AI Can (Mostly) Solve Cyber Regulatory Harmonization and Efficiency

With the proliferation of advanced artificial intelligence (AI) capabilities for cyber offense and defense, it has never been more important for cyber regulations to avoid slowing down security teams and wasting their time and resources. Industry and policymakers have long advocated for regulatory harmonization and should continue to push for smarter regulations that actually reduce cyber risk.

Yet it has never been less important to ensure those regulations are harmonized.

AI can reduce the “harmonization tax,” the cost of addressing compliance tasks that can overwhelm companies for little actual improvement in security or reduced risk. This harmonization tax is usually imposed by the “DC-MOB,” regulations that are duplicative, conflicting, misaligned, overly detailed, or burdensome.

AI will minimize much of the DC-MOB, particularly regulations that are duplicative or burdensome. Most of these benefits do not rely on high-end agentic AI from frontier models; simpler agents and large language models (LLMs) will be more than enough.

Regulators and the White House should avoid the bureaucratic stress and political capital needed to eliminate duplicative and burdensome regulations, since AI can meaningfully share the cognitive and box-checking workload demanded by regulators. Instead, they must ensure that regulations do not conflict with one another, a problem no amount of AI can resolve; that regulations meaningfully enhance security; and that future regulations are as AI-friendly as possible, encouraging its use to streamline compliance.

For their part, regulated entities must embrace AI-driven governance, risk, and compliance (GRC) strategies.

This article examines the harmonization tax, five complaints about compliance and controls, the role of AI, and recommendations for policymakers.

Sacrificing Security for Compliance: The “Harmonization Tax”

The Trump administration’s 2026 Cyber Strategy states that “[c]yber defense should not be reduced to a costly checklist that delays preparedness, action, and response.” However, countless federal efforts to address the challenge of regulatory harmonization have stalled. Disharmony and inefficiencies prevail as they always have, reducing regulation’s strengths to uplift security in key sectors. As one cyber industry leader bluntly told the Government Accountability Office (GAO), “We are spending money on compliance that would better be spent on cybersecurity.”

Call this the harmonization tax: the hours and dollars (and yen, pounds, and euros) that cybersecurity professionals spend not on defense but on administrative translation between regulatory regimes. This tax redirects time and capital that could be spent on bolstering cybersecurity, such as information technology (IT) upgrades, to compliance efforts, such as copying, pasting, and reformatting the exact same incident data into multiple distinct government portals.

In July, a GAO report found that seven out of 10 federal cybersecurity regulations mandate the same reporting requirements as another regulation, and that a financial institution may be subject to as many as 15 separate incident-reporting regulations, often supplying the same information to each. Earlier that same month, the Pentagon suspended its Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements for imposing “significant and often prohibitive burdens” on the defense industrial base.

Inefficiency and the lack of harmonization across federal requirements impose costs on firms without improving security outcomes. The World Economic Forum’s 2026 Global Cybersecurity Outlook identifies regulatory compliance and governance complexity as one of the leading obstacles CEOs cite to becoming cyber resilient. In submissions to the Office of the National Cyber Director (ONCD), the financial sector commentators reported that senior cyber leaders spend 30 to 50 percent of their time on regulatory compliance and that large firms may spend up to 40 percent of their cybersecurity budgets submitting compliance reports. Security teams in finance spend more than 70 percent of their hours on compliance tasks rather than on cyber defense, according to the Bank Policy Institute.

Reducing the “harmonization tax” is a key challenge for regulators and security teams, but fortunately, AI is well suited to help.

Beware the DC-MOB

The harmonization tax is driven by five distinct problems that together form the DC-MOB.

Duplicative. These regulations occur when multiple agencies require identical or heavily overlapping requirements, reporting mandates, or rules. According to a Department of Homeland Security report in 2023, there were “13 separate forms and 10 websites in use by the Federal Government for incident reporting. Of the 22 Federal agencies with current cyber incident reporting requirements, only three recognize or accept another agency’s form.”

Conflicting. Some regulations contradict one another outright. The classic example is end-to-end encryption. It is heavily encouraged by the European Union’s General Data Protection Regulation. But national security laws like the United Kingdom's Investigatory Powers Act or Australia's Telecommunications and Other Legislation Amendment effectively forbid it so that law enforcement can access plain-text communications.

U.S. firms, according to a recent GAO report, might face a legal standoff, with the Securities and Exchange Commission mandating disclosure of an event, but suspicious activity reports or confidentiality rules mandating silence. Information could be released that other agencies insist should stay confidential. For smaller health care practices with limited compliance staff, “the mere confusion and concern over potential conflict can lead to delays in meeting reporting timelines even if no actual conflict exists.”

