Generative AI as a Compliance Analyst

Continuing my exploration of AI usage in/for corporate regulatory compliance, I wanted to see how useful LLMs (and specifically the new Bing chat tool) currently are as an analysis tool. The new Microsoft Bing is powered by ChatGPT and appears to be even more powerful than its progenitor due to its ability to conduct searches based on prompts and incorporate those results into its responses.

For this experiment, I decided to utilize Bing to see what insights could be generated from State Department charging letters and Consent Agreements related to ITAR violations. After a few false starts, I did get Bing to generate the following summary of common issues/violations across multiple charging letters in the past 15 years (word for word from Bing, in order of occurrence/importance):

• Unauthorized export of technical data and defense services related to various defense articles, such as software, microelectronics, missile systems, aircraft components, thermal imaging cameras, etc. This is the most frequent and serious violation, as it can pose a risk to national security and foreign policy interests.
• Violation of the terms or conditions of licenses and agreements issued by the DDTC, such as exceeding the scope, duration, or quantity of authorized exports, or failing to comply with reporting or recordkeeping requirements.
• Failure to register with the DDTC as a manufacturer, exporter, or broker of defense articles or services, as required by the ITAR.
• Lack of internal controls to ensure compliance with the ITAR, such as inadequate training, screening, auditing, or corrective actions.
• Not vetting other parties involved in the export transactions, such as foreign end-users, intermediaries, or subcontractors, to ensure they are eligible and trustworthy.
• Uncontrolled technical data that is accessible to unauthorized persons or entities, such as through email, cloud storage, or public websites.

Not bad.  Couple this with the fact that Bing provided citations and this was a pretty good end result.  The potential utility and power of having such an information synthesis tool at your fingertips is pretty self-evident.

BUT some words of caution:

• One of the main challenges with generative AI is that it is by design predictive and statistical in nature, and does not “understand” the content how humans might. For example, ChatGPT can generate texts that are grammatically correct and coherent, but it may not be able to capture the nuances, context, or implications of the texts. It may also generate texts that are inaccurate, biased, or misleading, (or entirely made up / hallucinated) depending on the data it is trained on and the prompt/input it receives. Users should always verify the sources, facts, and logic of the generated texts, applying their own critical thinking and domain knowledge to evaluate the texts. Certainly interested in exploring and learning how generative AI can build in “truth checking.”
• Bing often had a hard time finding THE critical source for information. For example, I expected it to review DDTC’s consent agreement page when conducting its research, but it had a hard time identifying this webpage as the key webpage to review even when I provided the URL and webpage title. This could be related to Bing’s underlying search capabilities.
• Given the statistical and generative nature of these tools, the quality, depth, and nuance of the output is directly related to the input. There is a whole field devoted to “prompt engineering” and your mileage with generative AI will depend on your ability to craft good prompts that elicit the desired output. Prompt engineering can be tricky and time-consuming, as it may require trial and error, experimentation, and feedback. I struggled quite a bit trying to find the right prompts to cajole Bing to produce the output above.
• There are limits (perhaps guard rails?) to its analytics capability. When I asked it to prepare a table of charging letters showing which of these themes/issues were implicated in each of the letters, it essentially threw up its hands and said that such a task was better performed by a human.
• There is definitely an issue of training data latency. When asking follow-up questions regarding the substance of the list above, it became apparent that the most recent charging letter / consent agreement Bing had digested were the Keysight materials from 2021.

For additional drawbacks and tips for using the new Bing AI capabilities, see this excellent article from Ethan Mollick.

In conclusion, general generative AI can be a powerful analyst/copilot with the right direction and prompting, especially using more domain-specific LLMs (see CoCounsel from Casetext). Certainly, at this point these tools are best used as force multipliers and not replacements for human judgement and abilities. Nonetheless, knowledge workers need to understand and start adding these tools to their toolbelt or risk being outmaneuvered and outworked by the competition.

Further, as such tools are introduced in the corporate setting, companies need to seriously think about how to responsibly use and validate this technology to guard against a whole range of issues including biases of all sorts (discriminatory, confirmation, etc.), stale/outdated information, and made up results, just to name a few.

Responsible Use of Generative AI in Compliance

As generative AI for compliance becomes increasingly common, organizations must establish clear controls for how these tools are selected, used, and monitored. AI can help compliance teams research regulations, analyze enforcement actions, summarize documents, and identify potential risks. However, these capabilities should support-not replace-professional judgment.

One of the most important safeguards is human oversight. AI-generated compliance analysis should be reviewed by qualified professionals, particularly when it involves regulatory interpretations, export controls, sanctions, licensing decisions, or other high-risk matters. Users should verify important facts against authoritative sources rather than relying solely on AI-generated answers or citations.

Organizations should also address data privacy and confidentiality before deploying generative AI tools. Compliance teams often work with sensitive business, employee, customer, and technical information. Companies should define what information can be entered into AI systems and ensure that approved tools meet applicable privacy, security, and data-governance requirements.

AI systems should also be regularly tested for accuracy, bias, hallucinations, outdated information, and inconsistent results. Performance should be evaluated using realistic compliance scenarios, including complex and unusual cases. Where significant errors are identified, organizations should investigate the cause and implement appropriate corrective measures.

Finally, companies should establish clear AI governance policies covering approved use cases, employee training, accountability, monitoring, and escalation procedures. The goal is not to eliminate human involvement, but to use AI as a compliance copilot that improves the speed and scale of analysis while keeping responsibility and final decision-making with qualified professionals.

When properly governed and validated, generative AI can become a valuable force multiplier for corporate compliance teams while helping organizations manage emerging regulatory risks more effectively.