When Every Team Has an AI Agent, What Happens to GRC?

THE AI GRC DESK

Practical AI for GRC practitioners. Using AI, governing AI Responsibly, and Engineering better GRC

AI IN GRC · FUTURE OF GRC

Hello Hello,

Are we preparing for the future of GRC, or are we preparing for a version of the organisation that may no longer exist?

We've been thinking about this question a lot lately.

Think about how electricity, the internet and cloud computing fundamentally changed how we live, work and interact. They didn't simply make existing tasks faster. They changed how organisations operated, the skills people needed, and the kinds of jobs that existed.

I believe AI, particularly autonomous AI agents, could bring about a similar transformation. And I wonder whether we're spending enough time thinking about what that means for the future of Governance, Risk and Compliance.

In Security, we often talk about People, Processes and Technology. We're already exploring how AI can transform processes and technology. But have we really considered what happens to the people?

Much of the conversation centres around whether AI will replace jobs, reshape them or create entirely new ones. These are legitimate concerns. But beyond the jobs that might disappear, what happens to the people who remain? How will their responsibilities evolve? How will teams interact? And what entirely new roles might emerge that we haven't even imagined yet?

And if that happens, the skills, workflows and responsibilities of GRC professionals will need to evolve too.

Let's run a thought experiment. It's 2031 or even sooner.

Imagine an organisation where HR, Legal, Procurement, Finance, Engineering and Security all have AI agents. Some agents retrieve information and prepare recommendations. Others execute approved workflows, update systems, coordinate tasks and interact with other agents. GRC has its own agents too.

Now imagine the organisation is onboarding a new technology supplier.

A Procurement agent gathers supplier information and initiates the onboarding workflow. A Security agent reviews technical requirements and retrieves relevant assurance evidence. A Legal agent identifies contractual obligations that require attention.

A GRC agent receives information from these systems, maps it against the organisation's control requirements, identifies potential risks and prepares an assessment for review. All of this happens through approved connections and defined permissions, without someone manually emailing documents between departments.

The GRC professional receives a structured assessment, supporting evidence, unresolved questions and any exceptions requiring a decision. That is a very different way of working from the GRC processes many of us operate today.

Of course, this is a hypothetical scenario, not a prediction that every organisation will work this way. But it raises some interesting questions.

Today, much of our governance model is built around people, teams, applications and third parties. We define responsibilities, access permissions, approval authorities and control ownership.

But what happens when AI agents become active participants in business workflows? Will we need new ways to establish trust boundaries and govern interactions between departmental agents? Will our understanding of insider risk need to expand to include non-human identities operating with privileged access and delegated authority?

And how do we maintain accountability when a decision or action involves several agents operating across different systems? These are not simply technical questions. They are governance questions.

An agent may have permission to retrieve information without having authority to approve a decision. Another may be authorised to update a record but not to commit the organisation to a contractual obligation.

Access is not the same as authority. And automated execution does not remove human accountability.

This is the part I find most interesting.

Imagine starting your working day not by chasing risk owners for updates, collecting screenshots or preparing another spreadsheet.

In that environment, the GRC professional may spend less time moving information between people and more time designing, challenging and assuring the systems through which governance happens.

I don't think that means people stop being important. Quite the opposite. The conversations that require judgement, challenge, negotiation, risk ownership and accountability may become even more valuable.

One way I've been thinking about this is through three forms of interaction.

1. Human ↔ Human
GRC practitioners working with leaders, risk owners, engineers and control owners to understand business context, challenge assumptions and make informed decisions.

2. Human ↔ AI Agent
People reviewing automated assessments, approving consequential actions, investigating exceptions and checking that agents are operating within their intended boundaries.

3. AI Agent ↔ AI Agent
Agents exchanging evidence, coordinating activities and executing permitted workflows across departmental boundaries.

The question isn't necessarily whether one replaces the others. It's how GRC will govern all three, while ensuring that accountability remains clear.

We may begin to see greater demand for specialisms that combine traditional GRC judgement with engineering, automation and AI assurance.

These aren't predictions of formal job titles. They're examples of responsibilities that could become increasingly important. And perhaps some of these responsibilities will simply become part of what every GRC professional is expected to understand.

How do we develop good GRC professionals if AI performs much of the foundational work through which people traditionally learned the profession?

Think about risk assessments. Many practitioners develop their judgement by reviewing evidence, speaking with stakeholders, understanding control weaknesses, documenting risks and defending their conclusions.

If AI begins doing much of that preparation, how will junior practitioners learn to recognise a weak assessment? How will they know when the evidence is incomplete? How will they develop the confidence to challenge an automated recommendation?

We cannot assume that removing manual work automatically produces better professionals. We will need to be deliberate about how people develop judgement, technical understanding and professional scepticism.

I don't think the answer is that every GRC professional needs to become a software engineer. But I do think we should become more comfortable understanding how systems work, where evidence originates and how automated decisions are made.

These skills build on the foundations of GRC rather than replace them. The objective is still to help organisations make better and safer decisions. What may change is how we deliver that outcome.

Not every organisation will adopt autonomous AI at the same pace, and not every GRC workflow should be automated. Some processes will still require significant human involvement because of their complexity, consequence or need for professional judgement.

But I don't think we should wait until the operating model changes before asking what our profession needs to become. After all, the internet didn't just give us faster communication. It changed the way organisations operated. AI could do the same.

And perhaps the future of GRC isn't simply about doing today's work faster. Perhaps it's about preparing to govern a very different kind of organisation.

I'd genuinely love to hear your perspective.

If you could imagine the GRC professional five years from now, what would their day-to-day responsibilities look like? What new roles do you think could exist?

There are no definitive answers yet. That's what makes this conversation worth having.

ChatGPT is insanely powerful.

But most people waste 90% of its potential by using it like Google.

These 1,000+ proven ChatGPT prompts fix that and help you work 10X faster.

Sign up for Superhuman AI and get:

Claim your free prompts

Princess David Okoro, CISM
Author, The AI GRC Desk
With guest co-author Oghenero Ologide: https://www.linkedin.com/in/ologide-oghenero-a59814114/
Find me on LinkedIn: Princess David Okoro
Subscribe to The AI GRC Desk: aigrcdesk.com/subscribe

The practitioner's guide to AI in GRC. Using it, governing it, and building it responsibly.