AI Governance, Compliance, and Contracts: Why We Merged These Three Pieces
Three decades of audit work taught me these were never separate conversations
For years, I treated these three disciplines — AI governance, compliance, and contract management — as separate conversations. With the board, I talked governance. With the audit committee, compliance. And contracts almost always sat on the legal department’s side, outside the radar of risk and internal control.
It took three decades of auditing companies across more than 15 countries for me to realize something simple: those three conversations are actually one.
Let me walk you through why.
When a company adopts artificial intelligence — for risk analytics, process automation, whatever the use case — the governance question isn’t just “does the model perform well?” It’s “who’s accountable if the model gets it wrong, and what document defines that accountability?” That answer almost always lives in a contract, an internal policy, or a regulatory document. Not in a dashboard.
When we talk about compliance — AML/CTF regulations, industry-specific frameworks, ISO 37001, whatever applies in your jurisdiction — a company’s real exposure isn’t just whether the policy exists. It’s whether that policy actually reflects what’s happening on the ground, and whether contracts with vendors and clients are aligned with what the policy requires. A flawless policy on paper, backed by contracts nobody has reviewed in two years, protects no one.
And when we talk about contracts, the conversation has traditionally been purely legal: clauses, terms, jurisdiction. But every contract is, at its core, a risk management instrument. It defines who carries what exposure, under what conditions, with what exit points. Treating it as isolated from the rest of corporate governance is the mistake I see repeated most often in the companies I work with.
These three pieces were always connected. What was missing was the infrastructure to treat them as what they actually are: a single control system.
Get Lester Davila Escobedo’s stories in your inbox
Join Medium for free to get updates from this writer.
That’s exactly what we’ve built with Auditoría 4.0, our framework for digitizing the assurance function at Consulting and Leaders Group. We started on the financial and operational side: real-time analytics, automated risk matrices, continuous monitoring instead of point-in-time quarterly audits. In our reference case, this approach cut audit turnaround time by 40%.
But a control infrastructure that audits the numbers in real time while contracts still get reviewed by hand — whenever someone remembers to — isn’t complete infrastructure. It’s governance with a hole in it.
That’s why we brought Obligo AI — Powered by Consulting and Leaders Group into our AI Governance practice: a capability that uses artificial intelligence to draft, review, and validate contracts, internal policies, and regulatory documentation, flagging compliance risks before they become an audit finding or a sanction. It doesn’t replace your legal team’s judgment. It frees that judgment from repetitive review work, so it gets spent where it actually matters: deciding, negotiating, prioritizing.
Here’s how the full picture fits together:
AI governance sets the rules of the game — who decides, who’s accountable, what biases need to be mitigated in algorithm-assisted decision-making. That’s the framework we call Shielded Governance at CLG.
Compliance translates those rules into concrete, measurable, auditable controls — not a static checklist, but something continuously monitored.
Contracts and documentation are where those rules become enforceable. It’s the terrain where, if something breaks, the company actually pays the price — in disputes, sanctions, reputation.
When these three pieces live in separate systems, reviewed by separate teams, on separate calendars, governance has gaps nobody sees until it’s too late. When they live in a single control infrastructure, the company stops reacting to risk and starts anticipating it.
This isn’t an abstract idea. It’s literally how we’re redesigning the way the audit committees I work with understand their own risk perimeter. The question is no longer “do we have a good lawyer reviewing contracts?” or “do we have a solid compliance policy?” It’s whether those two things — and the AI governance framework holding them together — are actually talking to each other, monitored with the same analytical rigor.
Very few companies in Latin America can answer yes to that today. And that’s precisely the opportunity: closing that gap before it becomes the finding nobody wanted in the next audit report.
If your organization is still managing AI governance, compliance, and contracts as separate conversations, that’s probably your next blind spot. In 30 minutes, I can show you what this looks like integrated, with concrete examples from your sector.
