The morning the SEC sued Coinbase, one of the company's own lawyers was walking into a hearing room in Washington to testify. The legal department could see the news breaking and could do nothing about it. That's the one job AI for legal compliance won't touch yet: the phone call, the hearing, the judgment under pressure.
Molly Abraham, VP of Legal at Coinbase, told the story on CZ and Friends, GC AI's podcast where CEO Cecilia Ziniti interviews legal leaders:
"We knew obviously that the SEC had given us a Wells notice. We didn't know when or if they were going to sue us. And I will never forget that morning... he was testifying... in DC. He's on his way into the room and he gets the phone call that we are being sued by the SEC and then he's testifying and we're not able to talk to him."
Everything that led up to that morning, the monitoring, the position papers, the multi-jurisdiction research, the risk assessments, is work a small in-house team carries every week. Abraham calls it "embracing the gray," and the gray keeps growing faster than legal headcount.
That gray now spans AI regulation, state privacy amendments, trade policy, and the vendor diligence underneath all of it.
The teams below closed that gap with legal AI.
GC AI is the enterprise legal AI platform a three-time general counsel (Anki, Bloomtech, and Replit) built for in-house teams. Six GC AI features carry the compliance workload in this piece:
Research answers multi-jurisdiction questions from primary law with citations
Automations watch regulatory sources on a schedule
Playbooks check contracts against the positions your compliance program requires
Exact Quote keeps every citation verifiable against source text
Contract Intelligence answers portfolio-wide questions across every vendor contract
Skill Library turns a regulatory change into a structured summary the team can act on.
AI for Legal Compliance vs. AI Compliance
AI for legal compliance means an in-house team using AI platforms to do compliance work: tracking regulatory change, checking contracts and policies against current rules, running risk assessments, and answering multi-jurisdiction questions with citations.
AI compliance is different. It is the work of complying with AI regulations like the EU AI Act. Most legal teams end up owning both, and a platform built for compliance work should hold up under AI-regulation scrutiny too.
A GC asking about AI for legal compliance wants specifics: what to hand the platform, what stays with the lawyers, and what the switch is worth in hours and outside counsel spend.
The Compliance Work In-House Teams Hand to AI First
Across the compliance conversations we've had with senior legal ops leaders and general counsels, and 2,000+ legal teams and law departments (as of August 2026), including the legal teams at Snyk, Arc'teryx, and Liquid Death, six compliance tasks come up again and again:
Regulatory change tracking: standing watches on the sources that move your obligations, covered in full in our AI for compliance monitoring guide.
Multi-jurisdiction research: cited answers on unfamiliar law in hours, work that used to be an outside counsel engagement.
Contract and policy alignment: Playbooks that flag the clauses sitting off your program's required positions.
Risk assessments: building the question set, running it internally, and documenting the answers.
Vendor and third-party diligence: reading the security terms, the DPAs, and the subprocessor lists at portfolio scale, the task Contract Intelligence is built to answer across every vendor contract at once.
Policy drafting and training: turning a regulatory change into an updated policy and a training the business will read.
Joys Choi, Senior Director of Legal at Tipalti, handles the multi-jurisdiction version daily for a financial services business:
"Instead of spending hours translating Colombian labor law, I ask GC AI questions and it provides me with links and summaries in English."
GC AI, she says, "keeps us ahead of regulatory change."
What a Compliance Program Saves With AI
Sharon Johnson, SVP and Chief Legal Officer at MODE Global and a certified compliance and ethics professional, put a number on it. A large vendor quoted her team for standard compliance work, risk assessments included:
"The price tag that they wanted to give us was huge. And I remember thinking, you know, I'm a certified compliance and ethics professional... let me go and figure out how to do a risk assessment."
She used AI to build the question set, ran the full risk assessment internally, and "saved hundreds of thousands of dollars on that." Her team now uses AI to monitor "federal register notices or executive orders or trade policy signals," so the advice reaches the business before an obligation lands.
All of that depends on accuracy. On GC AI's In-House Legal Bench (May 2026), a benchmark GC AI built and ran across 100 in-house legal tasks with 1,200+ attorney-developed criteria, regulatory tracking was GC AI's single widest margin over general-purpose AI, at 15.1 points:
GC AI: 86.8%
ChatGPT (GPT-5.5): 79.8%
Claude (Opus 4.7): 68.4%
Gemini (3.1 Pro): 57.5%
A compliance answer that misses a jurisdiction or invents a citation costs more than the hours it saved. That margin keeps the lawyer's review fast: the lawyer confirms answers and moves on.
Where the Lawyer Stays in the Loop
Rebecca Fike, a Reed Smith partner and former SEC Enforcement senior counsel, on overstating what your AI does:
"AI washing is the phrase right now, taken from the green washing. That is just disclosure fraud."
