What a compliance AI agent actually does
Collects evidence against your control framework, answers security questionnaires from your policy documentation, and flags any control drift or gap for a human to review.
A compliance AI agent sits across your cloud infrastructure, HR and IT systems, and your policy documentation, and runs a loop: continuously check evidence against each control in your chosen framework (SOC 2, ISO 27001), flag anything that's drifted out of compliance, answer an inbound customer security questionnaire by pulling exact language from your approved policy documents, and draft policy updates when a framework requirement changes. The useful ones cite the exact control or policy source for every answer rather than paraphrasing from general knowledge, and they escalate anything they can't ground in an approved source to a human compliance officer.
The category pushed further into AI through 2026 while staying firmly in annual-contract territory. Norm Ai closed a reported $120M Series C at a $1.2B valuation in July 2026 specifically to build agents that encode financial-services regulation directly, and Vanta and Drata both deepened AI in evidence review and questionnaire automation. But pricing data from Vendr shows real negotiated medians, not self-serve numbers: about $20,000/year for Vanta and about $38,000/year for Drata, so "buy" in this category means a real annual contract and a sales conversation, not a signup form.
Where agents still fail: grounding, in the legal sense. An agent that paraphrases a regulation instead of quoting it, or maps evidence to a control it doesn't actually satisfy, creates exactly the kind of liability the Air Canada chatbot case illustrates, except the audience here is an auditor or a customer's security team instead of a passenger. These agents are decision-support tools: a compliance officer or outside counsel still has to sign off on anything actually submitted or represented as fact.
What the compliance agent handles (and what it shouldn't)
| Task | Agent handles it? | Systems it touches | Human role |
|---|---|---|---|
| Evidence collection against a control framework | Fully | Cloud infra, HR/IT systems | Reviews flagged gaps |
| Security questionnaire answering from policy docs | With approval | Policy repository | Compliance officer reviews before sending |
| Policy drafting against a chosen framework | With approval | Policy repository | Compliance officer finalizes |
| Continuous control monitoring and drift alerts | Fully | Cloud infra, identity provider | Reviews flagged drift |
| Regulatory change monitoring | With approval | Regulatory feeds | Compliance officer assesses the impact |
| Audit readiness scoring | Fully | Control framework data | Reviews before engaging an auditor |
| Representing compliance status to an auditor or regulator | No | Audit workflow | Compliance officer or counsel represents the company |
| Legal interpretation of ambiguous regulatory language | No | Policy repository | Outside counsel interprets |
Off-the-shelf AI agents on the market
Real products you can sign up for today — with current 2026 pricing, honest pros and cons.
Vanta
Startups and scaleups preparing for their first SOC 2 or ISO 27001 audit
Demo only
Contact sales; AWS Marketplace lists Essentials at $14,000, Plus at $21,500 and Professional at $23,000 for 1-20 employees on a 12-month term; Vendr reports a broader range of $7,500-$57,000/year with a median around $20,000
Custom
Pros
- +AI Agent automates evidence review, questionnaire answering and policy drafting
- +Broadest framework library (SOC 2, ISO 27001, HIPAA and more) among the compliance-automation vendors
- +Large installed base means integrations cover most common cloud and HR tools
Cons
- −Audit fees for the actual SOC 2 or ISO 27001 audit aren't included
- −Pricing still isn't self-serve despite the AWS Marketplace listing
- −AI Agent features are an add-on, not necessarily included at every tier
Drata
Companies that specifically prioritize questionnaire automation and continuous monitoring
Demo only
Contact sales; AWS Marketplace lists a $25,000 platform fee (100 FTE) plus a $7,500 SOC 2 framework fee; Vendr reports a median around $38,000/year
Custom
Pros
- +AI-powered questionnaire automation and continuous control monitoring
- +Strong reputation specifically for SOC 2 and security-questionnaire workflows
- +Real-time control-drift alerts rather than point-in-time checks
Cons
- −Vendr's median is roughly double Vanta's for broadly similar core functionality
- −Price scales with the number of frameworks you add
- −Less framework breadth than Vanta for less common standards
Norm Ai
Financial services companies needing to track live regulatory change, not just SOC 2 or ISO 27001 evidence
None
Contact sales
Enterprise-only, financial-services focused
Pros
- +Encodes actual regulatory text into agents rather than checking against a generic control framework
- +Backed by a $120M Series C at a $1.2B valuation (July 2026, Khosla Ventures)
- +Built specifically for regulated industries like financial services where rules change frequently
Cons
- −No public pricing
- −Narrower industry focus than Vanta or Drata's broad SOC 2 and ISO 27001 coverage
- −Enterprise-only with no path for a smaller company to try it
The AI stack
A production compliance agent needs a reasoning model, grounded policy and control data, and real read access to the systems that generate evidence.
