How many hours will a compliance job that currently requires 40 hours take in five years?
If the answer is 20, 10, or even 5, the challenge facing many consulting firms won’t be artificial intelligence. It will be their business model.
We’ve been debating for some time whether AI will replace lawyers, consultants, and compliance professionals. That’s the wrong question. The relevant question is what part of the work will continue to have value and how much the client will be willing to pay for it. Knowledge is no longer a scarce resource
For decades, much of the value of legal and compliance consulting has lain in knowledge: knowing the regulations and how to interpret them, having methodologies and models at one’s disposal, identifying obligations, designing controls, or drafting a policy. That knowledge was expensive to acquire and, above all, scarce. That’s why it paid well.
AI is changing that equation. Today, a professional can analyze a regulation, compare requirements, prepare the first draft of a policy, structure a risk matrix, or review documentation in a fraction of the time it took just a few years ago.
Knowledge remains important. What is becoming commoditized is access to it. And a business that sells hours of knowledge is going to feel the impact. Customers no longer want documents
There is a second change—one that is less visible but more profound. Companies don’t want to keep paying indefinitely for someone to tell them what to do. They need help actually doing it.
It’s not enough to just hand over an Excel spreadsheet with 150 controls. You need to know who is responsible for each one, when it should be performed, what evidence shows that it has been completed, what open issues there are, and what the actual residual risk is.
It’s not enough to simply draft a policy. You have to track its versions, distribute it, collect acknowledgments of receipt, review its validity, and be able to demonstrate who was aware of it and since when.
It’s not enough to simply identify a risk. You have to manage it.
For years, we have built compliance around documents: policies, procedures, matrices, reports, emails, and shared folders. The next step is to turn all of that into structured, traceable processes, with people, controls, and evidence all interconnected. AI accelerates this transition because it also automates much of the intellectual work involved in those processes.
I’m writing this from a software perspective, so it’s best to read it with that in mind. But the combination that works isn’t software instead of a consultant. It’s AI + methodology + software + professional judgment. AI analyzes. Software executes, automates, and provides a record. And the professional contributes what’s hardest to automate: context, experience, judgment, and accountability.
The Threat We Need to Face Head-On
It would be naive to deny it. If a company can interpret a regulation with the help of AI and manage its controls using a tool, it will handle some of the work it currently outsources in-house. Some consulting firms will lose business as a result—not because of a lack of quality, but because part of what they used to sell is no longer in short supply.
But there are some things the client cannot resolve on their own. AI can make mistakes when interpreting regulations and present incorrect answers with apparent confidence. Someone has to review its output, adapt it to the organization’s specific circumstances, and assume professional responsibility for the advice provided to a regulator, a judge, or a board of directors.
That paper doesn’t disappear. It becomes more valuable.
What does this mean in practice?
Viewed this way, AI can be a tremendous opportunity for consulting firms, provided they change the way they deliver their services—and not just the speed at which they work.
A consulting firm that currently needs ten people to serve a certain number of clients can serve many more with the same team. It can automate repetitive tasks, reuse knowledge, and standardize its methodology.
But here’s the paradox. If you continue to charge by the hour, doing the same work in half the time means billing half as much. Efficiency only translates into profitability if the business model evolves as well:
From one-time projects to ongoing services. The consulting firm operates the client’s compliance system on an ongoing basis, rather than providing an annual snapshot. From hours to scope. Fees are based on the scope of work managed, the service provided, and the results achieved—not on the time spent. From periodic reviews to continuous monitoring. Evidence is kept up to date throughout the year, not just when an audit is approaching. From producing to validating. Technology handles an increasing portion of the work, while the consultant reviews, interprets, and applies professional judgment. This frees up time for what the client truly needs from a professional: understanding their organization, interpreting complex situations, and helping them make decisions.
The video rental store—an example from the past that helps us see the future…
Blockbuster served as an example of disruption and resistance to accepting a new reality. While the video rental chain charged for each rental and for late returns, Netflix pioneered a monthly subscription model: a recurring customer relationship, first with DVDs by mail and later with streaming. Blockbuster eventually reacted, but failed to adapt its business in time and filed for bankruptcy in 2010. In consulting, the parallel is clear: moving from billing for each hour of work to charging for a continuous compliance service. It’s not enough to simply incorporate technology; you have to reevaluate what you’re selling and how you’re billing for it. The danger lies in clinging to the model that made the business profitable while the customer discovers a more convenient and useful way to meet their needs.
What can a consulting firm do starting tomorrow?
None of this requires transforming a consulting firm overnight. It requires getting started.
Audit your own work. Review your last ten projects and separate the hours spent on writing, research, compilation, and formatting from those spent on analysis and judgment. The former are the ones that will be cut back the most. It’s wise to know how much they account for in your billing before the client finds out.
Use AI on a daily basis, but follow the rules. Have the team incorporate it into their actual work, with clear protocols for verification, security, and confidentiality: what information can be processed, with what tools, and under what conditions. A consulting firm that doesn’t use AI won’t be able to advise its clients on it.
Turn knowledge into assets. Package the methodology into libraries of reusable controls, templates, procedures, and criteria. What currently exists only in the minds of three partners should be able to be consistently applied to fifty clients.
Serve clients from a single platform. There’s no need to develop your own software. You can choose a tool and make it part of the service, so that the consulting firm’s work is stored in a single, dynamic system rather than scattered across documents, Excel spreadsheets, and folders.
Launch a recurring service. Offer two or three clients a fixed fee to manage specific aspects of their compliance on an ongoing basis. This is a way to learn how to set prices without relying on hourly rates before transforming the entire business model.
Specialize. This approach is particularly valuable where regulations are new, complex, or sector-specific: NIS2, DORA, the AI Regulation, criminal compliance, or internal information systems. General knowledge will become increasingly accessible; specialized knowledge applied to a specific context is much harder to replace.
Rethink how junior professionals learn.
For years, they have honed their skills by producing documents, conducting research, and performing tasks that AI now speeds up significantly. If that part of the job disappears, we’ll have to develop our expertise in other ways: reviewing, verifying, getting involved in projects earlier on, and working alongside experienced professionals. If the industry doesn’t address this, in ten years it will lack the senior professionals it currently takes for granted.
The Real Risk
Technology changes very quickly. Business models change much more slowly. That’s where the danger lies.
To continue believing that a larger staff necessarily means a better consulting firm. To continue measuring business in billable hours. To continue delivering documents when the client needs processes. To continue selling knowledge as if access to knowledge were still scarce.
AI won’t make legal consulting or compliance disappear, but it will profoundly change which parts of the work are valuable. Consulting firms that understand this can become much more efficient, scalable, and profitable organizations.
Those who try to protect the old model may discover that the greatest risk posed by artificial intelligence was never artificial intelligence itself. It was failing to realize in time that reality had changed.
If you run a compliance consulting firm and are thinking about how to take this step, let’s talk.
*Article enhanced with AI support.
