Frozen compliance budgets, multiplying AI risk: the CCO job becomes triage

A flat budget is a prioritization engine whether or not anyone calls it that. Anything added under one gets funded by letting something else run thinner, so the practical content of the American Banker column's advice ^[7] is a list of controls an institution is prepared to see degrade. The column does not supply the list.

Its own figures show where the strain sits. Seventy percentage points separate the banks running AI somewhere in the business from the executives who describe themselves as leading-edge users of it ^[10]. Presence in the room is not command of the subject: a further 35 points separate the risk and compliance leaders who say they sit in enterprise AI decisions from that leading-edge group ^[11]. That leaves a large population of institutions where models are in production and the people accountable for the control environment rate their own fluency as unremarkable.

Worth noting what is not disclosed. These arrive as 2025 survey data with no named sponsor, instrument or sample size ^[12], which makes them usable as direction and useless as a benchmark. No CCO is walking an unattributed 15% into a board meeting and coming out with headcount.

The origin story matters to the arithmetic. AI entered compliance through narrow work where the payoff could be measured: anti-money-laundering alerts, sanctions screening, transaction monitoring ^[13]. Enterprise-wide deployment reverses the direction of the review. Compliance stops assessing tooling it commissioned for itself and starts assessing decisions made elsewhere, which is a larger job performed by the same or fewer people ^[1].

The timing argument is that regulatory easing opens a rare window to redefine the mandate ^[8]. Windows close. A function that converts control capacity into strategic influence during a permissive stretch does not get the analysts back when supervision tightens, and the charter, acquisition and conversion filings from nontraditional applicants ^[5] mean the supervised field is getting more crowded while the compliance bench is not.

The column dates the current shape of the role to post-crisis reform two decades ago ^[14]. That architecture was paid for by enforcement pressure, and enforcement pressure is exactly what the present environment withholds. Which is why "reinvention" here reads less as ambition than as the only available answer to a budget that has stopped growing while the surface area under review has not ^[9].