AI can find your policies. But can you trust the answers?

Enterprise AI is transforming how employees access organisational knowledge. But in complex, regulated environments, finding information is only part of the challenge. The more important question is whether that information can be trusted when decisions depend on it.

For years, organisations have struggled with a familiar problem.

They have thousands of policies, procedures, guidelines and operational documents, but finding the right information when it’s needed can be frustratingly difficult.

Enterprise AI is beginning to change that.

Tools such as Microsoft Copilot and other AI assistants are making it easier for employees to search organisational information, ask questions in natural language and receive useful answers without navigating multiple systems or lengthy documents.

That’s meaningful progress.

But as organisations become more comfortable using AI to answer operational questions, a more important issue is emerging.

How do we know the answers are right?

Not simply whether the AI has found a relevant document.

Not whether it has produced a clear explanation or included a supporting citation.

But whether the guidance is accurate, current, consistent with other organisational requirements and appropriate for the decision someone is about to make.

Because those are not necessarily the same thing.

A confident answer isn’t always the right answer

Consider a business banker assessing a lending application.

The banker needs to establish whether the application can be approved within their delegated authority or must be escalated.

They ask an AI assistant.

Within seconds, it returns a clear answer, supported by a reference to the bank’s lending policy.

The response appears credible. It identifies the relevant section and explains the approval requirement.

But imagine that a separate delegation framework imposes an additional restriction.

Or that the lending policy has recently changed, while an older operational procedure remains available.

Perhaps the requirement differs depending on the customer segment, the lending product or a particular risk indicator.

What happens if the AI retrieves one relevant document but doesn’t account for the others?

The answer might accurately summarise the document it found.

It could even include a perfectly valid citation.

And it could still be the wrong guidance for the decision being made.

This is a hypothetical scenario, not a finding about any particular bank or AI product.

But it illustrates an important distinction.

Finding relevant information is not the same as establishing that the information provides a complete and authoritative basis for action.

In heavily governed organisations, that distinction can have significant consequences.

When operational guidance fails, the consequences are real

The importance of accurate operational guidance becomes clearer when we examine what can happen when organisations fail to translate their obligations into consistent operational execution.

Recent Australian banking enforcement actions provide sobering examples.

In December 2025, the Federal Court ordered ANZ to pay $250 million in combined penalties across four matters involving institutional and retail banking misconduct.

Among those penalties were $40 million for failures involving customer hardship requests and inadequate hardship processes, $40 million for misleading statements about savings interest rates and failures to pay promised interest, and $35 million for failures involving fees and deceased estates.

ASIC described widespread misconduct and systemic risk failures, with significant consequences for customers.

In May 2026, Westpac was ordered to pay $26 million after failing to respond to more than 200 online customer hardship requests within legally required timeframes.

The failures extended over nearly six years.

The court found that the conduct was not suggested to be deliberate but arose from inadequate systems and operational failures. Some affected customers suffered adverse credit reporting and debt recovery activity.

These cases were not caused by AI-generated advice, nor were the penalties imposed for breaches of APRA’s CPS 230.

But they demonstrate something fundamental.

Having obligations documented is not the same as ensuring they are consistently understood and carried out.

For Australian banks, APRA’s Prudential Standard CPS 230 reinforces the importance of effective operational risk management, internal controls, monitoring and remediation.

It requires regulated entities to manage risks arising from inadequate or failed internal processes and systems, as well as the actions or inactions of people.

The underlying message is clear: organisations are accountable for the effectiveness of their operations, not simply for the existence of their policies.

And as AI becomes another way employees access and interpret operational guidance, an additional risk emerges.

What happens if an AI system repeatedly presents incomplete or outdated guidance as authoritative?

What if it overlooks a policy exception, an updated delegation or another requirement that changes the answer?

The consequences may no longer be limited to one employee misunderstanding a document.

Incorrect guidance could potentially be repeated across hundreds or thousands of employees making operational decisions.

Of course, well-governed AI also offers the opportunity to reduce inconsistency and improve access to accurate information.

But that depends on the quality and governance of what sits underneath it.

AI doesn’t just make organisational knowledge more accessible. It can also distribute the same misunderstanding at scale.

The problem may not be the AI

Much of the conversation about AI accuracy focuses on hallucinations — occasions when AI generates information that is incorrect or unsupported.

This is a legitimate concern.

But there’s another problem that deserves just as much attention.

What if the information the AI is drawing from is itself inconsistent?

Large organisations accumulate substantial volumes of documentation over time.

Policies are updated. Responsibilities change. Procedures are revised. Regulatory requirements evolve. New operating models are introduced.

And those changes don’t always flow consistently through every document, business unit and operational process.

One procedure may reference a delegation that has changed.

Two business units may have different instructions for activities that should be governed consistently.

An older policy may remain accessible after a newer version has been approved.

A local work instruction may reflect an established practice that no longer aligns with the organisation’s current requirements.

These inconsistencies can exist long before AI enters the picture.

AI can make the information easier to find and consume, but improved access doesn’t automatically resolve the underlying problems.

In fact, it raises an uncomfortable possibility.

We may be making it easier for employees to act on organisational information without first establishing whether that information is aligned.

