Last updated: 22 October 2026. Written by Ritesh Kanjee, director of Augmented AI.
When AI moves faster than policy, regulation written on paper cannot keep up. The answer I gave at a compliance conference is to use AI to govern AI: many small, task-specific agents that monitor inputs, track outputs, enforce rules, log decisions and flag anomalies in real time. That turns compliance from a periodic audit into a continuous process.
I gave this talk at the AI Regulation & Compliance Conference 2025, to a room of lawyers, compliance leads, policy advisors and regulators. Everyone was wrestling with the same quiet problem: AI is moving at bullet-train speed while regulation is still laying the tracks. Below is the problem, the approach I use, and how a non-technical team can start.
Why can't traditional regulation keep up with AI?
Most regulatory frameworks assume a stable system with clear inputs, predictable outputs and time to review decisions after the fact. AI breaks all three assumptions. Models update constantly, the data they see shifts daily, and decisions happen faster than any human team can audit them.
That means an approach built on manual reviews, quarterly reports or static documentation is already behind on the day it is signed off. There is a second, deeper problem: you cannot regulate something you do not understand, and you cannot understand AI if you only observe it from the outside.
What does "using AI to regulate AI" mean?
It means putting the oversight inside the system, in the form of AI agents whose only job is to watch and enforce. My conclusion, which was uncomfortable for some people in the room, is that you cannot regulate AI without using AI. The key design choice is not one large generalist system that tries to do everything, but many small, application-specific agents, each doing one job:
- Monitor inputs: watch what goes into the AI system.
- Track outputs: record what the system produces.
- Enforce rules: check each action against the policy that applies.
- Log decisions: keep an explainable record of what was decided and why.
- Flag anomalies: alert a person when something falls outside the expected pattern.
These agents have no creativity and no opinions. They only execute. That narrow scope is what makes them reliable guardrails for systems that never stop moving.
Why do small agents work better than big policy frameworks?
Small agents work better because they run all the time, while large policy frameworks move slowly by design. A framework asks, "What happened last quarter?" A set of agents lets you ask, "What is happening right now?" The table below shows the difference.
| Question | Traditional policy framework | Small, task-specific agents |
|---|---|---|
| When does oversight happen? | After the fact, in manual reviews and quarterly reports | Continuously, while the system runs |
| What is the record? | Static documentation | Explainable logs of each decision |
| When are problems found? | Often after they become incidents | Before they become incidents, when an anomaly is flagged |
| How does it handle change? | Rewritten slowly as models and data change | Watches the live system in real time as it changes |
How does this work in practice?
In practice, I build these systems on a workflow tool that acts as the orchestration layer. It connects the models, tools, databases and internal systems into workflows that actually run every day, not slides that describe them.
Today I maintain more than 60 automation workflows across different organisations. From that work, the results I see are:
- 20 to 30 hours of manual work removed per week
- Continuous compliance instead of reactive audits
- Clear visibility into how models behave
- Lower operating costs each month
This is not theoretical. These workflows run daily, and the same pattern applies whether the agent is checking a document, a payment or a model's output.
Do you need to be technical to build AI compliance systems?
No, you do not need to be a developer. This question came up more than once at the conference, and my answer is that the real gap is implementation, not tools. When you work with ready-built systems, you learn by running them, and you come to understand AI by operating alongside it. That hands-on understanding is the only way regulation keeps pace.
What should compliance teams do next?
The practical shift is to stop treating regulation as something external to AI systems and start building it inside them. A sensible way to begin:
- Pick one AI-driven process where a wrong decision would matter.
- Write down the rules that process must follow.
- Start with one agent job from the list above, usually logging decisions or flagging anomalies.
- Run it on live work and review what it catches, then add the next agent.
If you want to understand AI, automate alongside it. If you want to regulate AI, build systems that never stop watching it. That is the future of compliance.
To see ready-to-use systems from Level 1 to Level 5 autonomy, explore the Corporate Automation Library. For weekly breakdowns of real automation systems, agents and workflows, subscribe to Augmented AI News.
