I posted a job ad for a product co-founder at Sinope. The role was aimed at a GRC professional with ISO 27001 experience, someone who could help us build a product that gives the right compliance outcomes. Within a day, I had responses. I also had a fierce public thread with a consultant who took it as a personal challenge. He kept engaging, which kept my post visible, so I appreciated it either way.
But the argument underneath the argument was the interesting part. His position, like most consultants who have pushed back on what we are building, rested on a version of AI that does not match what we are actually building. The assumption was: AI is ChatGPT. ChatGPT makes things up. Therefore AI cannot do compliance work.
That framing is so far off that it is almost not worth correcting. Almost.
The Body of Knowledge Is Not as Rare as Consultants Think
GRC expertise is not mystical. It is a body of knowledge that has been taught, absorbed, and applied consistently across tens of thousands of practitioners, possibly hundreds of thousands. Auditors and consultants somewhat agree on the standards. They agree on how controls are evaluated. They agree on what good evidence looks like. If that body of knowledge were truly personal, truly non-transferable, it could not possibly replicate itself across that many people at that kind of scale.
What actually happens is that practitioners learn from public certification guidelines, shared frameworks, and on-the-job exposure to how standards get interpreted. The knowledge is standardized enough to be taught. Which means it is standardized enough to be encoded.
At Sinope, the architecture we are building is not RAG over a PDF. It is agentic data stores tied to models, closer to something you might call an LLM Wiki, trained on the same foundational knowledge a GRC consultant would absorb during their training. Public standards, certification frameworks, the reasoning patterns that underpin how auditors evaluate controls. Strip out everything irrelevant, everything that has nothing to do with how a policy is assessed or how evidence is structured, and focus the model's reasoning entirely on the audit domain. A small, fine-tuned model built this way can be more capable and more compute-efficient than a general-purpose model prompted by someone who does not fully understand what they are asking.
The consultants who dismiss this have not built systems like this. That is not a dig; it is just true. If your only reference point for AI is a chatbot you use for drafting emails, you are going to underestimate what a purpose-built agent actually looks like.
Human Interpretation Drift Is the Same Risk as Hallucination
This is the part I do not think gets said enough. Standards are not really standard. They are open to interpretation by the person applying them and the person auditing them. Two consultants can read the same control requirement and land in genuinely different places. That drift compounds over time, across firms, across audits. The body of knowledge is consistent in theory. In practice, it bends with whoever is holding it.
The industry treats this as normal. It treats AI hallucination as disqualifying. But these are the same category of risk: an interpreter producing an output that diverges from the intended meaning of a standard. One happens because of individual bias and knowledge gaps. The other happens because of a lack of targeted training and reasoning structure. Both can be mitigated. Neither is automatically safer than the other just because one is human.
And here is the other thing: a well-trained agent can hold far more of the standards body in its working memory than any individual human can. A consultant draws on what they have personally encountered. Their reasoning is shaped by the cases they have seen, the audits they have run, the interpretations they have absorbed from whoever trained them. An agent trained on the full scope of the standards does not have that constraint. It does not forget, does not fatigue, does not subtly reweight a control because it reminds it of a different client from three years ago.
This is not a claim that agents replace the human in the loop. At Sinope, we are not sending agent output straight to an auditor. Someone reads it first. The human moves from doing the grunt work to checking the output. That is a meaningful shift in where skill and time get applied, not an elimination of judgment.
Where We Are Honest About This
The hypothesis here is exactly that: a hypothesis. We have not proven that a fine-tuned, audit-domain agent outperforms a consultant using a general-purpose model. What we have is a well-reasoned basis for believing it is true, a technical architecture built around that belief, and a clear sense of what we are setting out to demonstrate.
The argument is not "trust us, AI is better." The argument is: if you are benchmarking AI against your own expertise, and your benchmark for AI is a tool that was not built for this domain, you are not running a fair comparison. You are comparing a general tool to a specialized one and calling the general tool the category.
We are building the specialized one. And we are aiming to prove it.