Amazon's finance technology team has published details of an AI system they built internally to handle regulatory inquiries, and the story is more interesting for what it reveals about the problem than about the solution.
Regulatory responses are one of the most labour-intensive back-office tasks in any large organisation. A regulator sends a formal inquiry. Someone has to locate all the relevant historical documents, extract the pertinent information, cross-reference it against the company's internal data, draft a coherent response, and do all of this before a deadline. At Amazon's scale, with operations across dozens of jurisdictions, this was happening constantly and consuming significant skilled staff time.
The AI system they built does not replace the humans making final decisions. It helps them find information faster, maintain the thread of a multi-part conversation with regulators over days or weeks, and produce a first draft that staff then refine. Retrieval speed was improved from around 10 seconds per query to under 2 seconds by processing multiple searches simultaneously rather than one at a time. That might sound like a minor technical detail, but across dozens of daily interactions it compounds into meaningful time savings.
The most important design decision, and the one most transferable to other organisations, is grounding. The system only pulls information from documents that the compliance team itself has uploaded and verified. It does not draw on general knowledge or internet sources. This matters because AI systems that are not tied to verified sources are well-documented to fabricate plausible-sounding but false information. In compliance contexts, an AI that invents a regulation or misquotes a precedent does not just waste time. It creates legal exposure. Research on AI systems used in legal and compliance settings found hallucination rates ranging from 17% to over 50% depending on the tool, with even purpose-built legal AI products producing errors in a significant share of queries.
A second design decision worth noting is the audit trail. Every conversation is logged in full, in sequence, and is retrievable. Every source document cited in a response is traceable. This is not just good practice. As regulators in Europe, the US, and elsewhere increasingly expect organisations to demonstrate how AI-assisted decisions were made, having that trail is becoming a baseline requirement rather than a nice feature.
The broader context here is significant. Financial institutions alone spend an estimated $61 billion annually on compliance operations globally, and that number is rising. Compliance costs are projected to increase by 6 to 9 percent each year through the end of the decade. At the same time, tax authorities and regulators are themselves deploying AI to identify anomalies and select targets for inquiry. The IRS in the US now uses machine learning models to flag high-risk returns, including a new model specifically targeting large partnerships that previously went largely unaudited. In other words, the volume of incoming regulatory inquiries is likely to increase for most large organisations precisely because the regulators are getting better at generating them.
This creates an asymmetric pressure. Regulators are using AI to ask more questions, faster. Organisations that continue to respond manually will face a growing gap between inquiry volume and response capacity. The organisations that build or adopt AI-assisted response systems close that gap. They also produce more consistent, traceable responses, which reduces the risk of the kind of inconsistency that triggers further scrutiny.
For non-financial companies, the lesson is not that they need to replicate Amazon's exact technical architecture. The lesson is that document-grounded AI, combined with a proper audit trail and human review before anything goes out, is now a viable operational model for compliance work. Several commercial tools already offer versions of this. The question is whether leadership treats this as a genuine operational priority or continues to treat compliance as a cost centre to be minimised rather than a function to be systematically strengthened.