Extending GRC to Cover AI Risk

The Challenge

Organisations are adopting GenAI, retrieval-augmented generation (RAG) and AI agents faster than their governance can keep up. In critical infrastructure, the question isn’t only whether an AI system is secure. Boards also need to know who is accountable for its decisions, whether those decisions can be audited, and what happens when it goes wrong. Most existing GRC processes weren’t designed to answer those questions.

What I Am Doing

• Governance aligned to recognised frameworks: driving AI governance and risk management programmes aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act and Responsible AI principles.
• Extending GRC rather than starting again: extending the organisation’s existing GRC processes to cover AI-specific risks, so AI is governed through the same discipline as everything else.
• From Responsible AI to Accountable AI: focusing on auditability, decision traceability, AI observability and human oversight across the AI lifecycle.
• Security across the lifecycle: leading AI security initiatives across GenAI, RAG, AI agents and enterprise AI applications, from design through deployment, monitoring and governance, and applying threat modelling and architecture review to AI-enabled systems.
• Choosing the right controls: evaluating and integrating AI security technology for prompt security, AI DLP, AI governance, model monitoring, agent security and AI threat detection.

The same thinking is behind my public AI Security Wiki, a free, vendor-neutral framework of test cases, control objectives and a regional regulatory hub for security leaders.

Why It Matters

AI governance fails when it sits apart from the rest of the risk programme. My focus is making AI accountable in ways auditors, regulators and boards can check, built on the security architecture and GRC disciplines I’ve worked in for over 20 years.