, checking activity against established policies and controls, while investigating exceptions, places a considerable operational burden on compliance teams. The PwC 2026 EMEA AML survey found that confidence in transaction monitoring has fallen below 30% (almost half since 2024), and 40% felt that Consumer Due Diligence requirements are overly reliant on rules.
Consider a hypothetical business processing approximately 5.5 million transactions a month. The challenge isn’t just storing the records, but identifying those that have an error, policy breach or unusual pattern without overwhelming specialists with routine review. Their attention needs to be focused on the exceptions that require investigation and judgement. And this is where governed AI is starting to make a difference.
Gartner has identified anomaly detection, continuous control monitoring and real-time audit logging as emerging capabilities in cloud ERP finance. However, automation alone is not enough for the business that wants truly granular and trusted control – it is essential, says Deloitte, that companies define accountability, access controls, output validation, traceability, exception handling and risk-appropriate human oversight.
AI governance and compliance, managed within the right operational criteria, inverts the way work is done. Instead of a team working through millions of transactions in search of exceptions, the leader sets the criteria for what counts as non-compliant and the AI returns only the records that meet those criteria. You can specify that revenue should never carry a debit, for example, so the moment this appears in revenue, the record is surfaced and flagged for investigation. The volume stops being the problem because the business is no longer looking at all of it, only at what falls outside the rules it has set.
The same logic changes the way the organisation approaches the monthly close. Traditionally, someone has had to log in, confirm that the banks were reconciled and the accounts payable closed off correctly. Now, with AI, those checks are surfaced on a dashboard that can be read at a glance – and this can be taken even further in mature environments where teams only read the exceptions raised by the AI and not the dashboards. They’re not interested in the banks that have reconciled, only in those that have not and they rely on AI to bring those items to their attention. Instead of interrogating a mass of data, the team only works with the information that’s pertinent to them.
AI’s intelligent immersion within these systems changes the structure of a familiar responsibility. Governed AI doesn’t remove the compliance burden; it moves it, and this opens up new obligations around data sovereignty and security. Deloitte’s 2026 State of AI in the Enterprise study, drawn from more than 3,000 business and IT leaders across 24 countries, found that only 21% of companies had a mature governance model in place for agentic AI, even as adoption continues to climb. The controls are slower than AI’s capabilities.
The first of the obligations companies need to meet is data sovereignty. Data is increasingly bound to the country of origin and cannot simply move across a border because it is convenient to process it elsewhere. A customer’s data in Botswana is subject to that jurisdiction’s protections, in South Africa there is POPIA and in Europe there is GDPR. Where the data resides and how its sovereignty is protected have become questions leaders are now expected to answer.
The second obligation is the security around what AI produces. An agent that can read across the business can’t be allowed to answer questions it has no business answering. If an employee asks how much the CEO earns and the system returns the figure, the value of the tool has been undone by the exposure it has created. And this risk extends beyond the company’s own systems making it essential to secure AI outputs and controlling what can or cannot be answered as part of the business governance model.
This is where the real value of the human in the loop and partnership sits. Technology can interrogate the data, provide the exceptions and hold the line on compliance, but it cannot understand the industry or how a business operates in the way an experienced team can. That understanding of a sector, its pressures and the decisions that follow turn a governed system into a well-run one, and that is where it is essential to have the right partnerships and priorities in place.
