The Era of 'Bolting On Compliance Later' Is Over ── Build Regulation Into AI Agents From the Start

Hi, I’m Keito Inoshita from Affectosphere Group.

The era of AI agents handling work autonomously is approaching fast.

In regulated industries — pharma, finance, healthcare — there’s growing appetite for exactly this: “Let AI agents handle the compliance work.”

But there’s a serious problem with how this is currently approached.

Today’s LLM-based agents handle regulatory compliance by “reasoning through it.” Ask “Does this procedure comply with FDA regulations?” and the agent generates an answer from its trained knowledge. But that judgment has no consistency guarantee, and it can’t serve as a foundation for legal accountability.

A paper published on arXiv by Alexander Rombach, Chantale Lauer, and Nijat Mehdiyev addresses this problem head-on.

Using a technical approach called neuro-symbolic AI, it presents a research agenda for “compliance by design” — embedding regulatory and compliance constraints at the core of agent architecture rather than layering them on top.

Today I want to translate this research into terms that help compliance officers and business leaders think about “how could we actually use this?“

---

3 Points for Today

1. The problem: LLM agents’ compliance judgments have fundamental consistency and accountability gaps.
2. The approach: Neuro-symbolic AI embeds regulatory rules as structural constraints that agents cannot bypass.
3. Practical implications: Which departments in pharma, finance, and healthcare could try this — and with which processes? Concrete use cases below.

---

① What’s Wrong With “Adding Compliance Later”

Let’s look at the classic failure pattern of AI agent deployment in compliance contexts.

You build a process automation agent. Then you add “compliance checks” as a secondary layer. But in practice, compliance isn’t consistently embedded in the agent’s decision-making — it’s a check that runs under certain conditions. Other paths through the process might bypass it.

With this design, there’s always a residual risk: “the agent takes a non-compliant action, and you discover it after the fact.”

In regulated industries, that’s potentially fatal.

GxP-regulated clinical trial documentation in pharma. Internal controls and AML (anti-money laundering) compliance in finance. Patient data privacy and access controls in healthcare. In every one of these areas, “discover the violation, then fix it” may not be an option.

The paper’s argument is: as long as compliance is treated as post-processing on top of agent reasoning, this structural risk cannot be eliminated.

---

② What Is Neuro-Symbolic AI?

Neuro-symbolic AI is a technical approach that combines the strengths of LLMs (neural) with the strengths of symbolic AI (rule-based reasoning).

LLMs are excellent at understanding and generating natural language. But they’re poor at consistently applying constraints like “you must follow this rule in every case.”

Symbolic AI can represent rules and logic explicitly and reason consistently within them. But it struggles with the flexible handling of natural language.

Neuro-symbolic combines both.

In a compliance context: regulatory rules — “changes to trial data require an electronic signature and audit trail,” “a payment agent cannot execute without approval at the relevant transaction threshold” — are held in the symbolic layer as formal rules. The agent’s behaviour cannot exceed the boundaries those rules define.

The LLM flexibly determines how to process tasks. The symbolic layer verifies whether that action is within the permitted scope. That’s the architecture of compliance by design.

---

③ How to Apply This in Practice ── Three Use Cases

Let’s map this research perspective onto concrete situations.

Pharma: Automated Electronic Log-Entry for Clinical Trials

Clinical trial operations generate enormous volumes of GxP-compliant documentation — protocol deviation records, adverse event reports, change management documents.

Most of this is currently handled manually. When you bring agents in, the biggest risk is “records that don’t meet compliance requirements.”

With a compliance by design approach, rules like “records must follow format X, carry an electronic signature, and appear in audit trail Y” are built into the agent from the start. The agent is architecturally incapable of acting in a way that violates those requirements.

KPIs: reduction in documentation labour-hours alongside reduction in compliance violation incidents — both trackable simultaneously.

Finance: AML Screening and Transaction Approval Flows

AML compliance involves regulated procedures from anomaly detection through internal escalation to suspicious transaction reporting (STR).

When agents automate transaction screening, embedding regulatory constraints directly into the agent’s architecture is more reliable than post-hoc checking. Rules like “if risk score exceeds threshold, human approval is mandatory” or “STR must be filed within X hours” become structural constraints, not logic the agent can reason its way around.

An agent that cannot choose to “let something slide on its own judgment.” That’s the implementation vision for compliance by design.

Healthcare: Patient Data Access Controls

When AI agents in healthcare settings handle patient data, access controls compliant with HIPAA or equivalent domestic regulation are mandatory.

Managing constraints like “this role can only access this data scope” and “secondary use without patient consent is prohibited” explicitly at the symbolic layer reduces the structural risk of an agent accidentally referencing out-of-scope data.

This addresses both audit response costs and data governance violation risk.

---

Answering the Question: “Is Compliance a Brake on AI Investment?”

It’s entirely rational for compliance officers to approach AI adoption cautiously.

But compliance by design suggests a different framing: compliance as part of the engine, not the brake.

If compliance is something the agent verifies after acting, it’s a bottleneck. If it’s something the agent’s action space is bounded by from the start, the speed of AI deployment and regulatory adherence aren’t a trade-off. They become compatible.

This research is still at the agenda stage. But it maps the technical challenges that need to be solved, clearly enough to be actionable.

Compliance and IT teams reading this together — that’s probably the right use of this paper.

That’s all for today!

---

References

1. Alexander Rombach, Chantale Lauer, Nijat Mehdiyev (2026). Neuro-Symbolic Agents for Regulated Process Automation: Challenges and Research Agenda. arXiv preprint.

* This article was written in part with AI assistance and may contain inaccuracies.