An essay by James da Costa made the rounds recently: Everything, Everywhere is Compliance. The argument, roughly: compliance is one of the fastest-growing job categories in America, more than 400,000 compliance officers and over $40 billion a year in labor, regulation keeps compounding, and AI is finally reliable enough to automate real compliance work. He lays out three waves of startups: converting regulation into executable code, replacing legacy systems of record with AI-native ones, and putting agent fleets on top of the backlog.
I replied to the thread when it came out, because we are building in one corner of that ecosystem. This is the longer version of that reply.
Key takeaways
- The essay’s macro is right: compliance labor grew for decades, and throwing more people at it stopped working.
- Every layer of the proposed AI stack reads or produces policies. The essay treats that record layer as a given. At most companies it does not exist.
- Drafting is about to become nearly free. Approval and acknowledgment are acts of responsibility, and those do not delegate to an agent.
- Faster drafting means more versions, which makes version-bound records more load-bearing, not less.
The part I keep nodding at
The growth story checks out. Compliance headcount has climbed for twenty years while the rulebooks got thicker, and the response of most large organizations was to hire more reviewers.
The essay’s sharpest evidence is what happened anyway: TD Bank pleaded guilty in 2024 and paid over $3 billion across the DOJ and FinCEN, the largest Bank Secrecy Act resolution in history, with a backlog of unreviewed alerts in the tens of thousands. Hundreds of compliance staff, and the work still did not get done. People alone were never going to scale with the rulebooks.
So when the essay says the next wave will “turn regulation into code,” I believe it, at least for the industries it describes: banks, lenders, payments companies, mortgage servicers. That world is real and the companies he names are doing real work in it.
What this looks like from a 120-person company
The enterprise frame skips something. None of those 400,000 compliance officers work at a 40-person clinic or a 120-person machine shop. At that size, compliance is the HR director’s fourth job, or the quality manager’s second one. There is no alert queue to clear and no compliance department to augment.
What the AI wave actually delivers at that size, first, is cheap drafting. A decent policy draft now takes minutes. Templates, first passes, plain-language rewrites: all nearly free, and genuinely useful.
Which sounds like the problem is solved, until an auditor shows up.
Every layer of that pyramid stands on a policy
Walk back through the essay’s three layers and notice what each one quietly assumes.
Regulation turned into code enforces rules. Somewhere, a written policy has to say what your company’s version of the rule is, because the regulation sets the floor and your policy sets your practice. AI-native systems of record hold filings, reports, and transactions. The rules your own people are supposed to follow live somewhere else. And agents that do compliance work interpret policy to do it. The moment an agent interprets a policy, the first two questions are which version it read and who approved that version.
The essay does not ask those questions, and at enterprise scale it does not need to: a bank has a policy office, a document control function, and attestations wired into onboarding. The pyramid stands on a floor the essay never mentions because in that world the floor is already poured.
At a 120-person company, there is no floor. Policies live in Drive, versions multiply, approval happens in a hallway, and nobody can prove who saw what. Pour the AI on top of that and you get faster chaos.
The questions an auditor asks
I’ve sat through more than ten ISO 9001 audits, plus SOC 2, ISO 27001, and HIPAA reviews. Not once did anyone ask how sophisticated my tooling was. The questions never change: who approved this policy, when did it take effect, and show me who acknowledged this version.
That is the accountability chain, and every link in it is a human act. A named person approves the policy and puts their judgment on record. A version takes effect at a known time. Each covered person acknowledges the text in front of them. Later, someone produces the records without a scramble.
Drafting can be automated, and increasingly will be. Accountability cannot, by definition. An agent can write your data retention policy. It cannot take responsibility for it, and it cannot agree to follow it on behalf of your warehouse team. Whatever else changes in the next five years, an attestation stays a person putting their name on a statement.
Faster drafting makes the record layer heavier
There is a second-order effect here that I think gets missed. When drafting is nearly free, policies change more often. Every rewrite, tightening, and annual refresh gets cheaper to produce, so there are more versions in circulation than ever.
More versions means the question “which version was in force, and who had acknowledged it” comes up more, and matters more. This is exactly why we built AllyMatter so that every change, however small, goes back through approval and back out for acknowledgment. A comma can change the meaning of a clause. Records that only mostly match what people agreed to are worth very little in the meeting where they matter.
Speed upstream demands rigor downstream. The essay’s world of prolific AI drafting makes the boring record layer more load-bearing, not less.
Why we built the boring layer
So that is our corner of the ecosystem, stated plainly. AllyMatter is a system of record for the policy itself: the text, who approved it, who acknowledged which version, and the proof that they did, exportable the day someone asks.
We do not write your policies for you, and we do not pretend to know your regulations. You bring the standard, your people bring the judgment, and the approval workflow puts names and timestamps on every decision. Acknowledgment tracking binds every signature to the exact version and stores the statement each person saw. The audit trail keeps the whole history assembled for the day the auditor, the client, or the lawyer asks.
Concept: da Costa’s three layers redrawn as three stacked bands (Turn regulation into code / AI-native systems of record / Agent fleets), sitting on a wider foundation band:
Caption: Every layer of compliance automation stands on a governed policy record.
If the essay is right, and I think it mostly is, the companies above us in that stack are about to make regulated work dramatically faster. We are content being the layer underneath: the one that knows which policy was in force, who approved it, and who saw it, no matter what wrote the first draft.
Start your 30-day free trial. No credit card to start, and a 30-day money-back guarantee if you convert and change your mind.
Not ready for a trial? Migration from SharePoint, Google Drive, Confluence, or Notion is on us. We’ll move your docs and have you running in about a week.
Founder of AllyMatter I’m founder of AllyMatter, an operations-first knowledge base for growing companies. Before AllyMatter, I co-founded Syren Cloud and helped scale it into a 300-person organization across two countries, leading marketing, operations, and HR. We moved fast, served demanding customers, and learned the hard way that internal knowledge systems built for help docs or IT don’t solve day-to-day operations. AllyMatter is my answer—tools that turn tribal knowledge into trusted, searchable processes. This blog shares the playbooks, checklists, and lessons I wish I’d had while scaling.
