AI and country risk research: where it helps, where it falls short, and what regulators expect

Regulators across multiple jurisdictions are asking whether AI outputs are explainable, auditable, and governed. For compliance teams using AI to research jurisdictions, assess regulatory frameworks, or inform country risk ratings, regulators are already asking to see the governance behind those outputs.

The hallucination problem: what the evidence shows

Legal research and compliance research share the same vulnerability: both involve using AI to retrieve and interpret regulatory information where accuracy is not optional. In 2025, researchers at Stanford's RegLab published a peer-reviewed study in the Journal of Empirical Legal Studies testing AI legal research tools from LexisNexis and Thomson Reuters. Across 202 legal queries reviewed by legal experts, both tools hallucinated between 17% and 33% of the time, despite both companies having marketed them as 'hallucination-free '.

In April 2026, Sullivan & Cromwell apologised to a US Bankruptcy Court judge after an AI-generated legal motion contained inaccurate citations. Damien Charlotin, a Paris-based lawyer and researcher who teaches at HEC Paris and maintains the most comprehensive public database of AI hallucination incidents in legal proceedings, had logged over 1,500 such cases globally by June 2026, with new incidents added daily.

The specific risk in a compliance context is that the outputs look authoritative. An AI-generated jurisdiction assessment reads like a jurisdiction assessment. It uses the right terminology, cites sources and reaches a plausible conclusion. The errors sit in the substance. If a country AML risk rating rests on incorrect information, the liability belongs to the institution that relied on it.

Source bias is a known limitation in AI-assisted research. Models trained on publicly available data generate more signal from jurisdictions with high media coverage, active enforcement, and English-language reporting. For country risk assessment, where quieter jurisdictions are often the higher-risk ones, that bias requires active correction through deliberate source selection and weighting; decisions that require expertise built over years rather than a prompt.

What regulators are asking

In June 2025, the UK FCA and ICO published a joint statement on AI in financial services, with the ICO developing a statutory code of practice for organisations deploying AI and automated decision-making systems. Singapore MAS's AI Risk Management Guidelines require financial institutions to determine the extent of transparency and explainability required for each AI use case according to its assessed risk materiality, with controls documented accordingly. The EU AI Act, as amended by the European Parliament in June 2026, sets fixed compliance deadlines for high-risk AI systems: December 2027 for Annex III systems and August 2028 for Annex I systems.

EU AMLA's draft guidelines on ongoing monitoring, currently in consultation, state explicitly that entities using AI or advanced analytical tools should prepare for enhanced governance and explainability requirements. AMLA's separate draft guidelines on business-wide risk assessment, with final publication expected in Q4 2026, set out minimum requirements for how obliged entities must document, govern, and evidence their risk assessment methodology. Both signal the same direction: AI-assisted compliance outputs need to be explainable, documented, and evidenced to the same standard as any other risk decision.

FATF's 5th round of mutual evaluations, running 2024 to 2027, places heavy weight on outcomes and effectiveness. Countries are assessed on whether their supervisory frameworks produce genuine results, including whether their financial institutions are identifying, assessing, and managing financial crime risk in practice. An AI-assisted country risk programme that cannot demonstrate documented reasoning, verified sources, and human sign-off does not meet that standard. The FCA issued over £124 million in fines in 2025, the majority tied directly to AML systems and controls failures. The cases share a common thread: weaknesses in risk assessment, inadequate ongoing monitoring, and governance frameworks that failed to keep pace with the firms' actual risk exposure. As AI becomes part of those frameworks, the same standards apply, and the same questions will be asked.

Building a methodology is a significant internal commitment

When a regulator asks how a jurisdiction rating was reached, the answer needs to hold up. That means a documented methodology, verifiable sources, analyst sign-off on every data point, and a version history showing what changed and when. Building that in-house is a significant internal project with cost and resource implications that most teams underestimate. The Bank of England and FCA's 2024 survey of AI in financial services found 46% of firms reported only a partial understanding of the AI technologies they use. For a country AML risk programme, that means being able to explain to a regulator not just what rating a jurisdiction received, but how it was reached, what sources informed it, and who reviewed and approved the output.

Maintaining that programme across every jurisdiction, processing the volume of regulatory and political change it generates, is a continuous operational commitment. FATF decisions, sanctions changes, political shifts, and regulatory developments across every jurisdiction you cover generate a significant volume of data point changes every year. Every outdated data point and unverified source is the liability of the team that built it.

What responsible AI use in compliance looks like

AI has genuine value in compliance workflows where it is used with appropriate controls and human oversight. Pattern recognition in transaction monitoring, processing large volumes of structured data, and initial screening are areas where AI adds speed and accuracy. The right question for compliance teams is where AI output requires human verification before it carries compliance weight.

Compliance teams are purchasing defensible decisions. AI makes information cheaper and faster to produce. What it cannot replace is the methodology, verification, and human oversight that regulators are already scrutinising.

At KnowYourCountry, parts of our process are AI-assisted. Nothing goes out unreviewed. Every AI-assisted element is reviewed, adjusted, and approved by subject-matter experts before publication. Every data point cites a verifiable source, every change has analyst sign-off, and updates are tracked and documented. The methodology is entirely human-overseen and has recently been enhanced with expanded sanctions coverage, a standalone proliferation financing category and criminality risk split into eight weighted sub-factors. It is a methodology that regulated businesses and government agencies have trusted for over 20 years.