Compliance Was a Tax on Iteration. AI Just Cut the Rate.

The expensive part of regulatory compliance was never the document. It was everything you didn’t do because of it.

Picture a hardware team that wants to revise a part. The change is good. But it triggers a re-evaluation against a few hundred pages of standards, and that re-evaluation costs weeks of specialist time. So the change doesn’t happen. The design freezes — not because freezing is correct, but because thawing is too expensive. Multiply that across every decision in a regulated product and you get the real cost of compliance: a slow, invisible tax on iteration. Teams stop changing things that should change.

That framing — compliance as a drag on iteration, not just a line item — is the seed worth pulling on from Naval’s The AI Industrial Revolution, where one founder describes building a retrieval system to “prompt our way through all of that work.” The claim that grabbed me wasn’t speed. It was the second-order effect: doing this “massively reduces change aversion and improves iteration.” The point of collapsing the cost isn’t to file faster. It’s to make changing the design affordable again.

The tax is real, and it’s measurable #

Compliance is not a vibe; it’s a budget. The best public estimate, an NBER working paper covering US firms from 2002–2014, puts regulatory compliance at between 1.3% and 3.3% of a company’s total wage bill, with the load heaviest for firms around 500 employees (NBER w30691). That’s a meaningful slice of payroll spent proving you followed the rules.

And the rules keep moving. One industry analysis reports regulatory changes up more than 500% since 2008, with financial institutions facing an average of 185 regulatory changes per day (Number Analytics). Each change is another reason to re-check a design you’d already settled. The same analysis claims organizations using advanced compliance technology saw 60% fewer regulatory breaches and 30–40% lower costs versus manual processes — directional, vendor-flavored, but consistent with the thesis that tooling moves the needle here.

Why RAG, specifically #

The reason this is a retrieval problem and not a “just ask the model” problem is accountability. A model that invents a plausible-sounding rule is worse than useless in a regulated setting — it’s a liability. Retrieval-augmented generation grounds every answer in the actual text of the standard, so the model is summarizing and cross-referencing documents you control instead of hallucinating regulations that don’t exist.

The research is catching up to the pitch. Oxford researchers built a RAG system to evaluate drug information and clinical-trial protocols against FDA guidance, reporting 100% answer relevancy and 95–100% faithfulness on clinical pharmacology questions (PMC). A separate framework tackles the cross-jurisdictional version of the problem — grounding responses in jurisdiction-specific standards across US (FDA) and Chinese (NMPA) regulatory frameworks, explicitly to suppress hallucinated rules (arXiv 2506.18511). On the legal side, scholar Paul Ohm argues (Network Law Review, 2025) that most major compliance obligations under the EU AI Act — summarization, technical documentation, bias assessment, code review — are automatable by today’s LLMs, pushing compliance costs toward negligible for well-resourced firms (Network Law Review). The honest read across this early work is that grounding the model in the regulation reliably beats asking it cold, but the output still tracks expert judgment only partially — a fast first pass for AI Act technical documentation, not a replacement for the human who signs it.

The concrete proof point #

The cleanest evidence comes from drug submissions. Clinical Study Reports are the dense, multi-hundred-page documents at the center of an approval filing — trial data, statistics, safety findings, all synthesized and cross-cited. McKinsey’s QuantumBlack and Merck co-built a generative-AI authoring tool for them, and the reported numbers are striking: first-draft time dropped from an average of 180 hours to 80 hours (a ~56% cut), with errors across data, messaging, citations, and terminology down 50%, produced by a joint team of 80-plus data scientists, AI engineers, and life-sciences experts working across three continents (McKinsey). Those figures are corroborated by independent trade coverage of the collaboration, not just McKinsey’s own post.

Here’s the part that matters for the thesis. When the marginal cost of producing a compliance document falls by half, the calculus on changing the underlying thing changes too. You can afford to run another trial arm, revise a study design after seeing the data, or respond to regulator feedback with a fresh draft instead of defending the old one. McKinsey’s follow-on argument is that AI plus zero-based redesign can compress overall submission timelines “from months to weeks” (McKinsey life sciences) — the same change-aversion collapse, one level up the stack. The design lock-in that made iteration expensive starts to thaw.

The honest counter-case #

If you only take the upside, you’ll get burned. Several things cut the other way, and they’re not nitpicks.

A model can’t own accountability. Wolters Kluwer’s post-mortem on failed “AI-first” compliance programs lands on a hard constraint: regulators demand a named human behind every interpretation, and “the model told us” is not a defense during an examination (Wolters Kluwer). Speed you can’t stand behind in front of a regulator isn’t speed. The human moves from author to verifier, but the human does not leave.

The error rate isn’t zero, and the tail is ugly. Even the favorable studies caveat themselves: the Oxford team reported mixed accuracy when experts independently checked gap identification and stated plainly that expert validation is required before any submission (PMC). The AI Act document tooling is the same story: partial alignment with experts, not parity. In a high-stakes filing, a missed gap or a confidently false “compliant” is not an average-case problem — it’s a tail-risk problem, and the tail is where careers and patients live.

The savings may pool with incumbents. The same NBER data showing burden peaking near 500 employees implies it’s proportionally heavier on small firms — yet the AI tooling that relieves it takes investment, integration, and ongoing validation that favor large players (NBER w30691). The startups most likely to disrupt a regulated industry may benefit least.

Regulators have agents too. This is the Red Queen risk the episode itself names: if both sides automate, regulators can use AI to generate more documentation requirements and more frequent audits, and the 185-changes-a-day firehose accelerates rather than calms. Cheaper compliance per document doesn’t help if the document count explodes.

What I’d actually do with this #

Treat the regulations as a test suite — a real one, with a named owner who signs off on the result. RAG over the standards is the fast test runner: it tells you, in minutes, where a design probably violates a rule, so a human can spend their scarce hours adjudicating the genuinely hard 20% instead of grinding through the rote 80%. The win isn’t firing the compliance team. It’s giving them a draft good enough that you stop being afraid to change the product.

The deepest claim in that podcast segment isn’t that AI files paperwork faster. It’s that change aversion is a cost you’ve been paying without seeing it on any invoice — and that the moment iteration gets cheap, you start building differently. That part doesn’t need a citation. Any builder who’s ever left a design untouched because the re-review wasn’t worth it already knows the number.