What is AI GRC? Governance, risk and compliance for AI

GRC for AI systems

Governing AI uses the same machinery as any other GRC programme: an inventory, risk assessment, controls, evidence and audit. What changes is the subject. The inventory lists models, agents and third-party AI services. The risk assessment looks past harm to the organisation and adds harm to the people the system affects, such as unfair outcomes. And the controls cover data quality, human oversight, transparency and monitoring of the system after release.

Three documents set the agenda. ISO 42001 is the certifiable management system standard for AI. The EU AI Act classifies systems by risk and puts legal duties on providers and deployers of high-risk systems. The NIST AI Risk Management Framework is a voluntary structure, widely used in the United States, organised in four functions: Govern, Map, Measure and Manage.

AI inside GRC work

The second meaning is AI as a tool for the compliance team. The work suits it: security questionnaires repeat the same questions in different words, frameworks overlap, and evidence has to be read against a control’s wording. AI can draft an answer from existing controls and evidence, suggest which requirements a control satisfies, or point out where a document does not match the control it is filed against.

The risk is the same as anywhere else: a confident answer that is wrong. In compliance that wrong answer can end up in a contract or an audit. The safe pattern is that AI proposes, cites the record it used, and a named person reviews and accepts before anything is sent or changed.

Why the two belong in one programme

An organisation that uses AI in its compliance work is itself running an AI system, and should govern it like one. More practically, AI risks and security risks land on the same register, AI controls reuse the same document control and audit cycle as ISO 27001, and customers ask about both in the same questionnaire. Running AI governance as a separate project usually means doing the shared work twice.

Certifyi covers both meanings in one place. Its AI governance module, built around ISO 42001, gives you an AI system register, an EU AI Act risk class for each system and AI impact assessments, and it shares a workspace with your security and privacy frameworks. On the other side, Certifyi’s AI drafts questionnaire answers from your controls and evidence, following the pattern above: nothing is applied until a person accepts it.

Related terms

AI governance

The roles, policies, processes and records an organisation uses to decide which AI systems it builds or uses, manage their risks to the business and to people, and show that it does so.

AI system inventory

A register of every AI model, agent and third-party AI service an organisation builds or uses, with its purpose, data, owner and risk class. ISO 42001 and the EU AI Act both start from it.

AI impact assessment

An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.

Control mapping

Linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once.