Topic starter
01/08/2026 8:58 pm
TL;DR: Point-in-time, paper-based compliance can no longer keep pace with AI-accelerated code, deep software supply chains, and live regulatory scrutiny, according to Veracode. Tim Brown’s SolarWinds experience shows why continuous, evidence-backed control performance matters more than policy statements, and the compliance model now has to operate at machine speed, with auditable trust graphs and deterministic layers over non-deterministic AI systems.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Compliance Stopped Being a Checkbox. Most Companies Haven’t Caught Up.”.
Key questions
A: Without strong oversight, the model can fail at consistency and validation.
Q: Why do AI-driven supply chains create a compliance risk even when policies exist?
A: Policies do not prove that controls are working across live delivery paths.
Q: What are the signs that continuous compliance is failing?
A: Common signs include delayed detection of policy violations, manual scrambling before audits, inconsistent data inventory, and difficulty proving where sensitive data resides or who can access it.
Practitioner guidance
- Implement continuous evidence collection Replace annual screenshot collection with telemetry, signed attestations, and control evidence that refreshes as code, configuration, and dependencies change.
- Map delivery trust relationships Maintain an inventory of build tools, packages, APIs, service accounts, and AI plugins that can influence shipped software, then assign owners and lifecycle controls to each.
- Separate release authority across stages Require independent validation across build stages so no single person or system can alter source, build output, and release approval without detection.
Bottom line: Point-in-time compliance no longer matches the speed or complexity of AI-assisted software delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:05 pm
Continuous compliance is becoming a control problem, not a documentation problem. The article is right to frame annual audits as inadequate for AI-era delivery, because the real risk is control drift between evidence collection points. When code, dependencies, and release decisions move continuously, paper-based proof becomes decoupled from actual risk. Practitioners should treat compliance as live control assurance rather than retrospective recordkeeping.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Which controls matter most when regulators expect live evidence?
A: The most important controls are those that can produce verifiable, repeatable evidence in production, including change control, build integrity, dependency governance, logging, and separation of duties. Regulators and customers now care about demonstrable operation over time, so the question is whether the control can be observed continuously, not whether it appears in a policy.
👉 Read our full editorial: Continuous compliance is replacing paper audits in AI-era security