Compliance teams skipping AI checks report higher fine rates

AI use in compliance puts decision defensibility under pressure

Compliance teams using AI need evidence and expert review to explain and defend their decisions. Enhesa surveyed 273 senior decision-makers in compliance, risk, environment, health and safety, legal, and sustainability at companies with 5,000 or more employees. Enhesa has a commercial interest in demand for compliance services, which readers should keep in view when weighing its findings and recommendations.

The survey shows a gap between the evidence teams want and their confidence in defending decisions: 91% considered source citations critical, and 88% wanted a full audit trail showing how the system reached its conclusion. Yet only 32% were very confident their team could defend the logic of an AI-driven compliance decision. Defensibility means being able to explain a decision’s reasoning and supporting evidence, so this confidence gap poses a practical challenge as teams expand AI use.

Regulatory workload creates demand for faster compliance work

The pressure to expand AI use starts with the volume of regulatory work reaching compliance teams. Enhesa tracked more than 22,000 major regulatory changes during 2025 and more than 15,000 in 2026 through August. The figures cover a full year and a partial year, respectively. Alongside that volume, 88% of survey respondents said another regulatory change arrived before they had finished implementing the previous one.

Unfinished work has consequences across the business. Nine in 10 teams in Enhesa’s survey reported at least one business impact from regulatory complexity in the past year, including higher legal or external consulting spending, heavier workloads, and delays to product launches or market entry. Keith Berry, chief executive officer of Enhesa, described those costs: “Regulatory change is moving faster than anyone can track manually and comes with material business impact. Fifty-three per cent of companies said they increased outside consulting costs, and 34% delayed a product launch or market entry as a result,” he said.

Market-entry decisions show how compliance work can affect growth plans. Enhesa’s survey found that, over the past two years, growing complexity led 60% of companies to reconsider, delay, or abandon entry into a new market, while 18% abandoned market entry outright. Understanding regulatory requirements therefore helps determine whether an expansion proceeds at all. The burden includes interpreting the rules and making the commercial decisions that depend on them.

With so much work at stake, AI already plays a broad role in respondents’ operations. Enhesa found that 76% were using AI across the entire compliance function or running it fully autonomously on at least one core compliance task. The combined measure captures two forms of deployment: function-wide use and autonomous execution of a task. It shows how widely AI is deployed while grouping those forms of use in the same reported category.

The reported gains help explain AI’s appeal. Forty-eight per cent of Enhesa’s survey respondents reported significant improvement in the speed of identifying and responding to regulatory changes, and the same share reported improved efficiency in compliance monitoring and reporting. Only 26% reported comparable improvement in anticipating future regulatory risk. Respondents therefore saw greater gains in handling current obligations than in preparing for future ones.

Expert-review practices are associated with different fine rates

Faster processing makes the decision to check AI-generated guidance especially important. In Enhesa’s survey, 40% of compliance teams said they always or often acted on that guidance without expert review. They were deciding what to do before an expert had checked the guidance, so review needs a defined place between producing guidance and acting on it.

One comparison in Enhesa’s survey focused on teams that skipped verification entirely. Those teams reported a regulatory fine rate of 37%, compared with 13% among teams that did not skip verification entirely, making the first group nearly three times as likely to report a fine. The comparison group includes teams that performed some verification; it does not imply that they checked every recommendation. That definition matters when interpreting the difference.

A separate comparison in the same survey grouped respondents by how frequently they skipped expert review. Teams that rarely or never skipped it reported a fine rate of 7%, compared with 27% among all other teams. Both comparisons associate less verification with higher reported fine rates, but they use different groups within the same survey. They remain separate findings about reported practices and outcomes.

The consequences extended beyond fines. Overall, 56% of teams in Enhesa’s survey reported some negative outcome linked to unverified or incorrect AI output. Across all respondents, 30% cited incorrect filings, 21% regulatory fines, 20% missed deadlines, and 18% failed audits. These categories share the same respondent base and can overlap, because a team may have experienced more than one outcome.

Each outcome points to a different place where a check can matter. A filing requires checking what the company submits, a deadline requires checking when it must act, and an audit requires work that can withstand examination; fines add a direct regulatory consequence. Leaders assessing speed gains can use these distinctions to examine the quality and timing of the work being accelerated. The review must establish whether the guidance fits the obligation the team needs to meet.

