Suresh discusses the practical realities of implementing AI-driven compliance monitoring, highlighting the importance of strong data governance, human accountability and explainable AI. He explores current and future use cases for AI within regulatory monitoring, controls testing and assurance activities while outlining where organisations should remain cautious when relying on automated decision-making.
As organisations increasingly deploy AI across compliance and risk functions, moving from periodic reviews to continuous monitoring presents both opportunities and challenges. In this Q&A, Suresh Sankaran, Prudential Regulation Lead at NatWest Group, shares his perspectives on AI-enabled oversight, evolving regulatory expectations, governance frameworks and the balance between automation and human judgement.
1. Moving from periodic reviews to continuous monitoring is a major shift for many organisations. What are the biggest operational and cultural barriers you've seen when implementing AI-driven continuous oversight, and how can firms overcome them?
The biggest challenge is rarely the technology itself. It is the operating model and the mindset shift.
Traditionally, compliance and assurance functions have been built around periodic reviews, sample testing and retrospective analysis. Continuous monitoring challenges that model because it creates a near real-time view of risk and control effectiveness.
Key operational barriers include data quality and integration challenges, fragmented control environments, unclear ownership of alerts and remediation activities, and alert fatigue. Cultural barriers include concerns around AI replacing professional judgement, resistance to increased transparency and viewing monitoring solely as a compliance responsibility rather than a business responsibility.
Successful organisations position AI as an augmentation capability, supported by strong data governance, clear accountability and a focus on identifying emerging risks earlier.
2. As regulatory expectations continue to evolve, where do you see AI delivering the most immediate value within compliance surveillance and regulatory monitoring, and which use cases are still not mature enough to rely on?
The most mature use cases are those involving large volumes of information that require efficient analysis and prioritisation.
Immediate value can be found in:
- Regulatory horizon scanning and change monitoring.
- Policy and regulatory obligation mapping.
- Transaction and communication surveillance.
- Anomaly detection.
- Evidence gathering and controls testing support.
- Regulatory reporting quality assurance.
Areas requiring complex contextual judgement remain less mature, including conduct assessments, interpretation of regulatory intent, disciplinary decisions, unusual control evaluations and final assurance opinions. AI can highlight potential issues, but humans should remain responsible for final decisions.
3. When AI is used for controls testing and assurance activities, how should organisations measure effectiveness and ensure the outputs are reliable enough to support critical risk and compliance decisions?
