Can we use AI agents in a regulated or compliance-heavy business?

Yes, but only if compliance is an architecture constraint, not a checkbox at the end. In a regulated business the rules decide what the system may be: the agent fails closed, every tool call is audited, anything irreversible stops for a human, personal data is guarded at the boundary, and tenants are isolated below the model. Designed in, those properties are cheap and they're the entry ticket. Bolted on after review, they force a rebuild.

0106compliance as an input, not paperwork

Compliance as an input, not paperwork

Treat the law like latency or cost: an input to the design. Data-protection rules, professional secrecy, and the mandate decide what data can flow where and what the AI may do unsupervised — so design around those constraints first.

0206fail-closed and human-gated

Fail-closed and human-gated

The default answer is no: if the agent is unsure whether an action is allowed, it stops and escalates. Anything irreversible (a payment, a filing, a destructive change) waits for a human. A confident wrong action is worse than a refusal.

0306isolation and audit by construction

Isolation and audit by construction

Tenant isolation lives below the model, so one client's data can't reach another's request — the model can't leak what it never had. Every tool call is logged, so 'why did it do that' has a precise answer after the fact.

0406common questions

Straight answers.

Does compliance slow an AI project down?: Upfront a little, overall it speeds you up: designing for fail-closed, audit, and isolation from day one is far cheaper than retrofitting them after a review or an incident. For regulated buyers they're the entry ticket.
Can a general LLM be trusted to follow the rules?: No — never rely on the model to enforce a rule the law requires you to guarantee. The guarantees live in deterministic code around the model.
What regulations does this cover?: The pattern is the same across finance, healthcare, legal, and accounting: data-protection law, professional secrecy, and accountability for actions, turned into fail-closed prompts, audit, HITL, and isolation.