The promise of AI lies in its ability to tackle the rote, mundane tasks associated with some jobs, so employees can spend more time on higher-level activities, rather than being stuck in the drudgery. But what if one of those rote, mundane tasks were completing mandatory compliance training?
In controlled testing, compliance training platform Ethena found that ChatGPT’s new agent tool completed compliance training content without any human intervention and was able to mimic real-interaction with the module and avoid detection.
“We believe at this stage it’s fairly nascent, that is, based on everything we’re seeing and hearing and understanding in the space,” said Ethena’s VP of marketing, Chris Vandermarel. “We think it’s unlikely that a lot of employees are doing this at this point in time, but as the technology matures, as the knowledge gets shared, as one colleague whispers to another colleague…We think this is one of those things that’s nascent today, but could change very quickly.”
When ChatGPT released its “agent mode” in July, Ethena’s engineers began thinking about its different use cases and understanding how it might apply to the compliance training space, according to Vandermarel, including the potential for more nefarious uses, such as the possibility of using the tool to complete a compliance training. The company tested several vendors, including Ethena, and concluded that the problem was “widespread” across the platforms.
“[We] very quickly discovered, wow, this tool is so good at mimicking human behavior, that it just does it all flawlessly,” he said.
The discovery raises issues for HR leaders too. Soon, companies and compliance pros may not be able to fully trust that training courses were actually completed by a human. Compliance and legal requirements mandated by federal, state, and local governments, or those mandated by the court or via a legal settlement, could be at risk of true compliance. Enforcement efforts and company policy might also require updating.
“It’s a very, very simple prompt, which is part of what makes this story so wild, because people skipping mandatory training is not a new concept. This is something that people have been doing for a long time,” Vandermarel said, adding that the ubiquitousness of the ChatGPT tool and AI agents more generally could prove a big risk for compliance teams.
Quick-to-read HR news & insights
From recruiting and retention to company culture and the latest in HR tech, HR Brew delivers up-to-date industry news and tips to help HR pros stay nimble in today’s fast-changing business environment.
What’s HR to do? Ethena’s own CPO, Melanie Naranjo, told HR Brew that it could be time to reassess the value of compliance training to employees, and make sure an engaging, up-to-date training with real-world scenarios and situations that employees might actually encounter is delivered.
“From an HR perspective, what really comes to mind for me is that the fact that it’s so easy and that there are so few barriers to making it happen risks it becoming more normalized and feeling less like you’re breaking the rules,” she said.
HR teams can also offer test-out options for employees, work on building leaders’ to model behavior and demonstrate the value of trainings, and monitor training data and analytics to be on the lookout for unusual activity. If everyone in a department completed the training in the exact same amount of time, that’s worth a bit of sniffing around.
But Vandermarel pointed out that AI systems are evolving much faster than prevention methods and vendors, so simply fighting fire with fire—using AI tools to monitor and prevent this activity—probably will not succeed. It’s a more useful strategy to deliver a compliance training that’s relevant and tailored for them and respects their time and prior knowledge.
“The tech is the surface-level problem,” Naranjo said. “If you’re addressing that and nothing else, then I think what you’re actually missing is a really key opportunity to take this moment in time to take a step back and reflect on what is your actual compliance strategy, and is it effective? If it was effective, you wouldn’t have employees using AI agent mode to take their training. They would actually want to take the training. They would understand the value.”