🤖 GRC Teams Haven't Fully Embraced AI: What Do the Reports Say? 📊

[Semih Asil]

AI Still in Experimentation Phase for GRC​

Nearly half of governance, risk, and compliance (GRC) teams are still experimenting with artificial intelligence (AI). According to a new report, the full integration of AI into workflows is only at 13.5%.

This study, conducted by integrated GRC software provider Onspring, shows that 44.4% of participants indicate that AI is still in an experimental or pilot phase within their organizations. Meanwhile, 25.4% stated that AI is used for specific tasks, and 16.7% reported that AI is not used at all.

The survey, conducted in March and April with the participation of 126 GRC professionals in North America, reveals that AI has not yet achieved widespread operational use in GRC functions. AI is being evaluated, tested, and applied in targeted areas, but most organizations have not fully linked AI to the workflows that define daily GRC execution.

AI Pressure on CIOs Is Increasing 🚀​

Another survey indicates intense pressure on Chief Information Officers (CIOs) regarding AI adoption. According to research by Dataiku/Harris Poll, 71% of CIOs believe their roles are at risk if their companies fail to achieve measurable business gains from AI within the next two years.

62% of CIOs report facing challenges from their CEOs regarding vendor selection. Additionally, 85% of IT leaders say that a lack of traceability and explainability delays or halts AI projects from reaching production or "scale."

Florian Douetteau, CEO of Dataiku, commented, "CIOs are moving from experimentation to responsibility faster than most organizations expect."

Value and Concerns of AI in GRC 🛡️​

According to Onspring, while GRC applications are valuable, it can be difficult to clearly price their value. AI can help in this regard by reducing the manual workload on GRC teams and providing leaders with clearer ways to demonstrate what their programs are achieving.

Among the concerns limiting AI adoption, data privacy (28.6%) and accuracy/hallucinations (25.4%) stand out. Since GRC workflows involve the exchange of sensitive information, organizations need to trust that AI-powered processes will protect this information and support access controls.

GRC teams face particular obstacles in AI adoption because they operate within complex requirements, such as different industry frameworks and intricate compliance environments. This makes management difficult in situations where repetitive tasks are tied to fragmented systems and manual follow-ups.

Survey findings indicate that GRC professionals still spend a significant amount of time on necessary but highly repetitive manual tasks. Evidence collection and documentation were identified as the most time-consuming activities (25.9%), followed by risk assessments (19.8%) and third-party reviews (16.5%).

Approximately 70% of participants stated that AI would have the greatest impact in simplifying repeatable, administrative GRC operations.

Onspring suggests that the near-term value of AI in GRC may come from helping experts perform these repetitive tasks more efficiently. This could include areas such as summarizing information, identifying missing documentation, prioritizing follow-ups, uncovering patterns, or improving routine task flow. The common denominator is time. If AI can reduce the administrative burden of GRC work, experts can devote more time to interpreting findings, assessing risk, and supporting better decisions.

Focus Areas for Effective AI Adoption 🎯​

Onspring identified five focus areas for GRC teams to achieve effective and meaningful AI adoption:

• Reduce Manual Burden: Start with the most time-consuming, repeatable GRC operations (documentation, risk assessments, third-party reviews).
  
• Build Trust: Before expanding AI into workflows, privacy, accuracy, and audit defensibility should shape how AI is introduced, vetted, and scaled.
  
• Connect Systems: If data, tasks, and ownership remain fragmented, the ROI of AI will be limited.
  
• View Third-Party Risk as a Continuous Process: Continuous monitoring, follow-up, and accountability require stronger operational support than just point-in-time surveys.
  
• Measure AI Value with Practical GRC Outcomes: Reduced cycle times, increased efficiency, and improved decision-making can be the strongest early indicators of AI value.