Misaligned. Regulations frequently use different definitions or demand different controls or responses in similar circumstances. The 2023 Homeland Security report noted there are misaligned triggers for reporting to a regulator, from as major as a “substantial loss” or “serious impact” (Cyber Incident Reporting for Critical Infrastructure Act, Section 2242), to merely an incident which “is reasonably likely to jeopardize, disrupt or otherwise impact, the integrity, confidentiality, or availability of computers” (Transportation Security Administration, Security Directive 1582-21-01) or might “affect the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support” (Department of Defense, DFARS 252.204-7012).

As the GAO found, this misalignment leads to “multiple [competing] legal analyses and inconsistent public messaging about the same cybersecurity event.”

Overly detailed. These regulations are often too prescriptive with little risk reduction. The original Transportation Security Administration pipeline regulation specified that, “for patches and updates that are listed on CISA’s Known Exploited Vulnerabilities Catalog … and have a [severity score] of ‘Critical’ … the patch/update must be installed within 15 days of its availability. … All other updates and patches must be installed within 30 days of availability.” That is far more detailed than a similar regulation from the Pentagon, which simply called on entities to “Identify, report, and correct information and information system flaws in a timely manner.”

Burdensome. The Department of Health and Human Services (HHS) has proposed a new security rule for covered health care systems to build and annually refresh an asset inventory and a network map of protected health information, scan for vulnerabilities twice yearly, and conduct annual penetration tests and self-audits. More than 100 hospital systems and provider associations have since asked HHS to withdraw the rule, warning of the cost to rural providers "that already operate on narrow, if not negative, financial margins."

Where AI Can Help and Where it Cannot

AI-driven GRC can reduce the harmonization tax for four of the five DC-MOB problems—the duplicative, misaligned, overly detailed, and burdensome—without any new legislation or policy. Since AI will make these problems far more manageable, government harmonization efforts should invest little in trying to solve them.

There are, of course, limitations. AI can do little to nothing to minimize the impact of conflicting regulations, when one regulator “thou shalts” and another “thou shalt nots.” These require policy, legal, or legislative fixes.

Nor can AI help if overly detailed regulations force bad decisions. For example, well-governed cybersecurity programs can decide themselves which vulnerabilities to patch, and when. Regulations that dictate patching timelines for routine vulnerabilities misdirect resources best used to reduce more critical risks. And it does not meaningfully advance security to have an AI fill out compliance checklists or create a complete system security plan (SSP), which is then likely scanned by another government AI.

And some AI-driven compliance comes with higher costs. Continuous offensive testing requires high-end agentic systems, since defenders need to use systems as advanced as those by attackers.

Some enterprise-grade ​​AI compliance software costs reach into the millions of dollars per year, potentially favoring larger incumbents who can absorb the cost. If the harmonization tax becomes an “AI tax,” smaller and mid-sized firms, and particularly rural health care providers like the hospital systems fighting the new HHS rule, may struggle to afford licensing, integration, and governance of these systems.

Of course, AI agents cannot help navigate regulations that are genuinely in conflict with one another. Humans are still required to make those risk-based decisions and present them to regulators.

These limitations are important, but small compared to what AI can deliver. Cybersecurity and compliance are already complex and expensive, while AI can be comparatively cheap. Relatively low-end LLMs and agents can automate complex tasks now done by humans. They can read a company’s existing policies and assess them against the many different frameworks (like SOC 2, ISO 27001, and NIST CSF). Long, repetitive security questionnaires can be drafted by basic LLMs from prior answers, prompts, and organizational documents and data. The expensive, bleeding edge of the frontier is not needed.

The result is that even the smaller hospitals worried about the HHS rule may be able to have a compliance team that only larger companies could usually afford.

Next is the benefit to policymaking. Fixing duplicative requirements need no longer be a policy priority. Simple LLM tools can ingest multiple regulatory frameworks simultaneously and map overlapping controls to produce a single compliance output. Reports are demanded on different timelines by eight different regulators? 10? 120? LLMs can handle that scale.

As one industry participant told the GAO, “The objective should be one report that satisfies multiple federal requirements where information is [substantially] the same.” That problem can be solved with a series of government meetings, overseen by the White House, to align requirements. Or it can be solved with an LLM filling out the various forms, overseen by a few responsible managers. The burden is not zero, but an AI-driven GRC process means it should no longer be a policy priority.

Third, agentic AI systems can increasingly act on their own to ingest regulatory text, cross-reference it against a company’s own systems and controls, and navigate duplicative, misaligned, or overly detailed regulatory frameworks. Agents can also generate the required documentation while continuously monitoring a company’s systems to meet demanding reporting deadlines.