Tool choice and autonomy raise separate governance questions

Expert review concerns how teams assess guidance, while tool choice determines where they handle the information used to produce it. Enhesa found that 64% of compliance teams had entered sensitive material into personal or non-corporate AI tools during the past year. Proprietary chemical or manufacturing data were the most common types of sensitive material entered. This practice brings information handling into the same management discussion as the quality of AI-generated guidance.

For teams entering sensitive material into those tools, Enhesa’s survey found a negative-outcome rate of 82%, compared with 9% among teams that entered nothing. The comparison links information-handling practices with reported adverse outcomes. A data breach is a specific incident involving exposure of information; the survey comparison concerns the broader category of negative outcomes. Leaders examining tool use therefore need to distinguish how sensitive inputs are handled from the outcome a team reports.

The amount of work delegated to AI presents another management choice. Thirty-seven per cent of teams in Enhesa’s survey reported running fully autonomous or agentic AI, meaning AI that performed at least one task fully autonomously. Among those teams, 71% reported a negative outcome, compared with 47% of all other teams. This autonomy-only measure identifies a specific deployment practice within the broader adoption figure discussed earlier.

Because tool choice and autonomy are different decisions, they need separate review questions. For personal or non-corporate tools, the question is what sensitive information employees enter and where it goes. For autonomous tasks, it is what the system can do on its own and where expert judgment enters the process. Keeping the questions separate helps leaders examine each practice and its associated outcomes.

Expert judgment shapes the operating-model choice

These review questions lead to a practical requirement: teams need to explain how AI-generated guidance informed their actions. A source citation helps them locate supporting material, while an audit trail records how the system reached its conclusion. Expert review then gives someone a chance to assess whether that evidence and reasoning fit the compliance obligation. Together, these functions connect the guidance to the company’s decision.

Respondents in Enhesa’s survey differed on which operating model would best support that work over the next 12 months. Forty-three per cent preferred AI paired with expert human counsel as the most effective compliance model, compared with 39% preferring AI tools alone and 4% preferring expert human counsel alone. The combined model led, with AI alone close behind. These preferences reflect an active choice about where to retain expert involvement as automation expands.

Berry recommends the combined model, a position that aligns with Enhesa’s commercial interest in compliance services. “AI can help companies stay ahead of regulatory change, enter new markets faster and protect their bottom line, but only when leaders can trust the data informing it and defend their actions,” he said. He makes trusted information and defensible decisions conditions for gaining those commercial benefits.

Within that model, Berry assigns processing speed to AI and strategic judgment to experts. He describes the division of work this way: “AI alone provides teams with speed. Expert counsel alone provides strategic, defensible judgement. Our data shows that together, compliance teams can move as fast as regulatory change demands, with the confidence that every decision will hold up.” His recommendation puts expert counsel within the process that turns AI-generated guidance into compliance decisions.

Main highlights

• Defensible decisions need evidence: Only 32% of respondents were very confident they could defend an AI-driven compliance decision. Compliance owners need source citations, audit trails and expert review to connect AI guidance to the obligation being addressed.
• Target AI at current regulatory work: Respondents reported stronger gains in responding to regulatory changes and monitoring compliance than in anticipating future risks. Compliance managers can prioritize these proven uses while separately assessing AI’s value for forecasting.
• Put verification before action: Teams that skipped verification entirely reported a 37% fine rate, compared with 13% among other teams. Compliance owners can establish expert-review checkpoints before staff act on AI guidance; the survey shows an association between verification practices and fines.
• Review data handling and autonomy separately: Sensitive-data entry into personal or non-corporate AI tools and autonomous AI use were each associated with higher negative-outcome rates. Technology and compliance owners need separate controls for where information goes and which tasks AI performs independently.
• Define the role of expert judgment: AI paired with expert counsel was the preferred operating model for 43% of respondents, closely followed by AI alone at 39%. Compliance leaders can assign responsibility for reviewing evidence and approving actions, while weighing Enhesa’s recommendations against its commercial interest in compliance services.