Ask any regulator what makes a whistleblower valuable. It's not only the tip-off, but the insight that follows: who knew what and when, why decisions were made, and how conduct unfolded. Absent a whistleblower, reconstructing context, knowledge and intent is a defining challenge subject to supposition and inference.
AI cannot be a whistleblower. It cannot make a tip-off, has no standing as a witness, and does not have (or need) protective regimes. Yet the ordinary way most organisations, and their advisers, now use generative AI can fill investigatory gaps as well as, if not better than, a conventional whistleblower.
Filling investigative gaps
Have you ever asked a model to "assess" a position, "analyse" a problem, give "thoughts" or "feedback", or set out "the risks if we" take a particular course? That is decision deliberation. Timestamped, searchable and retained deliberation. Like minutes for a meeting you did not know you were holding, or intend to hold.
From an investigative perspective, AI creates a new species of business record. Books and records conventionally contained conclusions, supported by selective or curated reasoning (if any at all). Finding the reasons behind the documents needed to come from people, which is why whistleblowers and witness evidence mattered. Conversational AI can record reasoning itself, including the options considered and discarded, and the questions asked quietly, including those from directors and decision-makers testing legal positions before anyone else hears them.
Where directors may have once been asked how they came to a decision, they may now be asked which parts of their AI's advice they accepted, which they dismissed, and why.
The investigative value is hard to overstate. Deliberations that were once internal now have a record: when you first became aware of something, what you understood it to mean, whether it concerned you, and whether that concern was actioned or parked. It is the equivalent of a person's diary notes, search history and correspondence combined into a single chronological record, capable of telling a regulator what someone knew, when they knew it, and whether they appreciated the risk. And none of it needs corroboration from a second person.
The risk is live now
What would be your first thought if a regulator asked for your organisation's AI chat logs today? Worth sitting with, because nothing stops them asking.
No new laws are required to activate the AI whistleblower. A chat history and files generated by AI are books and records covered by existing information gathering powers. Deleting data history may also not be an exit: an underlying record can survive user deletion, and destroying required records may itself be an offence.
With potentially dozens or even hundreds of users within an organisation using conversational and generative AI every day, the records reach beyond evidence of individual decision making. AI data can speak to culture, common practices and the evolution of conduct.
Managing AI risks
Not using AI is not a commercially practicable option. The efficiency and productivity gains are, to most users by now, self-evident even for sensitive and high-risk work.
The last 12 months have been a tipping point, with tentative engagement by Australian professional services turning into a sprint, with huge investments across professional service providers unwilling to be left behind.
So the question is not whether to adopt, but how to adopt.
Almost universally, AI implementation programs place data sovereignty and protection as priority one, as it should be. But sovereignty answers where data lives and who can reach it; it protects intellectual property and privacy. It says nothing about what the data is. What is often pushed lower on the priority list, or excluded entirely, is management of the new records an AI implementation creates.
This can look complicated, but the principle is simple: AI records need to be treated the way you treat existing records of the same type.
- If sensitive information is embargoed before release, the AI platform needs to be able to achieve the same.
- If information is redacted or anonymised, the AI platform needs to be able to achieve the same.
- If a document is subject to legal professional privilege, the AI platform needs to be able to distinguish this and be in an environment that supports privilege.
- If a record must be retained for a defined period, the AI platform needs to achieve the same.
These are not platform problems. They are governance problems, and they belong to the organisations and firms creating the records.
A Claude or ChatGPT subscription might be able to do the work. Whether its work is governed is a different question, and for most uses the honest answer is nobody has asked.
AI use is creating records every day. Whether those records become a regulatory risk depends on how they are managed.
RGC Onside is RGC Advisory's platform for reviewing ASX announcements against the JORC Code, the Listing Rules and the Corporations Act, delivered under a legal services engagement. It applies the approach described in this article to one of the most sensitive record classes there is.
