What should never be automated in compliance.

The wrong debate.

"Should AI be used in compliance?" is the wrong question. The volume of work has made that decision for us. The better question is which parts it should do, and exactly where it must stop.

Let the AI do this.

Read every contract, certificate and earlier answer. Propose a risk tier based on what each party touches. Check answers against registers. Find what disagrees. Draft findings and replies with a source on every claim. Chase what is missing. Prepare the meeting.

This is the work that eats senior people's weeks, and it is well suited to AI.

Never automate this.

Accepting risk. A risk accepted by nobody isn't really accepted.

Approving. Approval means someone can answer for it afterwards.

Signing or sealing. That is a statement by a person or a company, not a prediction by a model.

Filling a gap with a plausible answer. When no fact grounds it, the honest output is "needs evidence".

Accountability can't be delegated to software.

You can't put a model in front of a board. Regulators, customers and courts want to know which person was responsible. So the line isn't about what AI is capable of. It's about who has to answer.

The test.

Ask any AI vendor, us included, two things. What does your AI refuse to do? And afterwards, can you show me who decided? If the answers are vague, the risk is still yours.