Topic starter
22/07/2026 4:36 pm
TL;DR: AI adoption in GRC is outpacing governance models: Drata’s survey of 300 U.S. IT and security professionals found 43% say AI made their jobs harder, 90% report at least some AI investments fell short of expectations, and 71% say an AI tool used for GRC caused a failed audit or lapsed standard. The real issue is not AI breadth, but governed scope, visibility, and accountable outcomes.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The State of GRC in the Age of AI: What We Learned From 300 IT and Security Professionals”.
By the numbers:
- 43% of professionals said AI was expected to simplify their work, but the tools they are using have made their jobs more difficult.
- Only 13% of IT and security professionals are fully confident they can see every AI tool their employees use.
Key questions
Q: What breaks when AI is used in GRC without clear inventory and ownership?
A: The control breaks at the point where the organisation cannot prove which AI system produced an output, who approved it, or whether the evidence path was defensible.
Q: Why do AI tools create more risk in GRC when visibility is incomplete?
A: Because GRC depends on traceable evidence, clear ownership, and consistent review.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define AI system inventory for GRC workflows Map every AI-assisted compliance, risk, and evidence workflow to an owner, data source, and approval path, including embedded features inside other platforms.
- Assign outcome ownership to each AI-assisted process Document who is accountable when an AI-generated control assessment, policy recommendation, or audit artefact is challenged.
- Require evidence lineage for AI-generated outputs Record the model, prompt, source data, review step, and final approver for each artefact that may enter an audit trail.
Bottom line: AI in GRC is becoming harder to govern because adoption is outpacing inventory, ownership, and review discipline.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
22/07/2026 4:41 pm
Visibility is the first control plane, not a reporting convenience. If teams cannot see every AI system touching GRC work, they cannot govern scope, evidence, or responsibility. That makes the problem closer to shadow IT than to ordinary automation adoption, and it explains why audit readiness degrades even when tools appear to be productive. Practitioners should treat AI inventory as a prerequisite control, not a post-deployment clean-up task.
A question worth separating out:
Q: Should organisations prioritise targeted AI agents over broad platforms for GRC?
A: Often yes, when the goal is audit defensibility rather than generic automation. Narrow agents are easier to bound, test, and assign to one accountable outcome, while broad platforms can blur ownership and make evidence review less reliable.
👉 Read our full editorial: AI in GRC is widening the visibility and accountability gap
This post was modified 2 hours ago by NHI Mgmt Group