AI compliance automation and human review
Christian Kon of AHEAD joins Shruti Gupta to discuss where AI can help with compliance, how to compare its findings with an experienced reviewer’s, and why governance decisions still need human judgment.
Christian Kon · AHEAD. Hosted by Shruti Gupta · Founder & CEO, Zania.
Recorded October 2025 · Video published October 29, 2026.
Episode notes
Selected ideas from the conversation, with practical questions for your team. Chapter links open the relevant moment on YouTube.
Why do control inventories become difficult to manage?
Different teams can describe similar controls in different ways, leaving a company with overlapping requirements and repeated work. Christian recommends consolidating the control inventory and connecting control status to risk priorities. His broader point is that a compliance team should help people understand what to do and what evidence is needed, rather than add another layer of checking without a clear purpose.
Where should a team start with AI in compliance?
Start with a small, repetitive task, such as parsing documents. Christian distinguishes occasional chatbot use from making AI part of an operating process. For audit and advisory work, he argues that experienced reviewers still need to check the output, just as they would check a colleague’s work. A useful first trial has a defined task and someone qualified to judge whether the result is usable.
Why do AI-written policies still need review?
A policy must fit the organization’s actual practices and maturity. Christian sees policy drafting as an overhyped use case when teams accept polished text without checking that fit. He is more interested in AI helping assemble information for risk analysis: threats, the state of controls, and the business’s risk tolerance. Gathering that information can support an assessment; it does not settle the risk decision.
How should you evaluate an AI compliance tool?
First examine how the vendor protects and separates your data. Then give the tool the same documents an experienced assessor would review. Christian suggests comparing observations, recommendations, and time spent. Where do the findings agree? What did the tool miss, and what must a reviewer correct? Include that correction effort in the evaluation instead of measuring only how quickly the first answer appears.
What still needs human judgment?
Christian expects more assessment work to become automated, while governance continues to require human direction and business context. His career advice follows the same logic: understand the systems behind the evidence, from cloud infrastructure to access controls, and learn to translate between technical teams and auditors.
A practical test for your team
Choose one assessment task and a fixed set of evidence. Have an experienced reviewer and the AI tool assess it separately, then compare the findings against the source documents. Record omissions, corrections, and total review time. Decide who will resolve disagreements before using the output in a compliance decision.
Keep exploring
© 2026 Zania Inc.
1950 University Ave Palo Alto, CA 94303