Building a 0→1 AI assistant for regulatory compliance
________
The promise of compliance at Dynatrace Perform.
The opportunity
Our enterprise customers kept telling us the same story. Compliance teams stuck in late-night audits, scrambling to pull evidence together for regulators. Stressful, manual, and way too slow. At Dynatrace, we saw a clear opportunity. All the data compliance teams were chasing what already existed in our telemetry. We just weren’t using it that way yet. That insight kicked off Compliance Assistant. Instead of another dashboard, we needed a new app built specifically around this pain.
The timing also made sense. In the Accenture Compliance Risk Study 2024, 54%of respondents said AI and machine learning will improve compliance capabilities. Even more telling, 93% agreed that AI-powered and cloud-based tools reduce human error, cut manual work, and improve efficiency.
The market signals were hard to ignore. Regulations are getting stricter across industries like finance, healthcare, and energy. Compliance requirements are more complex and overlapping, especially for global organizations. Cloud adoption has made IT environments harder to reason about. Teams are pushing toward automation and AI to predict risks and automate audits and reporting. And regulators now expect real-time visibility into compliance status, not point-in-time reports.
All of that pointed to the same conclusion. This was a real problem, for real customers, and we already had the foundation to solve it.
Why now
Regulations like DORA are moving from guidance to enforcement, and the EU AI act close behind. Our largest accounts were asking Dynatrace to give them a unified compliance tool. This would avoid churn and retain those existing customers and turn our existing data advantage into buildable trust.
The market for regulatory compliance management software is projected to:
- Grow from $11.18 billion in 2024 to $12.46 billion in 2025, reflecting a compound annual growth rate CAGR of 11.5%.
- By 2029, it's expected to reach $19 billion, maintaining a CAGR of around 11.1%.
________
What hurt users the most
Users were juggling multiple tools to satisfy DORA, cross-system visibility vanished whenever data left its silo, and incident classification for regulators remained painfully manual.
- Fragmented compliance tooling made it very hard to anchor on a single source of truth.
- Potential critical incidents were hard to identify earlier in the journey.
- Determining whether an incident required regulatory reporting demanded tedious manual judgment and mapping.
- Business stakeholders couldn't quantify the impact on revenue during disruptions, leaving executive conversations without clear numbers.
“to monitor compliance health for our entire business, other than just security events, and have visibility into compliance through a single pane of glass.”
“We need to gain insights into our compliance with these standards and regulations and understand compliance gaps.”
“a better compliance score modelling. Helping us make informed decisions on what needs to be addressed first. This could potentially save us 100 of man hours.”
The promise
We (PM + Eng lead + me) scoped the app around two promises: real-time monitoring with AI automation, and compliance reporting insights that stack quarter to quarter. We were clear about what this app would not be: a cybersecurity solution or an IT vendor-risk management tool.
Understanding the compliance space
My PM and I looked at the competitive landscape together. This was super helpful to understand the upcoming market and the direction.
User journey
Designing the vision
Along with my PM, I designed a vision that can scale for multiple compliance frameworks, eg, DORA, AI Act, GDPR, NIST, etc. Redesigned the concept of business flows to now carry the DORA compliance context by default, out-of-the-box thresholds guide incident classification using Davis AI (Dynatrace's proprietary, causation-based artificial intelligence engine). We tested the concept with signed-up preview customers who were more than excited to give us feedback. A great gut-check moment!
Designing for human in the loop
The concept and iterations
The walkthrough
Tadaaa! Revealing the compliance assistant app. The value is simple: fewer manual hours, clear prioritization, and AI-triggered incident classification with human-in-the-loop as the final decision maker. The human is crucial, as once an incident is classified, it's a tiny 4-hour window to report to the regulatory authorities. Also, guiding users onto the app for the first time is critical to reduce drop-offs given this ausience is new to Dynatrace and the compliance space.
Proof of momentum
After releasing the preview to customers, the sales team reported that they were able to retain 4 large enterprise accounts due to renewal and avoid churn or doubts. We also saw an increase in preview signups- from an initial 15 to 27 customers, 12 brand new customers for the free trial in just 4 weeks after the launch of the preview! 🚀
Where the app is headed
The team is excited for what's next. We are currently adding more compliance frameworks such as the AI Act, APRA, GDPR while also for growth experiments to rapidly increase adoption and usage. This enables us to deliver value to more industries that Dynatrace caters to and meet our internal goals.
_________
Business Observability team in costumes on Carnival/Faschingdienstag.
Carnival/Faschingdienstag celebrations at the Dynatrace Vienna office.