Auditable AI control infrastructure, continuous assurance as evidence production, and jurisdiction-driven cloud buying shifts

Compliance Software Shifts Into Auditable AI Control Infrastructure

On 2 November 2026, Abu Dhabi’s Department of Government Enablement and OpenAI launched Machine-Readable Government, a pilot that converts selected Abu Dhabi policies and regulations into machine-readable rules for AI-assisted compliance checks, with the first production use case at ADAFSA for food-import oversight. In the same week, Trading 212 said it is deploying AI agents with Cardamon to map obligations across products, licences, jurisdictions, and operations, monitor regulatory change, assess business impact, and route tasks into Slack and Jira. Salmon Bank also said it is automating BSP reporting with Profinch.

At the regulatory edge, Kenya’s CBK Regulation 60 and Singapore’s MAS AI Risk Management Guidelines tightened expectations for AI lending through explainability, human oversight, validation, inventories, risk assessment, and ongoing monitoring. Together, these moves mark a shift from compliance tools that help humans interpret rules to AI-native control layers built on codified regulation, embedded orchestration, and traceable execution.

For operators, the buying criteria are moving toward platforms that can operationalize local rules at scale without losing auditability. For vendors and investors, the value pool is concentrating in infrastructure that can prove jurisdictional precision, action-level traceability, and deep workflow integration under supervisory scrutiny.

Continuous Assurance Shifts from Detection to Defensible Control Execution

Sep. 15-29, 2026 brought a cluster of launches showing internal audit moving from exception detection to evidence-producing control workflows. Workiva said its AI agent can generate evidence files, sample selections, attribute-test results, and full traceability across IT general controls, application controls, access, change management, and IT operations. Diligent, DataSnipper, UiPath, and BDO USA followed with agents that collect evidence, execute multi-step testing, log each step, and produce auditable working papers and findings.

The strategic shift is not just automation; it is defensible execution. Buyers now want runtime evidence that controls actually operated, plus audit trails for automated decisions, tool calls, human oversight, model inventories, validation, drift monitoring, and version control. That pushes value toward platforms that can fuse workflow automation with audit-ready proof, not just surface risk. Vendors that cannot produce traceable evidence will struggle to move from pilot to system of record, while those that can will own the control layer.

Continuous Identity Assurance Splits Into Detection and Proof Layers

Veriff and World showed on November 5 and November 8, 2026 that identity security is moving from one-time onboarding checks to continuous assurance. Veriff launched Presence Verification, claiming it analyzes more than 1,000 risk signals from a short selfie video plus device and network data to detect AI fraud and deepfakes in real time. Its stack includes passive liveness, deepfake analysis, and an optional coercion-detection tier that reviews full-session audio and video for coaching or forced compliance in 98 languages.

Three days later, World introduced a biometric identity bundle at Money20, combining World ID for Zoom, World Agents, and the Proofs wallet. Its approach is different: prior iris-based Orb verification plus a live selfie generates a “Human Badge” and cryptographic proof of verified presence for its 18M+ Proof of Human holders. The market is splitting into two value pools: real-time behavioral fraud detection for high-risk sessions, and portable proof-of-human identity for platforms that need reusable trust signals across products and workflows.

Jurisdictional Control Becomes the New Cloud Buying Criterion

Nigeria’s Central Bank has ordered payment transaction data generated in Nigeria to be stored and managed inside the country by 1 January 2027, extending the rule across the full data lifecycle: creation, processing, storage, backups, operational control, and disposal. The directive applies to licensed payment participants, including banks, payment service providers, mobile-money operators, and switching and payment-processing companies, and it makes offshore architectures for Nigerian payment flows materially harder to justify.

Europe is moving in the same direction, but with a tighter definition of sovereignty than simple residency. Microsoft’s EU Sovereign Public Cloud pairs EU data-boundary deployments with restricted, auditable access by European-resident staff; SAP frames sovereignty across data, operational, technical, and legal dimensions and offers EU Access options; AWS’s European Sovereign Cloud goes furthest on separation-by-design, with EU-located infrastructure, EU-resident operators, and Nitro-enforced boundaries that block AWS personnel from accessing EC2 customer workloads. The market signal is clear: regulated buyers are now purchasing jurisdictional control, not just local hosting, shifting value toward architectures that can prove operational separation, access restriction, and legal enforceability.