The problem isn’t necessarily that the AI has misunderstood the organisation.

It may be that the organisation hasn’t fully reconciled its own requirements.

Why a citation isn’t enough

One of the important advances in enterprise AI is its ability to ground responses in organisational information and provide references to supporting sources.

That makes answers more transparent and easier to verify.

But a citation establishes where information came from. It doesn’t necessarily establish that the information is complete or authoritative.

A referenced policy might be accurate but not applicable to the employee’s situation.

A procedure might be current but subject to an exception documented elsewhere.

Two approved documents might contain requirements that became inconsistent following a change in regulation or organisational responsibility.

And a cited answer may not reveal a relevant requirement that was never retrieved.

For employees, that creates a difficult situation.

They have been given an answer that looks credible, perhaps with supporting references, but they may not know which other policies, controls or requirements should have been considered.

This is particularly challenging in environments where decisions are governed by multiple interconnected obligations.

Banking is an obvious example, but the issue is equally relevant to government, insurance, utilities, infrastructure and other operationally complex sectors.

The challenge isn’t simply whether AI can explain what a document says.

It’s whether the organisation has established the broader context needed to determine how that information should be applied.

Policies don’t operate in isolation

An organisational policy rarely tells the complete story.

Its requirements may depend on legislation, regulation, delegations, operational procedures, controls and other internal policies.

An employee’s authority to make a decision might be determined by several of these requirements operating together.

Changing one can have consequences for others.

A new regulatory obligation may require a policy amendment.

That amendment may affect operational procedures, approval authorities, employee instructions and reporting arrangements.

If those related materials aren’t updated consistently, employees may receive conflicting guidance.

Yet in many organisations, this information is maintained across separate repositories, teams and systems.

Individual documents may be managed effectively without the relationships between them being clearly understood.

That is where the challenge becomes more significant.

Organisations need to understand not just what each document says, but how its requirements connect with everything else.

Without that understanding, even sophisticated AI systems may be working from an incomplete picture of the organisation’s operating requirements.

Trust needs to be designed into the information environment

So what does it take to provide trustworthy AI-generated guidance?

The starting point is recognising that accuracy cannot rest entirely on the AI model.

It also depends on the quality, authority, relationships and governance of the information being used.

Organisations need to establish which documents are approved and current.

They need processes for identifying conflicting requirements and determining which take precedence.

They need to understand how policies connect to procedures, delegations and controls.

They need to recognise what else may be affected when a requirement changes.

And they need clear accountability for reviewing and resolving ambiguity.

AI systems themselves also require appropriate safeguards: testing against realistic scenarios, traceable sources, monitoring, clear communication of uncertainty and escalation pathways when questions cannot safely be answered.

A system should be capable of acknowledging when available information is insufficient or conflicting, rather than forcing a definitive answer.

None of these measures guarantees that every answer will be correct.

But together, they create a stronger foundation for using AI responsibly in operational environments.

Importantly, accountability doesn’t disappear simply because technology has produced the guidance.

Organisations remain responsible for the decisions made within their operations and the controls governing how those decisions are supported.

Human judgement remains essential, particularly when requirements are ambiguous, circumstances are unusual or decisions carry significant consequences.

From accessing information to understanding the organisation

The first major advance in enterprise knowledge was making information digital and accessible.

AI has introduced another: making that information easier to interrogate through natural language.

Both are valuable.

But as AI becomes more deeply embedded in operational decision-making, organisations need to consider what comes next.

Can they identify when policies contradict each other?

Can they understand the dependencies between requirements?

Can they recognise when an organisational change affects existing guidance?

Can they distinguish between information that is merely relevant and information that is authoritative for a particular decision?

And can they give employees visibility into uncertainty, rather than presenting every question as though it has a straightforward answer?

These questions point to a broader opportunity.

Not simply to make organisational information easier to retrieve, but to improve the organisation’s understanding of how its requirements connect and whether they remain aligned.

This is not about replacing experienced people with technology.

It’s about giving people better information, clearer context and greater confidence in the decisions they’re responsible for making.

The next challenge for enterprise AI

The ability to ask a question and receive an immediate answer is changing expectations about how employees access information.

That progress should be welcomed.

But in complex organisations, the value of an answer depends on more than how quickly it’s delivered or how confidently it’s expressed.

It depends on whether the answer reflects the organisation’s actual requirements.

Whether related obligations have been considered.

Whether the information is current.

Whether inconsistencies have been identified.

And whether someone is accountable for resolving the issues that technology cannot.

As organisations invest in making AI more capable, they should be asking an equally important question about the information those systems rely on.

Are we making our organisational knowledge more trustworthy, or simply making it easier to access?

Because the next challenge for enterprise AI isn’t just finding answers.

It’s establishing whether those answers can be trusted.

References

• ASIC, Federal Court orders $250 million combined penalties against ANZ, 19 December 2025.
• ASIC, Federal Court orders Westpac to pay $26 million penalty for hardship failures, 27 May 2026.
• APRA, Prudential Standard CPS 230 — Operational Risk Management, version in force from 1 July 2026.
• Microsoft, Microsoft 365 Copilot documentation and guidance.