Reasoning model
Checks evidence against controls, drafts questionnaire answers, and flags gaps or drift
Claude Haiku 5.5
$0.10/M input tokens (up to 100K), $0.50/M outputRoutine control-drift monitoring
Claude Sonnet 5.5
$2/M input, $10/M outputQuestionnaire answering and policy drafting
Claude Opus 5.5
$4/M input, $20/M outputRegulatory change monitoring and complex policy drafting
Our pick: Haiku 5.5 for continuous control monitoring, Sonnet 5.5 for questionnaire drafting, and Opus 5.5 only for genuinely complex regulatory analysis.
Knowledge & retrieval
Grounds every answer in your actual control framework and policy documents, not a generic paraphrase
Vendor-native control library (Vanta, Drata)
Included in the subscriptionThe buy-SaaS path
Custom RAG over your policy docs and regulatory text
Roughly $0.15/mo on Supabase pgvector for a small corpusCustom builds
Our pick: Whichever path you choose, force the agent to cite the exact control or policy source for every answer, never a paraphrase from general training data.
Integrations / tools
Lets the agent pull live evidence from your actual systems instead of relying on stale, manually uploaded documents
Native connectors (AWS, Okta, HR systems)
Included on most SaaS tiersBuy-SaaS
MCP tools or custom API calls, scoped read-only
Developer timeCustom builds and n8n
Our pick: Scope every evidence-collection token to read-only; the agent should never need write access to generate compliance evidence.
Observability & evals
Catches an ungrounded answer or a missed control-drift alert before it reaches an auditor or customer
Vendor dashboards (control pass/fail, drift alerts)
IncludedBuy-SaaS
Langfuse
Free up to 50K units/mo, then $29+/moCustom builds
Our pick: Add Langfuse or an equivalent the moment you run a custom agent, and have a compliance officer sample a week of answers monthly.
Reference architecture
The hardest engineering problem is grounding, in the legal sense: a compliance agent that paraphrases a regulation instead of quoting it, or maps evidence to a control it doesn't actually satisfy, creates exactly the kind of liability the Air Canada chatbot case illustrates, except the audience is an auditor or regulator instead of a customer.
Evidence or questionnaire request arrives
Audit platform, customer security team, or regulatory feedA new control check, questionnaire, or regulatory update needs a response
Retrieve and ground
Reasoning model plus RAGThe agent pulls the exact control language, policy text, or regulatory text relevant to the request
Gap and drift analysis
Evidence comparisonThe agent compares current system state against what the control actually requires
Confidence check
Guardrail layerAnything not clearly grounded in an approved source is flagged rather than answered
Draft response or flag gap
Tool-calling layerThe agent drafts a questionnaire answer or policy update, citing its exact source
Human review
Compliance officer queueNothing is submitted externally or represented as fact without a human reviewing it first
Logging and audit trail
Observability toolEvery evidence check, draft and citation is logged to support the audit trail itself
Estimated cost per request
~$0.03-$0.10 per questionnaire answer or control check in model costs alone, before any vendor's annual platform fee
Cost calculator
Drag the sliders to model your actual usage. The numbers update in real time so you can stress-test economics before writing a single line of code.
Estimate your monthly model cost at your own questionnaire and control volume. Vendor annual platform fees aren't captured here; see build vs. buy for that comparison.
