Can an AI agent do a compliance risk assessment?

It depends which part you mean. An AI agent can assemble a compliance risk assessment: the obligations, the incidents, the monitoring results and a first scoring against your method. Setting the ratings, judging whether controls work and accepting the residual risk stay with a compliance officer, because those calls set the firm's monitoring and its risk appetite.

Why is a risk assessment more than a scoring exercise?

A compliance risk assessment decides where the second line spends its year. A risk rated high gets tested often; a risk rated low may not be looked at for two years. Getting a rating wrong does not cause harm on the day. It causes harm later, when the area nobody tested turns out to be the one that failed.

Most of the effort is collection. The assessor needs the obligations that apply to each business line, what went wrong in the period, what monitoring found, what audit said, what complaints show and what is changing. That material lives in six or seven places and is rarely current. An agent can gather it and lay it out against your methodology. The AI agent risk assessment template is a useful model of the fields a reviewer expects to see.

What may the agent prepare, and what is the officer's call?

The agent may:

• Pull every obligation mapped to each business line from the obligations register, and flag lines with none mapped.
• Collect breaches, incidents, complaints themes, monitoring findings and audit points for the period, each linked to its source.
• Score inherent risk against your scale, showing which inputs drove each score.
• Note where evidence of control operation is missing or out of date.
• Compare the draft with last period's ratings and list every movement with a reason.
• Draft the narrative for each risk area.

The compliance officer decides:

• The final inherent and residual ratings, including any override of the agent's score.
• Whether a control is effective, partly effective or not effective.
• Which residual risks sit outside appetite and what happens about them.
• The monitoring plan that follows from the ratings.
• Sign-off and presentation to the risk committee.

Control effectiveness is the call that most needs a person. An agent can see that a control was tested and passed. It cannot see that the person operating it left in the spring and the replacement has not been trained. People close to the business carry that context.

What does a draft look like on a real assessment?

Take a payments firm with three business lines: card acquiring, cross-border transfers and a small prepaid card programme. The agent assembles the year's evidence for each.

For cross-border transfers it finds two sanctions screening incidents, a monitoring finding on stale customer risk ratings, and a regulatory change on payee name checks that has no owner. It scores inherent risk high and proposes residual risk medium, citing the screening tool's test results. It also notes that the prepaid programme has had no monitoring for eighteen months, so its low rating rests on old evidence.

The head of compliance raises cross-border residual risk to high. Her reason is that two incidents in one year suggest the screening control is weaker than its test results say. She keeps prepaid at low but schedules a review in the first quarter. Both changes and reasons are recorded against the agent's draft. The same evidence base feeds the business-wide AML risk assessment, so the two do not drift apart.

What controls make the agent's draft safe to rely on?

• Method fixed in advance. The agent scores against your written methodology. It does not invent weights.
• Every input is cited. A score with no linked evidence is shown as unsupported.
• Overrides are recorded with reasons. The record shows the agent's score, the officer's score and why they differ. Over time, that pattern shows where the method needs changing.
• Gaps are reported as gaps. No evidence is not the same as low risk, and the draft says so.
• New products enter the assessment. When a new product is reviewed for compliance risk, its risks feed the next cycle.

Assessing the agents themselves is a separate exercise. If you follow ISO/IEC 42001, the AI risk assessment for AI agents covers that. The step-by-step version of this process is in how to run compliance risk assessments with an AI agent, and the general principle is in our guide to AI compliance agents.