Appearance
AI Limitations & Authority Boundaries
This page is deliberately blunt. A compliance platform that oversells its AI creates exactly the risk it exists to manage.
What AI cannot do in OrviQ
These are structural. There is no configuration, permission or entitlement that enables them.
| AI cannot | Because |
|---|---|
| Determine that a requirement is satisfied | Satisfaction is derived deterministically from evidence, coverage and effectiveness |
| Determine control effectiveness | Derived from indicator results by rule |
| Produce an indicator pass or fail | Indicator evaluation is entirely deterministic |
| Calculate evidence coverage | Counting against a declared denominator |
| Approve a mapping, exception, applicability decision, policy or plan | Approval requires an accountable person |
| Close a finding, incident or audit | Closure is a governed decision |
| Set a risk rating | A judgement about business context |
| Set a recovery objective | A business decision about acceptable harm |
| Assess regulatory reportability | A legal test |
| Record a loss figure | A financial fact |
| Submit anything to a regulator | A formal representation |
| Publish a requirement or a control | The human adoption gate |
What AI is genuinely bad at
Distinct from what it is forbidden from doing. These are capability limits worth planning around.
Facts about your organisation
A model reading a requirement about cardholder data has no way to know whether you handle cardholder data. It will produce fluent, plausible text asserting either position.
Consequence: every factual claim in an AI draft needs verification. See AI Applicability Rationale.
Jurisdictional and entity nuance
Which regime binds which group entity, how two overlapping regimes interact, what your supervisor agreed last year — none of this is in the text the model reads.
Granularity judgement
The most common extraction error. Obligations split too finely become unownable; left too coarse they become unassignable. There is no correct answer in the text; it depends on how your organisation is structured.
Relationship strength
The most common mapping error is over-claiming: proposing equivalent where the honest relationship is subset. A model matching on textual similarity has no way to notice that a control covers three of four elements of an obligation.
Consequence: interrogate every equivalent proposal. See Relationship Types.
Distinguishing obligation from definition
"For the purposes of this circular, material means..." arrives as a candidate requirement with some regularity.
Scanned documents
An image without a text layer produces nothing usable. This is a document pipeline limit, not a model limit, but it is the most common cause of an empty extraction.
Failure modes to watch for
Fluent wrongness
Generated text reads well. Reading well is not being right, and a fluent incorrect justification attracts less scrutiny than a clumsy correct one.
Mitigation: review for reasoning and factual accuracy, never for readability.
Confidence as evidence
A high confidence score means strong pattern matching. It is not a probability of correctness.
Mitigation: use confidence to triage, never to skip review. Never batch-approve above a threshold.
Homogeneity
A dozen AI-drafted justifications across one framework will share a structure and a voice. An assessor notices.
Mitigation: rewrite each around what is actually specific to it.
Generic recommendations
Lessons-learned and gap-analysis drafts tend toward recommendations that could apply to any organisation.
Mitigation: if a recommendation would be true for a firm you have never heard of, it is not a finding.
Silent volume
An AI pass producing 214 proposals produces 214 items awaiting review. The work moved; it did not disappear.
Mitigation: generate at a rate you can review. Track first-time approval rates — see Human-in-the-Loop.
The language convention
The product and the documentation use a consistent vocabulary, and the distinction is substantive:
| AI | Human and engine |
|---|---|
| assists, suggests, proposes, extracts, drafts, summarises, recommends | determines, approves, decides, concludes, signs off, publishes |
If you find AI described anywhere as determining, deciding or approving something, treat it as an error and report it.
Evaluating the boundary yourself
Four checks, all of which you can run during an evaluation.
1. Turn the AI entitlement off. Every governed workflow should keep working — registers, approvals, determinations, reports, historical reconstruction. AI accelerates work; it is never a dependency for governance.
2. Try to approve your own AI-generated proposal. It will be blocked. Triggering an AI pass makes you the maker on everything it produced.
3. Look for a path from an AI pass to an approved record. There is not one. AI-produced records enter as proposed, draft or candidate.
4. Check the permission grants in your roles. A role holding both mapping.ai_propose and mapping.review does not break the per-record block, but it weakens the design intent.
What AI is actually good for
To balance the page. In practice the highest-value capabilities are:
| Capability | Why |
|---|---|
| Requirement extraction | Largest measurable workload reduction. A 94-page circular in two hours instead of a day and a half |
| Investigation questions | Cheap, and reliably surfaces the question nobody thought to ask |
| Root-cause hypotheses | Counteracts stopping at the first plausible explanation |
| Control discovery | Semantic search over a large control register genuinely beats keyword search |
| Mapping proposals, reviewed properly | Twelve days of analyst work replaced by two days of generation and four of review |
Every one of those is the same shape: the AI does the mechanical part, and a person does the judgement.