The compliance version of that warning applies inward: document what your team's AI checks and what it skips, including where outputs could skew by jurisdiction or department, because a regulator may ask.
Rachel Harris, GC and AI Governance and Privacy Officer at Suzy, on chasing certifications without a commercial reason:
"These are well-intentioned people doing their best, but if you don't map the commercial impact, it becomes theater. I'd always ask: why do we want this certification? Has a customer contractually required it? If not, we're just jumping through hoops for the sake of jumping through hoops."
Both land in the same place.
AI extends what the compliance program can reach, and the judgment call still belongs to a lawyer. Every output that reaches a regulator, a customer, or the board gets a review, and the State Bar of California's practical guidance on generative AI treats that review as a core competence duty. ABA Formal Opinion 512 gives the same duties a checklist shape: competence (Rule 1.1), confidentiality (Rule 1.6), and supervision (Rules 5.1 and 5.3).
How to Pilot AI for Compliance Without New Risk
A compliance-grade pilot fits in 30 days:
Pick one live obligation: a regulation your team already tracks by hand, with a real deadline attached (a state privacy amendment, or the EU AI Act transparency rules).
Set the baseline: hours currently spent per month tracking it, and the last time an update surprised you.
Run the AI in parallel: a standing Automation on the same sources, outputs reviewed by the same lawyer.
Score the deltas: what the AI caught first, what it missed, and what the lawyer's review time dropped to.
Write the file note: what the team verified and how, so the pilot itself would survive an audit.
Vet the platform the way you would any vendor holding regulated data. GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, and AES-256 encrypted, and every AI provider in its stack processes customer content on a zero data retention basis, documented on the live subprocessor list.
For the AI itself, the NIST AI Risk Management Framework gives a vendor-neutral structure for the questions your security team will ask.
How In-House Teams Run Compliance Work With GC AI
Danielle Sheer, Chief Legal and Trust Officer at Commvault, described the category:
"What would be really helpful is if there was an entire universe that was like ChatGPT, but built for and made for the legal world and the compliance world. GC AI."
The compliance workflows in this guide map to features that already exist:
Automations hold the standing regulatory watches Sharon Johnson's team runs.
Research answers the Colombian-labor-law questions with linked primary sources, the way it does for Joys Choi.
Playbooks turn your program's required positions into checks that run on every contract.
Exact Quote keeps citations verifiable before they go in the file.
Contract Intelligence answers portfolio-wide questions across every vendor contract for diligence.
The Skill Library's regulatory-summary skill turns a rule change into a structured summary the team can act on.
Teams that want the training first can start with GC AI's legal AI classes, taught by former general counsels and California CLE-eligible. The compliance use cases show up from the 101 class onward.
Frequently Asked Questions
What Is AI Legal Compliance?
AI legal compliance carries two meanings. The first is complying with regulations that govern AI systems, like the EU AI Act: inventorying AI tools, classifying risk, and documenting oversight. The second is AI for legal compliance, using AI platforms to do compliance work such as tracking regulatory change and running risk assessments, and it is where in-house teams save measurable hours today.
Can AI Run a Compliance Risk Assessment?
Yes, with a lawyer directing it: AI builds the question set, gathers and organizes responses, and drafts the findings; the lawyer still scopes the assessment and signs off on the judgment. MODE Global's legal team ran a full risk assessment internally this way and saved hundreds of thousands of dollars against a vendor's quote. Document what the AI did and what the team verified, so the assessment holds up under review.
Is AI for Legal Compliance Secure Enough for Regulated Industries?
Yes, when the platform carries enterprise controls: GC AI is SOC 2 Type II and SOC 3 certified, GDPR compliant, and AES-256 encrypted, with customer data in a segregated database and organization-level control over which AI model providers are enabled. Legal teams in financial services and healthcare run GC AI under those controls today. Review the published subprocessor list the way you would for any vendor processing regulated data.
Are Companies Responsible for AI Tools They Buy from Vendors?
Yes. Responsibility for compliance stays with the organization deploying the AI, whoever built it, so vendor claims need verification and the tool needs to run inside your governance framework. The practical checks: the vendor's security certifications, its subprocessor list, and organization-level controls over how the tool is configured. GC AI publishes all three, down to a live subprocessor list.
What Is Shadow AI and Why Does It Matter for Compliance?
Shadow AI is AI in use inside a company without formal oversight, and it matters because unauthorized tools carry data and privilege risk no one is managing. The fix is governance: inventory the tools in use, assess each by risk, and move the work onto a platform the organization controls. GC AI supports that control layer with organization-level settings for which AI model providers are enabled, plus audit logging of every change.
