Can an AI agent keep a compliance breach log?

Yes, and it will usually keep a more complete one than people do. An AI agent can spot possible breaches in incidents, complaints, monitoring results and audit findings, draft each entry with the rule, facts and impact, and track remediation. Deciding that something is a breach, how serious it is and whether to report it stays with the compliance officer.

Why do breach logs miss things?

A breach log is only as good as what reaches it. In most firms, entries depend on someone recognising that an incident broke a rule and taking the time to record it. Operational teams see a failed process, not a regulatory breach. Complaint handlers see an unhappy customer, not a disclosure failure. So the log tends to hold the breaches that were obvious or escalated, and miss the small ones that, together, point to a weak control.

An agent can read every incident, complaint and monitoring result and ask, for each, whether it touches an obligation. That widens the funnel. It also creates a risk: a log flooded with weak candidates is as useless as a sparse one. So the agent drafts and a person decides what goes in.

What evidence does the agent assemble?

For each candidate breach the agent drafts an entry:

• The obligation: the rule, policy or licence condition that may have been breached, quoted and cited.
• The facts: what happened, when it was found, and the source records.
• Impact: customers affected, amounts, duration, and whether harm is continuing.
• Cause: the control that failed, if the evidence shows one.
• Linked items: related incidents, complaints, earlier breaches of the same rule, and audit findings.
• Proposed classification: severity under your scale, and whether it may be reportable.

It keeps two kinds of breach apart. Regulatory breaches follow your regulator's rules and your policy. Personal data breaches follow data protection law, which has its own assessment and notification rules; the personal data breach assessment template covers those. One incident can be both, and the agent links the entries.

What does a person decide?

What does the log look like in practice?

Take a consumer credit firm. In one month the agent reviews 300 incidents, 450 complaints and the monitoring team's findings. It drafts nine candidate entries.

Four are clear: a batch of arrears letters sent without the required information sheet, two cases of a fee applied outside the contract terms, and a late regulatory return. Three are borderline: complaint responses sent a day after the internal target but within the regulatory deadline. Two are linked: separate incidents in which customers' payment arrangement requests were not recorded, which together suggest a training gap in one team.

The compliance officer accepts the four clear entries and grades the arrears letters as significant because several hundred customers were affected. She rejects the three borderline ones as internal service misses, not breaches, and records why. She accepts the two linked incidents as one breach and opens a remediation action. The agent updates the log and starts tracking the actions. The method is set out in how to log and assess regulatory breaches with an AI agent.

Which controls keep the log trustworthy?

• Rejected candidates are kept. Every candidate the officer rejects stays on file with the reason, so a reviewer can see the judgement was made.
• Entries cite rules exactly. No breach is logged against a paraphrase of a rule.
• Append-only history. Changes to severity or status are added, not overwritten.
• Repeat breaches flagged. The agent highlights a second breach of the same rule in a period.
• Separate from the change log. Regulatory changes are tracked elsewhere, as in the regulatory change log template.

The general principle is in our guide to AI compliance agents.

Where Pryme fits

In Pryme, drafting a breach entry is a draft-depth capability: the agent writes it, a person decides. Agents' own verdicts also feed the log. An action that was refused or held is a control working; an action that should have been stopped and was not is a candidate breach the agent drafts against itself.