For twenty years, governance, risk and compliance software has been a system of record. It stored the register, routed the workflow and produced the report. The thinking, the writing and the checking stayed with people — and as regulation multiplied, so did the people needed to keep up.

AI changes that equation. Not by replacing the judgement GRC depends on, but by taking on the groundwork that has always consumed most of a practitioner's week.

1. From recording work to doing it

The first generation of AI in GRC was a chat window beside the register. Useful for questions, but it left the work where it was. The shift now under way is to specialised agents embedded in the work itself: an agent that drafts a risk as cause, event and consequence; one that prepares a control self-assessment from the evidence already linked to it; one that splits a regulator's circular into obligations and maps them to existing controls.

Each of these tasks used to take hours. Reviewing a good draft takes minutes. That difference, repeated across a programme, is what lets a small team carry a large one.

2. From periodic to continuous assurance

Assurance has long been a calendar exercise: quarterly attestations, annual tests, a scramble for evidence before the audit. When agents can read evidence as it arrives — classify it, check it is current, notice that a control's last test failed — assurance stops being an event and becomes a state.

The control owner's role changes accordingly. Instead of filling in a questionnaire from memory, they review what the agent prepared, with every answer citing the evidence behind it, and sign. Where nothing has changed since the last periods they confirmed, an organisation may even let them sign several off together — while anything new is still looked at alone.

3. From frameworks to one control set

Most organisations now answer to several frameworks at once: ISO 27001, SOC 2, national cybersecurity standards, sector rules, privacy law, and soon AI regulation. Mapping each requirement to controls by hand is slow and inconsistent. AI that reads requirements and proposes mappings — with a person approving each one — makes "test once, comply many" practical rather than aspirational.

4. From reading regulation to acting on it

Regulatory change is where lean teams fall furthest behind. AI does not make the obligations lighter, but it makes them visible sooner: what changed, which policies and controls it touches, what is already covered and what needs work. The compliance team decides; the agent makes sure nothing is missed.

5. From trusting the tool to proving it

Here is the part that matters most for regulated organisations: AI in GRC must itself be governed like a control. If an agent prepares the evidence a regulator relies on, the organisation must be able to show exactly what the agent saw, what it produced, which sources it cited, who accepted it — and that the agent is tested against attacks and measured over time.

Guardrails that redact personal data and catch instructions hidden in documents and evidence.
Citations for every suggestion, with anything that cannot be grounded dropped.
An encrypted ledger of every AI action, readable by auditors.
Scorecards per agent — accuracy, citations kept, how often people corrected it — and regular adversarial testing.
A kill switch, budgets, and models that run in your own region on data that is never used for training.

What must not change

Accountability. A risk rating, a control conclusion, a decision to accept a risk — these remain human decisions, made by named people, on the record. The best AI-native GRC platforms are designed so that agents propose and people decide, and so that autonomy is something an organisation switches on for specific repeat scenarios rather than something it discovers after the fact.

The new shape of the GRC team

The GRC team of the next few years will be smaller in headcount and broader in reach. Practitioners will spend their time on judgement, challenge and engagement with the business — the work that always mattered most — while specialised agents handle the drafting, preparing, mapping and reading.

That is the bet we have made with Vigil8: one platform, 50+ specialised agents across every module, a governed AI core, and people firmly in charge.