76% of Enterprise Compliance Teams Now Use AI, Half Report Adverse Outcomes from Unverified Output

Governance controls lag deployment in multinational compliance functions

76% of compliance, risk, legal, and sustainability teams at companies with 5,000 or more employees now use AI across their function or autonomously for at least one core task, according to Enhesa's 2026 benchmark of 273 decision-makers at large multinationals. More than half reported a negative outcome from unverified AI output in the past year, including missed regulatory filings and fines.

The finding matters because it quantifies the gap between adoption and control. Compliance teams face accelerating regulatory change — Enhesa tracked more than 22,000 major changes in 2025 and more than 15,000 through August 2026 — and are using AI to manage volume. But deployment has outrun the technical capacity to verify that the output is correct, current, and defensible under audit.

Enhesa's data shows that teams skipping verification were fined nearly three times as often as those with verification workflows in place. That shifts verification from a productivity feature to a risk-control requirement. If your compliance team submits AI-generated filings or relies on AI-generated regulatory analysis, you need a system that logs sources, routes output through human approval, and retains an audit trail.

Procurement requirements are expanding beyond model access

Generic copilots, enterprise search products, and compliance suites that do not include output traceability, approval controls, and audit logs face a procurement disadvantage. Buyers should budget for verification and evidence-management capabilities, not just model access.

The strongest RFPs now require an inventory of deployed AI systems, named owners for each use case, risk classification, continuous monitoring, incident response, and audit-ready logs. Vendors that cannot produce measurable control effectiveness will compete at a disadvantage as buyers shift from AI policy creation to operational evidence.

Healthcare buyers are already applying this standard. Clearwater's 2026 benchmark of 105 healthcare organizations found that 42% ranked sensitive data leakage through AI tools as their top internal concern but could not demonstrate that technical controls worked. Policy documents and AI committees are no longer sufficient evidence for budget approval or audit defense. Healthcare CIOs and CISOs should require proof that controls detect and prevent sensitive-data exposure in actual AI workflows, including vendor-hosted copilots and embedded SaaS features.

Asset managers fund governance intelligence for high-stakes voting

Pennant, an AI-native platform for proxy voting and governance intelligence, raised $5 million in seed financing led by Urban Innovation Fund, with participation from Y Combinator and strategic investors affiliated with Marvell Technology, Legal & General, OpenAI, Kirkland & Ellis, and NVIDIA. The round is small relative to major enterprise-AI financings, but it signals investor interest in specialized governance workflows where explainability, source records, and defensible voting rationales matter.

Asset managers and institutional investors evaluating AI for proxy research should distinguish between summarization tools and systems that preserve an auditable chain from source documents to voting recommendations. Pennant enters a market that includes traditional proxy-advisory and governance-data providers, institutional-investor workflow platforms, and broader AI governance vendors. The financing gives it capital to compete in a narrow but high-accountability use case.

Singapore's agentic AI guidance adds scenario testing to assurance requirements

Singapore's Infocomm Media Development Authority released AI assurance-exchange initiatives on October 14, 2026, focused on testing agentic AI systems. The guidance addresses realistic scenario testing, test execution, log analysis, agent autonomy, tool use, monitoring, and accountability.

The approach complements the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act. It does not replace them. Vendors offering agent observability, authorization, simulation, and audit tooling can position against conventional model-evaluation products that do not test multi-step tool use.

Enterprises deploying agents should add scenario-based testing and action-level logs to RFPs. A conventional model card or predeployment benchmark may not establish that an agent can safely select tools, manipulate parameters, or act within changing workflow context. If your agent can execute API calls, read documents, or modify records, you need evidence that it will not act outside its intended scope under adversarial or edge-case conditions.

What to watch

Compliance and legal teams should audit current AI use for output verification gaps. If your team cannot produce an audit trail linking AI-generated content to source documents and human approvals, you face regulatory and procurement risk. Vendor selection should prioritize systems that log every input, output, and approval step, not just model performance metrics.

Buyers deploying agentic systems should require scenario-based testing before production use. Ask vendors to demonstrate how their product handles tool-selection errors, parameter drift, and actions outside defined workflows. If the vendor cannot show logs of multi-step agent behavior under realistic failure conditions, the system is not ready for deployment in regulated environments.