Compliance officer — tasks, one by one

Reading the rule

Reading long documents and summarising them is squarely what models do well, and the volume of regulatory text is the reason this job has grown. What does not transfer is the second half: knowing which of this company's actual processes the clause lands on, which requires knowing the processes rather than the clause.

Faster reading raises the expected scope rather than reducing the work: once summarising is free, the question becomes why you have not assessed every jurisdiction. The hours move from reading to defending an interpretation, which is a meeting rather than a document.

Working the alerts

This is the same task as the SOC analyst's queue and the security guard's camera wall, and it fails the same way: the true-positive rate is very low, human vigilance collapses, and correlation is machine-checkable. Financial crime monitoring is one of the most heavily automated alert pipelines anywhere for exactly that reason.

The queue is where this profession hires and where the pattern recognition is learned, so automating it removes the training ground. And the regulator's expectation is that alerts are investigated, not that they are closed — a system that closes more of them faster produces a metric that improves while the risk does not.

Saying no to the business

The mechanism here is organisational, not analytical: the refusal works because a named person with standing will be the one questioned if it turns out to have been wrong, and because they can be overruled in a way that is recorded. Neither property exists for a system, which is why no institution delegates it.

Held in place by structure, not by difficulty, and structure is cheap to change: a compliance function that reports into the business it polices has this task on paper and not in practice. The question to ask is not whether a tool could do it but who you report to, and that answer changes without any technology involved.

Proving it was done

Evidence collection is structured logging with a known format, and it is the part of compliance work that everyone agrees should not require a person. The outcome is checkable — the record exists and is complete, or it is not — which is the property that allows unattended operation.

Automating the evidence does not automate the judgement it evidences, and it creates a specific new risk: a complete record of a control that was not actually effective is worse than an incomplete one, because it is harder to challenge. Auditors have begun asking how the record was produced, which is a question the tooling was not designed to answer.