← All finance signals
Governance

Reading the Rulebook

Compliance used to mean a person reading a hundred-page filing; now an AI agent reads it first, and the read has to survive an auditor’s questions.

What is it?

Compliance work is shifting from people reading filings to AI agents reading rules first, then defending that read to an auditor. Real-time regimes like sanctions screening leave no room to flag-and-review later. Whether the agent’s interpretation would survive an actual audit is unproven.

Why now?

Regulation used to arrive as a document; DORA and instant-payment rails now require institutions to show working tooling, not a written policy. The review window sanctions and real-time payments allow has collapsed toward zero. The force is speed outpacing the humans who used to interpret rules.

Who’s building it?

Compliance-tooling vendors and regtech startups build the systems; regulators and auditors set what counts as proof.

Regtech vendorsCompliance teamsModel providersRegulators · DORAAuditors
The full read
Why now, who is building it, where the market goes, and what stays unsettled.
Get weekly →
01 · The market
Who’s in it
Builders — regtech vendors, and the model layer beneath them.
Buyers — financial-services compliance teams, forced to justify their tooling to regulators in real time.
Gatekeepers — regulators writing rules like DORA, and the auditors who test compliance.
What’s at stake
Vendors selling compliance as infrastructure gain pricing power, while firms still running it manually fall further behind.
A wrong real-time read leaves no room to correct.
Regulators, not customers, define what counts as adequate compliance.
What’s unsettled
Whether interpretation-grade AI holds up once an auditor actually challenges it.
Whether smaller firms can afford compliance built to run continuously.
Whether one vendor’s read of a rule becomes the market’s de facto standard.
02 · How the demand matureda progression, not a timeline
Basic
Most firms still run compliance on spreadsheets, reading each filing by hand.
Monitoring
Tools begin tracking regulators continuously, turning publications into specific, actionable items.
Real-time decisioning
Sanctions screening and instant payments force the system to decide immediately, not flag it.
Mandatory tooling
Rules like DORA require institutions to show working systems, not written policy.
03 · Where the market goesthe forks, not a prediction
→Consolidation or a long tail — decided by whether interpretation-grade compliance is cheap enough for smaller firms to build themselves.
→Platform and payment-rail rules may quietly set the real standard before regulators formally catch up.
→Incumbent compliance vendors absorb the smaller regtech startups, or a fragmented market of point tools persists.
→Value settles with whoever controls the audit trail, not the underlying model.
The demand question underneath: regulators can mandate live tooling, but nobody has yet tested whether an AI’s reading of a rule holds in court.
04 · The Compliance-as-Feature deskadjacent markets, moving now
Regulated Reality
Election deepfakes now trigger real law.
30 US states now have election-deepfake laws (2026).
Public Citizen
The Explainability Demand
Labelling AI content becomes a legal requirement now.
EU AI Act Article 50 mandates AI-content transparency labelling.
European Commission
The Bias Audit
State-level AI law keeps getting rewritten and repealed.
Colorado repealed its AI Act, replaced it in May 2026.
Colorado General Assembly
05 · The Wire
01
Agents enter compliance work.
Forbes ↗
02
FINRA sees AI agents moving into early use at member firms
FINRA ↗
03
FinCEN proposal weighs banks’ use of AI tools
U.S. Financial Crimes Enforcement Network ↗
The panel on this signal
They agreed on
–The direction is clearly one-way: compliance is moving from written policy toward running software regulators can inspect directly.
–Real-time regimes now leave no room for manual review.
–DORA-style rules reward vendors who can prove their systems run, not just describe them.
The regulatory analyst disagreed on
–An automated reading of regulatory text has not been tested against adversarial audit questioning; dashboard-level compliance summaries may satisfy internal review without holding up under a regulator’s detailed cross-examination.
Know more about the method →
✦How this signal was built
01 · Panel
A Delphi panel of 4 AI analysts, each reasoning independently.
→
02 · Debate
They challenge and revise each other’s reads over two rounds.
→
03 · Evidence
Every claim is tied to a cited, linked source on The Wire.
→
04 · Synthesis
A moderator writes it into one read, disagreement and all.