If you've ever worked in compliance infrastructure, you've probably noticed something strange: every industry is solving the exact same problem, and nobody is talking to each other.

I've spent several years building compliance systems. First at a startup using NLP to monitor workplace communications in real time, then at the company that acquired it, running pipelines that process 500,000 files a month from 13 data providers for 1,300 client firms in 105 countries. Before that, I built financial data dashboards that pulled from dozens of market data sources.

Different industries. Different regulators. Different data. Same headaches, over and over.

Here's what I've come to believe: the U.S. spends $2.15 trillion a year on regulatory compliance, roughly 7% of GDP, not because compliance is inherently that expensive, but because every industry reinvents the infrastructure from scratch.

The same problem, three times over

Let me walk through what compliance looks like in three industries I've touched directly.

Financial services. Firms are required to capture and archive every email, chat message, trade record, and voice call. FINRA, SEC, and AML rules each have their own requirements. Most mid-sized firms run several vendor tools that overlap in coverage and still leave gaps. And the downside of getting it wrong is not abstract: regulators fined financial institutions $4.6 billion in 2024, 95% of it in North America, then $3.8 billion in 2025 as enforcement shifted toward Europe and Asia. The rules follow you wherever you operate.

Healthcare. The U.S. spends about $1 trillion a year on healthcare administration, a fifth to a quarter of every healthcare dollar. Not all of that is waste, but administrative complexity is the largest single category in JAMA's analysis of waste in the U.S. health system, at an estimated $266 billion a year. The day-to-day version looks like this: wrangling with insurers over claims cost hospitals $25.7 billion in 2023, and nearly $18 billion of that went to fighting denials that were eventually overturned and paid anyway. Entire departments exist to argue about paperwork that ends the same way it started.

Corporate communications. Harassment policies, data retention rules, financial communication regulations. Each handled by a different vendor, a different team, a different workflow. When a new regulation comes out, someone has to manually figure out which tool needs updating and what the change actually means.

The underlying structure of these problems is identical. You have data coming in from many sources in incompatible formats. You need to analyze it against a set of rules. You need to flag violations, score risk, and produce an audit trail that satisfies a regulator who might show up two years from now.

The rules differ. The data formats differ. The regulators differ. But the architecture? It's the same problem everywhere.

77% of compliance teams still rely on manual processes. Only 1.6% of firms have fully integrated AI into their governance, risk and compliance work. Every vendor in this space claims to use AI. Most of them are stretching the definition.

Here's what I actually saw in production: a keyword list. Hundreds of terms flagged as risky. A message contains "guarantee"? Flagged. "Off the books"? Flagged. The code comments in one of the systems I worked on literally described this approach as "cheap, dirty and error-prone." That was a production compliance system, watching real communications at real firms.

Real NLP compliance analysis looks different. It accounts for context: who said it, to whom, in what relationship, in what sequence of messages. It filters noise (newsletters, automated notifications, routine replies) so analysts aren't buried in false positives. It scores confidence, not just presence. It can re-analyze historical data retroactively when rules change.

But even the good AI tools have a gap nobody has solved cleanly: regulations keep changing. The SEC updates guidance. CMS revises billing codes. A new rule takes effect. Every time, someone has to manually figure out what changed and whether the existing flagging logic still holds. That someone is usually a lawyer and an engineer, working off a PDF.

A compliance system that can't track regulatory changes is like a smoke detector that never gets firmware updates. It'll catch the fires it was designed for. Everything else gets through.

What the infrastructure actually needs

After building these systems, I think about the problem in three layers.

Layer 1: a universal data pipeline. One ingestion system that handles all source types (emails, documents, structured records, voice transcripts), normalizes them into a single canonical format, and routes them downstream. Not a different pipeline per industry. One pipeline with industry-specific adapters.

This is the pattern I wrote about in my previous article. Once you standardize the interface rather than the source, a new data provider goes from weeks of custom work to a few days. The pattern works the same whether you're ingesting financial communications or healthcare billing records.

Layer 2: a context-aware analysis engine. Not keywords. An NLP engine that understands sender-recipient relationships, conversation history, domain-specific risk signals, and confidence scoring. One that improves from analyst feedback: when a flag is cleared as a false positive, that signal should update the model, not get discarded.

The noise problem is real. In a high-volume communications pipeline, the majority of flagged content turns out to be automated emails, newsletters, and routine replies. If your analysis engine doesn't separate noise from signal, your compliance team spends most of its time clearing false positives instead of investigating actual risk.

Layer 3: a regulatory change tracker. This is the piece nobody has built well. A system that monitors regulatory sources (SEC releases, CMS updates, FINRA notices), parses the actual text, maps changes to existing rule logic, and surfaces gaps. A human makes the final call on whether to update a rule. But they're reviewing a proposed change with the relevant context in front of them, not starting from scratch with a 200-page PDF.

Why unification is hard (but worth it)

The reason these three layers don't exist as a single platform today isn't technical. It's organizational.

Financial services compliance vendors don't see themselves as healthcare companies. Healthcare IT vendors don't think about financial communications. Corporate HR software vendors aren't building SEC-grade audit trails. Everyone optimizes for their vertical.

The fragmentation lands hardest on the firms least equipped to absorb it. An NBER study of U.S. regulatory compliance costs found that the burden peaks in the middle: firms of around 500 employees spend about 40% more of their payroll on compliance than very small or very large firms, because they're big enough to be regulated like enterprises and too small to get enterprise economies of scale. Across the broader economy, federal regulations cost firms an average of $12,800 per employee per year. A mid-sized firm can't afford a dozen specialized tools and the teams to operate them, so it ends up patching things together by hand.

Billions in annual fines tell you what the downside looks like. Two trillion in annual compliance costs tells you the price of the status quo. There's a large gap between those two numbers where better infrastructure can live.

What I'm working on

I've been building toward exactly this: a compliance intelligence platform that handles all three layers, configurable across industries.

Nothing here is speculative anymore. The data pipeline layer I've run in production for years. The NLP analysis layer I've built and watched fail in ways that taught me why noise filtering isn't optional. And I now have a working prototype that runs rules from four different regulatory domains through one engine: FINRA communications rules, SEC recordkeeping requirements (both the original 1997 version and the 2022 amendments, because rule versioning matters more than people think), HIPAA privacy provisions, and AML structuring rules. I picked domains from different industries on purpose. If the thesis is that the rule layer is pluggable, the honest test is plugging in rules that have nothing to do with each other.

The hard parts aren't the AI. They're the pipeline reliability when providers change formats without warning, the rule mapping when regulatory language is ambiguous, and the feedback loop that makes the analysis improve over time instead of drifting.

But when 77% of compliance teams still work manually and 1.6% have fully integrated AI, the gap between where things are and where they could be is hard to ignore.