Estimated monthly cost
$32.50
≈ $390 per year
Calculator notes
- This calculator estimates only the model cost, which applies whether you buy a platform or build custom; Vanta's and Drata's annual contracts (Vendr-reported medians of $20K and $38K/year) are flat fees layered on top.
- A questionnaire answer costs more per unit than a routine control check because it requires drafting prose grounded in your policy documents.
- Neither Vanta's nor Drata's pricing is self-serve; treat the ranges in saas_alternatives as planning estimates from Vendr and AWS Marketplace listings.
- This calculator doesn't include audit fees, which are always a separate cost from the AI automation layer.
Build it yourself with vibe-coding tools
n8n gets a basic questionnaire-answering agent running in a few days: a webhook on new questionnaire requests, an AI Agent node grounded in your policy documents, and a compliance-officer review step before anything goes out.
Time to MVP
3-5 days for basic questionnaire answering, 2-4 weeks for full evidence automation
Total cost to MVP
$0-$70 (n8n Cloud Starter at roughly 20 EUR/mo plus model API costs)
You'll need
Starter prompt
Set up a webhook trigger on new security questionnaires or evidence requests. Feed each request into an AI Agent node using Claude Sonnet 5.5 as the model, with a Vector Store tool pointed at your written policies and control framework documentation, and a read-only HTTP Request tool for pulling live evidence from your cloud and identity provider. Give the AI Agent node this system prompt: 'You are a compliance assistant for {Company Name}. Answer each questionnaire item or evidence request only using the policy-search tool and the live-evidence tool. Cite the exact policy section or control ID for every answer. If you cannot find a source that directly supports an answer, do not guess: reply with GAP and a one-sentence description of what evidence is missing. Never answer from general knowledge about what a typical company's policy might say.' Add a Switch node after the AI Agent: route GAP items and every drafted answer to your compliance officer's Slack channel or email for review before anything is sent externally. Log every answer, its citation, and the reviewer's decision to a Google Sheet or Postgres table for the audit trail.
Paste this into n8n
Follow-up prompts (run in order)
- 1
Add a control-drift check that compares current cloud configuration against each control weekly
- 2
Add a regulatory-change monitoring step that flags new requirements relevant to your industry
- 3
Add a policy-drafting step for updating documentation when a control changes
- 4
Add a fallback model call if the primary model times out or errors
Expected output
A working agent that drafts grounded, cited answers to routine questionnaire items within seconds, and flags anything it can't support with an exact source for a compliance officer to resolve before anything is sent out.
Known gotchas
- !Policy documents go stale after any control change and need re-indexing, or the agent cites outdated language
- !A model will paraphrase a regulation instead of quoting the actual control language unless explicitly instructed to cite sources
- !n8n bills per workflow execution, so a batch of questionnaire items can add up fast on the Starter plan's monthly cap
- !There's no built-in legal judgment: never let the agent represent compliance status directly to an auditor or regulator
- !Evidence-collection tokens need to be scoped read-only; the agent should never have write access to the systems it's checking
Compliance & risk reality check
A compliance agent's own biggest risk is the thing it's supposed to prevent: an ungrounded claim about your company's actual compliance status.
Liability for what the agent represents as compliant
The same principle that held Air Canada liable for its chatbot's invented refund policy applies directly: if the agent tells an auditor or a customer's security team a control is satisfied when it isn't, your company owns that misrepresentation.
Mitigation: Ground every answer in your actual control framework and evidence, cite the exact source, and have a compliance officer review before anything is submitted externally.
Human sign-off on consequential compliance representations
A questionnaire answer or audit evidence submission is a real legal representation, not a chat reply.
Mitigation: Route anything leaving the company, a questionnaire response or an auditor submission, through a human reviewer every time.
Data security of control and evidence data
Compliance evidence often includes infrastructure configuration and access details an attacker would find valuable.
Mitigation: Use a vendor with SOC 2 certification and a no-training clause, and scope evidence-collection tokens to read-only.
No legal advice
Interpreting ambiguous regulatory language is a job for outside counsel, not the agent.
