Legal and compliance functions have an unusual relationship with new technology. They are asked to reduce cost and turnaround time like every other department, while carrying the consequences when something goes wrong. That asymmetry explains a lot of the caution, and most of it is justified.
AI for compliance management is worth taking seriously anyway, because the work that consumes legal teams is largely reading. Reading contracts for obligations, reading regulatory updates for anything that applies, reading policy documents to answer the same internal question for the ninth time this month. Machines read quickly and consistently, which is exactly the shape of the problem. What they do not do is exercise judgement about risk, and a system designed on the assumption that they do will fail in the most expensive way available.
At iSpark we work with legal and compliance leaders on that distinction. This article covers where AI in compliance management produces real gains, the one failure mode you must design out before anything else, a documented example from a US bank, the mistakes that create exposure rather than reduce it, and a realistic way to begin.
The Failure Mode You Have to Design Out First
Fabricated citations are the reason many legal teams stopped at the pilot stage. A public tracker of court decisions involving AI generated fabricated content now records well over two thousand cases internationally, and notably, self represented litigants account for more of them than lawyers do. The problem is real and it is documented.
It is also almost entirely avoidable, and that is the part most coverage misses. Fabrication happens when a model is asked to generate from memory. It largely stops happening when the model is constrained to a defined source set and required to cite back to specific documents, because it is then retrieving rather than composing. Our work on AI for legal and compliance teams starts from that principle: constrain generation, require citation, and the headline risk becomes a manageable verification step rather than a reason to avoid the technology.
Where AI Legal Technology Earns Its Place
| Use case | What AI contributes | What stays with a lawyer |
|---|---|---|
| Contract obligation extraction | Pulling terms, dates and commitments across a whole portfolio | Deciding what to do about what it finds |
| Contract review against a playbook | Flagging deviations from agreed positions | Negotiating the deviations worth fighting |
| Regulatory change monitoring | Filtering updates to the ones that touch your business | Interpretation and impact assessment |
| Policy and internal advisory | Answering routine questions from approved documents | Anything novel, escalated or contested |
| Compliance monitoring | Detecting pattern breaks across transactions or communications | Investigation and reporting decisions |
| Discovery and document review | Prioritising and clustering large document sets | Privilege calls and responsiveness |
Contract obligation extraction is usually the highest value first build, and it is underrated. Most organisations do not have a reliable list of what they have actually committed to across their contract estate. Finding out is valuable on its own, before any efficiency argument is made.
A Real Example: JPMorgan Chase and Contract Review
The challenge. JPMorgan Chase reviewed more than 12,000 commercial credit agreements a year. Interpreting them consumed roughly 360,000 hours annually of lawyer and loan officer time, and the work was slow, inconsistent between reviewers, and prone to errors made under deadline pressure. Loan servicing mistakes traced back to contract interpretation were a recurring cost.
The solution and implementation. The bank built COiN, short for Contract Intelligence, to extract and classify key clauses: interest rate provisions, payment schedules, covenant thresholds and default triggers. The scoping decision is the instructive part. JPMorgan did not aim at legal work generally. It targeted one high volume, high cost, well defined document type where the right answer could be checked.
The outcome. Review that had taken hundreds of thousands of hours annually was completed in seconds per document, with fewer interpretation errors than the manual process it replaced.
The business impact. Lower servicing risk, faster turnaround, and skilled people moved off routine clause checking. One honest caveat: COiN went live in 2017, well before current language models, and the numbers are the bank’s own. It is included here because the scoping lesson has aged better than the technology, not because 2017 results should be expected from a 2026 pilot.
Common Mistakes in AI Compliance Automation
- Allowing open generation on legal questions instead of constraining the model to approved sources.
- Deploying an internal advisory tool on top of policies nobody has updated.
- Starting with the hardest, most bespoke work rather than the highest volume repeatable work.
- Failing to record which outputs were AI assisted, which matters if a regulator asks later.
- Putting confidential or privileged material into tools without checking retention and training terms.
- Treating a flagged deviation as a decision rather than as a prompt for review.
Best Practices Checklist
- Constrain generation to a defined, current source set and require citations to specific documents.
- Keep a verification step with a named owner for anything leaving the organisation.
- Log what was AI assisted, by whom and on what date.
- Confirm data retention, confidentiality and training terms in writing before any pilot.
- Test on documents where you already know the answer before trusting new ones.
- Review the source set on a schedule. An out of date policy library quietly produces wrong answers.
How to Get Started
- Pick one document type you handle in volume with a consistent structure.
- Assemble a gold standard set of documents that have already been reviewed correctly.
- Measure the tool against that set before it touches live work.
- Run it alongside the existing process for one full cycle and compare.
- Expand to a second document type only after the verification habit is established.
Future Trends in AI Regulatory Compliance
Three developments matter. Regulatory expectations are converging on documentation, meaning organisations will increasingly be asked to show how an automated decision was reached rather than simply that a policy exists. Governance frameworks are becoming procurement questions, and published material such as Microsoft’s Responsible AI Transparency Report gives a sense of the evidence larger buyers now expect. And compliance teams are increasingly being asked to govern AI the business has already deployed, which is a different job from using AI themselves.
Key Takeaways
- Fabrication is a design problem, not an inherent property. Constrain generation and require citations.
- Contract obligation extraction is usually the highest value first build.
- Scope narrowly to a document type where correctness can be checked, as JPMorgan did.
- Legal and compliance will increasingly be asked to govern AI elsewhere in the business, not just adopt it.
Frequently Asked Questions
Is AI safe to use for legal work?
Yes, when generation is constrained to approved sources, outputs cite specific documents, and a named person verifies anything that leaves the organisation.
What should a legal team automate first?
Contract obligation extraction. It uses documents you already own, produces immediate value, and errors can be checked against the source text.
Will AI replace lawyers or compliance officers?
No. It removes reading and extraction work. Interpretation, risk judgement, negotiation and accountability for advice all remain with qualified people.
How do we handle confidential documents?
Confirm retention, confidentiality and model training terms contractually before any pilot, and keep privileged material within systems your organisation controls.
Do regulators accept AI assisted compliance work?
Generally yes, provided you can document how outputs were produced, verified and approved. Keep records of what was AI assisted from day one.
Where to Take This Next
The legal teams getting value here are not the boldest adopters. They are the ones who understood that the famous failure mode is a design choice, scoped their first project to something checkable, and built a verification habit before scale. That order is what separates useful from risky.
If you want an independent view of which parts of your legal or compliance workload would benefit and which should stay manual, iSpark runs fixed scope assessments that end with a written recommendation either way. Start with your contract estate and the obligations inside it.
Published by: iSpark
