Published 11 June 2026 · Morclear · 7 min read
Adoption is over. That was the easy part.
For three years, every AI-in-compliance survey asked the same question: are you using it yet? That question is now settled. In Compliance Week’s 2026 survey of 193 compliance, ethics, risk and audit leaders, more than 83% report using AI tools, with generative AI leading the stack and executive leadership pushing adoption from the top down — in many cases faster than the compliance function itself can keep up.
The interesting numbers are the ones underneath. The same survey found only about 25% of organisations have implemented a strong AI governance framework. ACA Group’s benchmarking of more than 200 US investment management and financial services firms describes AI use in compliance as “widespread but shallow”: average integration across compliance functions sits below 20%, and in operations closer to 5%. EY’s 2026 Technology Pulse Poll of 500 US technology-industry leaders adds the uncomfortable detail that 52% of department-level AI initiatives are running without formal approval or oversight, while 78% say adoption is outpacing their organisation’s ability to manage it.
Put those together and you get the actual state of AI in compliance in mid-2026. Not a sector that has transformed. A sector that has subscribed.
Sources: Compliance Week / konaAI 2026 AI & Compliance Survey, 193 compliance, ethics, risk and audit leaders · ACA Group 2026 State of AI in Compliance and Operations, over 200 US firms · EY 2026 Technology Pulse Poll, 500 US technology-industry leaders. The three surveys cover different populations and are not directly comparable.
Why shallow adoption is worse than none
A compliance function that uses no AI has a productivity problem. A compliance function where staff paste regulated data into unapproved tools, where AI-drafted policies enter the document register with no named reviewer, and where nobody can list which models touch which decisions has a compliance problem — created, with some irony, inside the team whose job is preventing exactly that.
Ungoverned AI use is not a neutral state. It generates outputs that look authoritative and carry no evidence trail. It creates data protection exposure every time client information enters a tool nobody assessed. And since the EU AI Act began applying in stages, it has become a regulated activity in its own right: deployer obligations, transparency duties and, for the high-risk categories that cover credit scoring, insurance underwriting and employment decisions, a full conformity regime arriving in December 2027.
The question boards should be asking is no longer “are we using AI in compliance?” It is “who is accountable for what our AI produces?”
The regulators have picked their words carefully
In February, ECB Banking Supervision delivered a speech on AI adoption in banking titled “Technology is neutral, governance is not.” That is not a regulator hedging. Under the ECB’s supervisory priorities for 2026–28, AI monitoring continues with a sharpened focus on generative AI applications, following workshops with banks on credit risk and fraud detection use cases. BaFin published guidance in December 2025 on ICT risks in the use of AI at financial entities, treating AI as an ICT risk to be managed inside the DORA framework rather than as a separate ethics question. ESMA published a supervisory briefing on algorithmic trading in February, with a section on the use of AI. Across jurisdictions, 2026 guidance is converging on the same short list: model explainability, bias management, human-in-the-loop oversight, and AI use cases mapped into the existing risk management framework rather than bolted on beside it.
Notice what is absent from that list: any suggestion that firms should use less AI. Supervisors are not anti-AI. They are anti-unowned-output. The supervisory model being built across the EU assumes firms will automate heavily and asks one question of the result — can a named human stand behind it?
The next wave is arriving before the last one was governed
While most firms are still working out who approved last year’s chatbot, the market has moved to agentic AI: systems that plan and execute multi-step work across tools rather than answering single prompts. Thomson Reuters finds 15% of professional services organisations have already adopted some form of agentic tool. Gartner predicts that by 2030 half of organisations will use autonomous AI agents to translate governance policies and technical standards into machine-verifiable data contracts, automating compliance and governance policy enforcement — and, in the same breath, that half of agent deployment failures will stem from insufficient runtime enforcement in the governance platform itself.
For compliance specifically, the agentic promise is real: continuous control monitoring, automated evidence collection, regulatory change tracked as it publishes rather than at the quarterly review. The RegTech market is being priced accordingly, with vendor forecasts for 2026 clustering between roughly $20bn and $29bn and growth projected in the high teens to low twenties as a percentage each year.
But an agent is, in governance terms, a privileged user that never sleeps. It reads records, executes tasks and touches systems. Handing one a compliance workflow without ownership, logging and sign-off does not automate the function. It automates the gap.
What closing the gap actually involves
The Morclear view
The compliance professional with AI beats AI without one. We have said that since the day we opened, and 2026 is the year the data and the regulators caught up with it. The 83% who adopted AI got the easy win. The 25% who governed it got the durable one — because a compliance output is only worth what someone is willing to sign their name to.
CORA™ — Morclear’s Compliance Operations & Risk Automation platform — was built on that principle before it was fashionable. Eight specialist modules covering the EU AI Act, DORA, NIS2, GDPR and ISO 27001. AI does the heavy lifting. A named compliance professional reviews and signs off every output. Delivered as a managed service, with the evidence trail built in — not bolted on.
Which side of the 83/25 gap is your firm on?
The free assessment maps your AI use against the obligations that already apply — in 10 minutes, with a scored report.
10 minutes · scored report · no follow-up unless you want it.
Morclear is an Irish RegTech firm delivering AI-powered, expert-reviewed compliance services to mid-market regulated organisations across the EU. CORA™ is powered by the Anthropic Claude API. All outputs are reviewed by a named compliance professional before delivery.
Sources: Compliance Week / konaAI 2026 AI & Compliance Survey · ACA Group 2026 State of AI in Compliance and Operations, 28 May 2026 · EY 2026 Technology Pulse Poll, 5 March 2026 · Thomson Reuters Institute 2026 AI in Professional Services Report · Gartner Top Predictions for Data and Analytics 2026, 11 March 2026 · ECB Banking Supervision, “Technology is neutral, governance is not: AI adoption in the banking sector”, 24 February 2026, and Supervisory Priorities 2026–28 · BaFin, Guidance on ICT Risks in the Use of Artificial Intelligence at Financial Entities, 18 December 2025 · ESMA, Supervisory Briefing on Algorithmic Trading in the EU, 26 February 2026 · Fortune Business Insights and other vendor RegTech market forecasts. Primary regulatory sources: EU AI Act — Reg. (EU) 2024/1689 · Digital Omnibus on AI — Reg. (EU) 2026/1744 · DORA — Reg. (EU) 2022/2554 · GDPR — Reg. (EU) 2016/679 · NIS2 — Dir. (EU) 2022/2555 · ISO 27001:2022.
morclear.com · morclear.ai · hello@morclear.com