Mitigation: Flag ambiguous regulatory questions for counsel rather than letting the agent interpret them.
Build vs buy: the real math
4-6 weeks for a RapidDev build; 3-5 days for a basic n8n version
Custom build time
$13K-$25K for an agency build (up to $30K for financial-services work); $0-$70/mo for DIY
One-time investment
Roughly the point where you need live regulatory-change tracking in a specific regulated industry, which neither Vanta nor Drata is built for
Breakeven vs buying
Vendr reports a median of about $20,000/year for Vanta and $38,000/year for Drata, both of which include a pre-built library of SOC 2 and ISO 27001 controls that would take real time to encode from scratch in a custom build. A $13K-$25K custom build makes sense mainly when your actual need is narrower, just questionnaire answering, or different, live regulatory tracking for financial services like Norm Ai's specific niche, not as a general substitute for an audit-automation platform.
Skip the DIY — RapidDev builds the production version
A Lovable MVP gets you a demo. Production needs auth that doesn't leak data, AI calls that don't bankrupt you, observability when models drift, and code you can audit. That's what we ship through our AI app development service.
Discovery call (free)
30 minWe map your exact compliance AI agent use case: who uses it, target volume, AI model choice, integrations, compliance scope. You get a detailed scope document and fixed-price quote within 48 hours.
AI-accelerated build
4-6 weeks for a RapidDev build; 3-5 days for a basic n8n versionOur engineers use Claude Code, Lovable, and custom tooling to ship 3–5x faster than agencies. You see weekly progress in a staging environment — not a black box.
Launch + handoff
1 weekWe deploy to your infrastructure, transfer the GitHub repo, set up CI/CD and monitoring, and train your team. You own 100% of the source code, prompts, and model configurations.
What you get
Timeline
4-6 weeks for a RapidDev build; 3-5 days for a basic n8n version
Investment
$13K-$25K for an agency build (up to $30K for financial-services work); $0-$70/mo for DIY
vs SaaS
ROI in Roughly the point where you need live regulatory-change tracking in a specific regulated industry, which neither Vanta nor Drata is built for
30-min call. Fixed-price quote within 48 hours. No commitment.
Frequently asked questions
How much does an AI agent for compliance cost?
Vanta runs a Vendr-reported median of about $20,000/year ($14K-$57K range), and Drata runs a median of about $38,000/year. A custom RapidDev build runs $13K-$25K upfront (up to $30K for financial-services work), plus $150-$600/mo in model and infra costs. A DIY n8n version costs $0-$70/mo but takes your own time to build and maintain.
How long does it take to set up?
A SaaS platform connected to your cloud and HR/IT systems takes 4-8 weeks. A custom agency build takes 4-6 weeks because the control mappings have to be encoded correctly before they generate any evidence. A basic n8n version can answer simple questionnaire items within 3-5 days, though full evidence automation takes 2-4 weeks.
Can RapidDev build this for us?
Yes. RapidDev has shipped 600+ apps and offers a free 30-minute consultation to scope your control framework, evidence sources and the review process a compliance officer should sit in.
Can an AI agent represent our company as compliant to an auditor?
No. The agent can draft and ground answers in your actual evidence and policy documents, but a compliance officer or outside counsel should always be the one representing compliance status to an auditor or regulator.
What happens when the agent can't ground an answer in an approved source?
A well-built agent flags the gap rather than guessing, the same discipline that prevents the kind of invented-policy liability that held Air Canada responsible for its chatbot's fabricated refund claim.
Can it work with AWS, Okta or our HR system?
Yes. Vanta and Drata both connect natively to common cloud providers, identity systems like Okta, and HR platforms, and a custom build can reach any system that exposes a read API.
Is this a substitute for a compliance officer?
No. It automates evidence collection and drafts answers, but a human compliance officer or counsel still needs to review and sign off on anything submitted externally or represented as fact.
Want the production version?
- Delivered in 4-6 weeks for a RapidDev build; 3-5 days for a basic n8n version
- You own 100% of the code
- AI cost monitoring built in
30-min call. No commitment.
