Notifications
Clear all
Topic starter
11/07/2026 8:32 pm
TL;DR: AI was positioned as foundational to audit readiness, continuous assurance, and trust transparency across security and compliance programmes, according to Drata, with a shift from point-in-time checks to always-on trust signals. The practical issue is not whether AI belongs in GRC, but whether teams can govern its use without weakening accountability or evidence quality.
NHIMG editorial — based on content published by Drata: Drataverse 2025 recap on AI, continuous assurance, and trust
Questions worth separating out
Q: How should teams govern AI in continuous assurance workflows?
A: Teams should constrain AI to low-risk drafting, routing, and summarisation tasks unless a human remains accountable for the final decision.
Q: Why do continuous assurance programmes depend on identity governance?
A: Because continuous assurance only works when the organisation can prove who approved what, who changed evidence, and who can override exceptions.
Q: What do security teams get wrong about agentic AI in GRC?
A: They often treat agentic AI as a productivity feature rather than a delegated authority model.
Practitioner guidance
- Define AI decision boundaries in GRC workflows Map where AI can draft, classify, and route work, and where a human must approve, attest, or close the loop.
- Review privileged access in evidence and trust tooling Check who can modify trust centres, evidence repositories, exception queues, and control mappings.
- Measure evidence freshness as an operational metric Track how long it takes for a control change, exception, or remediation to appear in the reporting layer.
What's in the full article
Drata's full article covers the event detail this post intentionally leaves for the source:
- Session-level takeaways from the San Francisco, New York, and London stops that show how the themes differed in practice.
- Product roadmap references to Drata's vendor risk management agent and SafeBase Trust Center work.
- Event atmosphere and speaker commentary that give more context to the trust and AI messaging.
- The specific examples behind the shift from cyclical audits to continuous assurance.
👉 Read Drata’s recap of Drataverse 2025 and its AI trust themes →
AI in GRC: what continuous assurance now means for teams?
Explore further
11/07/2026 9:01 pm
Continuous assurance is becoming a governance requirement, not a messaging layer. Once trust must remain visible at all times, static audit packets stop being enough. That changes how evidence, approvals, and exceptions are managed across the programme, especially where identity data and access decisions sit underneath the GRC stack. Practitioners should treat continuous assurance as an operating discipline, not a presentation problem.
A question worth separating out:
Q: Who is accountable when AI-assisted compliance decisions go wrong?
A: Accountability remains with the business and control owners, not the system that helped assemble the work. If AI drafts an assessment or routes an exception, the human owner must still be able to justify the outcome, evidence, and approval path. Regulatory expectations around accountability, documentation, and control ownership do not disappear because a machine helped produce the record.
👉 Read our full editorial: AI is becoming the baseline for continuous trust in GRC
