Topic starter
10/07/2026 9:19 pm
TL;DR: AI is turning trust into a continuous operating state, not a point-in-time control, according to Drata's podcast recap, with episodes covering continuous compliance, third-party AI risk, deepfakes, and governance metrics across six conversations with CISOs and GRC leaders. The governance model is shifting from annual review cycles to live evidence, measurable trust signals, and tighter oversight of vendor and agent behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “When Trust Meets AI: Spring 2026 Recapped”.
Key questions
Q: What breaks when AI trust is managed with annual GRC reviews?
A: Annual reviews break down because they assume the control environment stays stable long enough to certify.
Q: When should organisations treat a vendor AI feature change as a governance event?
A: Whenever the feature changes data access, decision support, or the approval path for a business process, it should be treated as a governance event.
Q: How do organisations measure whether continuous trust is actually working?
A: Measure the time between a control change and its appearance in governance reporting, the percentage of evidence that is current, and the speed at which exceptions are closed.
Practitioner guidance
- Implement continuous control monitoring for AI-linked workflows Track evidence on an ongoing basis for the controls that AI features can alter, including approvals, access paths, and data use.
- Reassess third-party AI risk when vendor capabilities change Trigger a fresh governance review when a supplier adds AI functionality, changes model behaviour, or introduces new decision support into an existing service.
- Define trust metrics that leadership can use Use measures such as review cycle time, escalation rate, and the share of security decisions resolved without manual bottlenecks to show whether controls are enabling the business while preserving assurance.
Bottom line: AI has pushed trust out of the audit calendar and into day-to-day control operations, where static evidence is quickly out of date.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Continuous assurance is becoming the new control plane for AI governance. Annual review cycles were built for environments that changed slowly enough to document after the fact. AI-driven systems, especially those touching identity, vendor workflows, or automated decisions, now change too quickly for that model to hold. The practical conclusion is that governance must shift from retrospective approval to live evidence and continuous monitoring.
A question worth separating out:
Q: Why are deepfakes a GRC issue as well as a fraud issue?
A: Deepfakes matter to GRC because they can defeat the human checkpoints that many approval and verification workflows still rely on. That makes impersonation a control problem, not just a scam problem. Organisations need stronger identity verification for sensitive actions, and they need governance that assumes voice and video can no longer be trusted on their own.
👉 Read our full editorial: AI trust is becoming a continuous GRC control problem