Some government initiatives are leading the way. The Open Security Controls Assessment Language (OSCAL) lets systems express their controls and assessment results in a form that software can read and generate. Under its Consolidated 2026 Rules, FedRAMP has moved away from its traditional, narrative-heavy guidance documents toward concise, declarative, and machine-readable formats. These changes will increase clarity and predictability of requirements for cloud service providers seeking to work with the federal government. The FedRAMP 20x program further emphasizes continuous evidence, automated validation, and machine-readable monitoring and reporting. Previously, cloud providers had to submit system security plans, which could extend to over 800 pages, requiring over a dozen mandatory appendices that must be submitted in full. None were optional. AI will make it much easier to test, evaluate, and monitor these key security indicators when what once took weeks of staff time becomes automated output.

AI’s accuracy is a risk that could land companies in legal trouble. However, misaligned judgments and hallucinations are less of a risk when an AI operates on a company's own enterprise data, with ground truth about its own systems, controls, and configurations. Regulated entities must keep a keen management focus on confirmation and accuracy, but these issues and mitigations may be little different than for overseeing humans.

Spectrum of AI-Friendly Regulation

This article has limited itself to one subset of the issue of how AI can affect cyber regulation, the impact on the DC-MOB. However, it is worth noting that every cyber regulation sits somewhere on a spectrum of AI friendliness, from total prohibition to outright mandate. The spectrum can be viewed as follows:

1. AI Forbidden: Regulation explicitly restricts any use of AI.
2. AI Discouraged or Limited: No explicit prohibition, and AI assistance may be permissible, but outputs require more active human oversight.
3. AI Neutral: AI is neither encouraged nor discouraged.
4. AI Encouraged: Regulator accepts or prefers use of AI, such as automated, machine-readable outputs.
5. AI Required: Regulation actively mandates AI, such as automated or continuous monitoring tools. Human-only compliance is insufficient.

Policymakers may impose limited restrictions on specific foreign or adversarial models in national security contexts. But unlike professors banning all AI in the classrooms, there should be few, if any, cyber regulations with blanket restrictions on the use of AI. Likewise, at the other end of the spectrum, there should be almost no mandates for the complete and total use of AI.

To reduce the harmonization tax, cyber regulators need to shift toward “AI encouraged,” removing headwinds that might limit entities' ability to use AI and provide easy paths for them to do so. As a concrete example, many regulations have reasonably mandated an annual penetration test to simulate hackers trying to bypass defenses, though the state of the art has become AI-driven continuous offensive testing. Regulations must increasingly not just allow such continuous validation but, in time, mandate them for organizations with the requisite resources and capacity. In the longer term, or for particularly high-tech or well-governed jurisdictions, regulation could become almost fully agentic, fully automating every aspect of compliance and supervision.

Steering Toward AI-Native Cyber Regulation

AI can enable regulators and firms to measure defensibility rather than count checkboxes, while also giving security teams the time and resources they need to bolster defenses and resilience.

First, the ONCD should ensure that every new regulation is AI-friendly and coordinated to limit the DC-MOB. For regulations that already exist, regulators should not devote time and scarce political capital to reduce disharmonies that AI will resolve on its own and spend it instead on the conflicting regulations that only policymakers can fix. A cyber regulation strategy, subordinate to the existing national cyber strategy, could institutionalize these approaches.

The ONCD would be even more empowered to make these changes if Congress passed the Streamlining Federal Cybersecurity Regulations Act, introduced by Sens. James Lankford (R-Okla.) and Gary Peters (D-Mich.). The bill would establish an interagency Harmonization Committee at the ONCD.

Second, agencies should not wait for legislation to adopt AI themselves. For instance, agencies should adjust or build AI-friendly frameworks to enable regulators to process and verify AI-compliant reporting. Regulators can publish new rules in API-consumable formats alongside traditional text so that regulated entities can utilize their own AI systems to meet GRC obligations. FedRAMP’s 2026 effort to replace long, narrative SSPs with machine-readable code and persistently validated records is a promising sign.

Third, regulators should consider requiring audit trails for AI compliance tools themselves, so that entities can verify how an AI system reached a determination and intervene when needed.

Finally, where regulators ban AI for a compliance task, they should have to justify the ban. They should also identify regulatory areas that truly require a human in the loop and those that could be handled more effectively by AI.

Once regulators allow AI to absorb much of the effects of the DC-MOB, policymakers can renew their focus on the conflicting regulations that software cannot resolve. Reducing those barriers will enable firms to dedicate more of their efforts toward securing their systems.