Should You Build or Buy AI for Product Compliance?

Executive Summary

The webinar argues that AI-powered product compliance is rarely a lightweight internal software project. A build may appear inexpensive when IT or AI staff are available, but a reliable system also needs regulatory expertise, continuously updated data, product and supplier context, testing, governance, auditability, and ongoing maintenance. The speakers’ case for buying a purpose-built platform is that it can provide these capabilities sooner and spread the cost and learning across many users.

The discussion also stresses that identifying applicable regulations is only the first step: companies must assess their products and components, obtain supplier evidence, and act on compliance obligations.

Build-Versus-Buy Considerations

• Liability and governance: Building gives a company control, but does not transfer its responsibility for compliance. The panel argues that aligning with established industry practices and maintaining an audit trail can help demonstrate a credible compliance process.
• Total cost of ownership: Existing AI staff do not make a build free. Costs can include AI usage, regulatory specialists, data collection, testing, system integration, external validation, legal review, and ongoing updates.
• Domain knowledge and context: Product attributes and company-specific risk matter, but so do regulatory interpretations, dependencies between regulations, industry practices, and accumulated implementation lessons. The speakers describe these as difficult to recreate from scratch.
• Accuracy at scale: Generic large language models may work on small, well-defined tasks but can struggle with comprehensive regulatory coverage, distinguishing relevant from irrelevant rules, and keeping pace with changes.
• Human oversight: Human review remains important. But if every AI result requires manual verification, the efficiency benefit may be reduced or erased.
• When building may still make sense: Internal teams may have valuable product and manufacturing knowledge, but the panel recommends recognizing that this is only one part of the solution—not a substitute for regulatory content, specialist expertise, validation, and governance.

Frameworks and Processes Highlighted

Assess the Full Operating Model, Not Just the Initial Build

• Include data acquisition and maintenance, specialist labor, testing, integrations, legal review, AI usage, governance, and continuing updates in the cost estimate.
• Consider the cost and compliance exposure during the time required to build and validate the system.

Treat Compliance AI as a Layered System

1. Regulatory content: Experts identify and update regulatory material.
2. Regulatory intelligence: The system normalizes requirements and captures context and relationships.
3. AI workflow and user interface: The platform matches requirements to products and presents results for review and action.

Use Product Profiles to Determine Applicability

• Capture product attributes, intended use, policy areas, and relevant geographies.
• Match the profile against regulations, while showing why a requirement applies—or does not apply.

Connect Identification to Execution

• Identify applicable rules.
• Translate them into compliance actions.
• Map requirements to parts, suppliers, and bill-of-material data.
• Gather documentation and evidence, investigate issues, and resolve them.

Preserve Trust and Auditability

• Keep a human ability to review, override, or tune outputs.
• Link AI-generated results back to source material.
• Use evaluation sets and testing to check that the system behaves reliably.
• Protect customer data; the Adherent representative said customer data is not used to train the platform.

Metrics and Claims Cited

• Adherent said it tracked 4,500 regulatory notifications in the prior year.
• The presenter said many organizations manage more than 200 regulatory changes per month across multiple jurisdictions.
• In the speaker’s comparison for assessing 200 regulations:
  • Manual work supported by general AI: 4–6 months, with estimated coverage of 10–20% of the relevant regulatory landscape.
  • Traditional compliance platforms: 6–8 weeks, with estimated coverage of 70–80%, but with human review limiting scalability.
  • Adherent’s claimed result: about 10 minutes, with near-100% coverage and near-zero risk of missing regulations.
• In Adherent’s internal tests of general-purpose LLMs:
  • The best result for identifying applicable regulations was reported as about 30%, with one company profile returning 5%.
  • When given a list of possible regulations and asked to classify them, models returned 2–3 times as many as actually applied, creating substantial review work.
• Eric said a system of this kind can cost as much as eight figures annually to build and operate, citing a team of 50 subject-matter experts. This was presented as an example, not a universal cost estimate.
• Adherent said its regulatory research team includes more than 50 domain experts and covers 27 languages.
• Travis cited an example of Uber spending twice its budgeted AI forecast in the first half of the year; this was used to illustrate that AI usage can carry material operating costs.
• The presenter described product recalls in Europe and the U.S. as being at an all-time high, and said enforcement activity is increasing. No specific recall figures were provided.

Product and Operating Examples

• Adherent: A product-compliance platform intended to map regulations to a product, prioritize what teams should address, and recommend compliance actions. The company said users provide product, policy-area, and geographic information; the platform then identifies applicable regulations.
• Source Intelligence: A supply-chain compliance and due-diligence solution that can support supplier and part mapping, subtier due diligence, traceability, bill-of-material rollups, and evidence gathering.
• Combined workflow: Adherent identifies which regulations apply; Source Intelligence helps investigate whether the materials or components in a product meet the resulting obligations. The webinar used a pencil as an example, mentioning possible concerns involving graphite, lead, formaldehyde, or component sourcing.
• Regulatory content operations: The speakers described regulatory experts working with engineers to curate regulatory material and build evaluation sets for testing the AI.
• Community learning: Adherent described peer discussions and workshops as a way for compliance teams to share lessons, compare approaches, and discuss regulatory topics.

Actionable Takeaways

• Build a complete cost model before approving an internal AI project; include expert labor, data, validation, maintenance, governance, and the cost of delays.
• Test general-purpose AI against real products and regulatory workloads—not just a few sample questions. Measure both missed regulations and false positives.
• Require traceable outputs that cite source regulations and explain why each requirement applies or does not apply.
• Ensure regulatory updates and interdependencies are handled continuously, rather than treating compliance as a one-time assessment.
• Plan the end-to-end workflow from regulatory identification through supplier evidence, remediation, and closure.
• For a build already in progress, seek lessons from organizations that have operated similar systems and validate assumptions about scope, cost, and ongoing expert involvement.

The performance figures and comparisons above were presented by Adherent and its panelists in a webinar promoting compliance solutions; they were not independently verified in the subtitles.

Presenters and sources: Danny (moderator, Adherent); Travis (Chief Strategy Officer and General Counsel, Source Intelligence); Eric (Adherent); Sarav/Sorab (Adherent platform and engineering); Joan O’Donnell and Adherent’s regulatory research team were also mentioned as sources of regulatory expertise.