Two meanings of “AI GRC”
- GRC for AI: governing, assessing and controlling the AI systems an organization builds, buys or uses.
- AI for GRC: using AI to make governance, risk and compliance work faster, for example reviewing evidence.
Both are growing. This article covers the first in depth and the second where it overlaps, because the same principles (inventory, risk assessment, human oversight, evidence) apply to both.
For assessing the risk of AI vendors you buy from, see AI Vendor Risk Assessment: How to Review Third-Party Evidence at Scale in 2026.
For security testing of AI and LLM systems, see AI Security Assessment: How to Assess the Security of AI and LLM Systems.
Why AI risk assessment is now expected
- Unapproved AI use is widespread. Verizon’s 2026 DBIR (May 19, 2026) reported that employee use of unapproved AI tools rose from 15% to 45% in a single year.
- Prosecutors ask about it. The DOJ’s September 2024 update to its Evaluation of Corporate Compliance Programs asks whether risk assessments “consider and appropriately document” the use of AI, whether AI has “a sufficient degree of human oversight, especially for high-risk uses,” and whether companies are “continuously monitoring and testing” it, per Gibson Dunn.
- Laws are arriving, unevenly. See the regulatory map below.
The 2026 regulatory map
| Jurisdiction | Status as of October 2026 |
|---|---|
| EU AI Act | In force since 2024. The Digital Omnibus, agreed provisionally on May 6, 2026 and published in final form by July 2026, moved high-risk obligations for Annex III systems to December 2, 2027 and for Annex I (AI in regulated products) to August 2, 2028. Article 50 transparency obligations still apply from August 2, 2026, with a grace period to December 2, 2026 for marking synthetic content from systems already on the market. |
| Colorado | SB 24-205 was replaced by SB 26-189, signed May 14, 2026 and effective January 1, 2027. It swaps impact assessments for notice-based duties, requires developers to give deployers technical documentation and keeps consumer rights to notice, explanation, correction and human review, according to McDermott Will & Schulte. |
| US federal | No comprehensive AI statute. A December 11, 2025 executive order, “Ensuring a National Policy Framework for Artificial Intelligence,” directed an AI Litigation Task Force to challenge conflicting state AI laws and Commerce to identify “onerous” ones, per Wiley. It does not itself preempt state law. |
| Sector rules | For example, the EU’s draft GMP Annex 22 (2025 consultation) limits AI in critical GMP uses to static, deterministic models and calls for a human in the loop for non-critical uses; FDA’s April 2026 warning letter to Purolea Cosmetics Lab stated that AI-generated GMP documents must be reviewed. |
Frameworks to use
| Framework | What it gives you |
|---|---|
| NIST AI RMF 1.0 (January 26, 2023) | Voluntary framework with four functions: Govern, Map, Measure, Manage. NIST says it is being revised under the White House AI Action Plan. |
| NIST AI 600-1 (July 26, 2024) | Generative AI Profile: risks specific to generative AI and suggested actions |
| ISO/IEC 42001:2023 (December 18, 2023) | Certifiable AI management system using Plan-Do-Check-Act |
| EU AI Act risk tiers | Prohibited, high-risk, transparency and minimal-risk categories |
A practical approach: run governance through an ISO/IEC 42001-style management system, assess individual systems with NIST AI RMF, and map obligations to the EU AI Act or state laws where they apply.
Running an AI risk assessment
- Inventory. Every AI system built, bought or used, including AI features inside vendor products and employee tools.
- Define intended use. What decisions or outputs, for whom, with what level of autonomy.
- Classify. Regulatory category (for example EU AI Act tier), business criticality, impact on people.
- Identify risks. Accuracy, bias, privacy, security, transparency, intellectual property, reliability, misuse.
- Assess controls. Data governance, testing, human oversight, monitoring, incident handling, vendor terms.
- Measure. Test performance against a baseline, including human decision-making where relevant, as the DOJ suggests.
- Decide and document. Approve, approve with conditions, or reject; record residual risk and owners.
- Monitor. Drift, incidents, complaints, model or vendor changes.
AI in your third parties
Many AI risks arrive through vendors. Add AI questions to vendor assessments: does the service use AI, on what data, is customer data used for training, what human review exists, how are model changes notified? Colorado’s new law, for example, places documentation duties on developers for deployers’ benefit.
Using AI inside GRC safely
The same principles apply when GRC teams use AI themselves: a defined intended use, source-linked outputs, measured accuracy against expert review, human decisions and records of who accepted or rejected each output.
Common weaknesses
- No AI inventory, or one that misses AI inside vendor tools
- Policies that ban tools no one monitors
- Risk assessments without testing
- Human oversight that is nominal
- Regulatory dates tracked from outdated sources (the EU high-risk deadline moved)
AI risk assessment checklist
- AI inventory including vendor AI and employee tools
- Intended use and autonomy level documented per system
- Regulatory classification recorded (EU AI Act, state laws, sector rules)
- Risks assessed with NIST AI RMF or equivalent
- Performance tested against a baseline
- Human oversight defined and real
- Vendor AI terms reviewed
- Monitoring and incident process in place
- Regulatory dates reviewed against current sources
See source-linked AI compliance review with AskDona
AskDona applies the controls described here to its own work: it reads AI policies, model documentation, vendor terms and assessment records against the requirements you set, flags gaps, and links every finding to the exact page so a person can confirm it. Run a sample AI compliance assessment on one AI system’s documentation. AskDona shows the evidence; your governance team decides.
FAQ
What is an AI risk assessment? An evaluation of an AI system’s intended use, risks and controls, leading to a documented decision and ongoing monitoring.
What is the NIST AI Risk Management Framework? A voluntary US framework released January 26, 2023, organized into Govern, Map, Measure and Manage functions.
When do EU AI Act high-risk rules apply? After the 2026 Digital Omnibus, December 2, 2027 for Annex III systems and August 2, 2028 for AI in products covered by Annex I.
What is AI GRC? Either governance, risk and compliance for AI systems, or the use of AI to support GRC work. Mature programs need both.
Is ISO/IEC 42001 certifiable? Yes. It specifies requirements for an AI management system that organizations can be certified against.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| NIST, AI Risk Management Framework | US standards agency | AI RMF, AI 600-1, revision |
| ISO/IEC 42001 | International standard | AI management system |
| Gibson Dunn, EU AI Act Omnibus agreement | Law firm client alert | Agreement dates, Article 50 |
| Orrick, Digital Omnibus finalizes 8 changes (July 2026) | Law firm insight | Final deadlines |
| McDermott Will & Schulte, Colorado AI law in flux (May 2026) | Law firm insight | SB 26-189 |
| Wiley, Executive order on national AI policy framework | Law firm alert | December 2025 EO |
| Gibson Dunn, DOJ updates ECCP (Sept 2024) | Law firm client alert | DOJ AI questions |
| Verizon, 2026 DBIR release (May 19, 2026) | Industry report | Shadow AI |
| Draft EU GMP Annex 22 (2025 consultation) | EU draft guideline | AI in GMP |
| FDA warning letter, Purolea Cosmetics Lab (April 2, 2026) | FDA warning letter | Review of AI-generated documents |