Good morning, risk warriors.

Today’s briefing has a wonderfully GRC-ish theme: the gap between documented governance and operational reality.

ISACA published guidance today making essentially that point—traditional IT governance assumed relatively stable technology, while AI requires controls that evolve continuously with models, use cases, developers, and business outcomes. (ISACA)

And we have a perfect real-world TPRM case study sitting right beside it: Manus.

So grab the coffee. The risk register has material changes.

ISACA argues that AI governance cannot be a rigid collection of policy statements bolted onto development at the end. Governance needs to translate into low-friction technical controls and continuously monitor things such as model drift, hallucinations and accuracy. (ISACA)

This applies far beyond AI.

Traditional GRC often works like:

Policy → Control → Annual Test → Repeat

The emerging model is closer to:

Risk → Control → Evidence → Monitor → Detect Change → Reassess → Adapt

That is a major shift.

A control shouldn't remain “effective” in your GRC platform simply because nobody has updated the record.

The risk environment gets a vote.

A GRC perspective published today argues that governance needs to evolve from periodic compliance into continuous intelligence—connecting controls, regulatory obligations, business operations and changing risk signals more dynamically. (Forbes)

That's exactly where modern GRC should be heading.

Executives don't really need another dashboard showing:

They need to know:

Which business objective is threatened?

What changed?

What could the financial impact be?

Are our controls still effective?

What decision needs to be made?

GRC becomes much more valuable when it stops reporting control activity and starts enabling risk decisions.

As we discussed yesterday, Manus announced that it is separating from Meta and returning to independent operation. To satisfy regulatory requirements in certain jurisdictions, data generated by some users since Meta acquired Manus on December 29, 2025 must be deleted August 23–24. Affected users have to back up their data beforehand and can restore it beginning August 25. Manus explicitly says this is not a breach or security incident. (Manus)

This is fascinating from a risk perspective because none of the usual cyber controls necessarily failed.

Consider the chain:

Acquisition → Regulatory intervention → Change in ownership → Corporate separation → Mandatory data deletion → Customer backup → Temporary service interruption → Restoration

That's third-party risk.

Not everything belongs under:

Your TPRM framework also needs:

The vendor can be perfectly secure and still create material business risk.

That's today's TPRM lesson.

Article 50 transparency obligations under the EU AI Act became applicable on August 2. Certain AI systems now face transparency requirements involving AI interaction and generated or manipulated content. (JD Supra)

We're moving from:

to:

For GRC teams, that means building traceability:

Requirement → Applicability → Business Process → Control → Owner → Evidence → Test Result

The compliance deadline is only the beginning.

Operationalization is where the work lives.

Thoropass's 2026 audit and compliance study found 69% of surveyed security and compliance leaders said AI adoption was outpacing their security and compliance controls. More than half identified AI-related data exposure or misuse as their top breach concern. (Business Wire)

The same research found 53% cited collecting evidence across multiple tools as their biggest audit bottleneck, while 91% said evidence sometimes needs to be resubmitted because of miscommunication or shifting auditor expectations. (Business Wire)

Here's the sneaky GRC problem:

You can have good controls and still have poor assurance if you cannot efficiently demonstrate them.

Audit readiness therefore needs two dimensions:

Control effectiveness

and

Evidence effectiveness

If it takes three weeks, six emails and an archaeological expedition through SharePoint to prove a control operated...

there's another maturity opportunity.

Today's control concept worth watching:

Good candidates include:

DORA provides a good example of the broader regulatory direction: critical ICT relationships require ongoing classification, monitoring, subcontractor visibility, incident cooperation and tested exit strategies—not just an annual questionnaire. (Crest Digital)

Research released today by Stratix says 63% of surveyed organizations reported a data compromise linked to shadow AI. The research argues that AI activity is increasingly moving onto endpoints where traditional governance has weaker visibility. (FinanzNachrichten.de)

Akamai research released last week similarly reported that nearly half of enterprise AI usage was bypassing corporate security controls. (Yahoo Finance)

Shadow AI isn't simply:

It can represent:

That's why I would treat Shadow AI as an enterprise risk scenario, not merely a security-policy violation.

Fresh research published this week examined AI agents across more than 2,000 workplace tasks and identified thousands of potential risk scenarios. One notable conclusion: simply keeping a human involved doesn't automatically make agentic AI safe—overreliance can erode human skills and oversight, while erroneous agent actions were among the most severe risks identified. (arXiv)

This raises a governance question we're going to hear much more often:

That is a fascinating control-effectiveness problem.

A checkbox labeled “human-in-the-loop” doesn't necessarily mean meaningful human control exists.

That's a very different maturity conversation.

Inspired by Manus:

Then ask for evidence.

Backup capability.

Export format.

Recovery procedure.

Exit plan.

RTO/RPO.

That's a much richer resilience conversation than:

Third-party disruption can come from:

Manus is today's exhibit A. (Manus)

Cybersecurity is one component of TPRM.

It isn't TPRM.

Shadow AI: today's Stratix research says 63% of surveyed organizations experienced a data compromise linked to it. (FinanzNachrichten.de)

Vendor change risk: Manus users in affected jurisdictions have less than two weeks to ensure relevant data is backed up before mandatory deletion begins. (Manus)

Regulatory operationalization: EU AI transparency requirements are now applicable rather than merely approaching. (JD Supra)

Governance velocity: ISACA is explicitly calling out the mismatch between fast-moving AI and governance designed for slower technology cycles. (ISACA)

See the common thread?

The strongest programs are moving toward an integrated operating model:

ERM identifies material business scenarios.

GRC maps those scenarios to obligations, controls and evidence.

TPRM continuously watches external dependencies and material vendor changes.

Compliance tracks regulatory change and applicability.

Cybersecurity evaluates technical exposure and control effectiveness.

Business Continuity tests what happens when critical dependencies disappear.

Internal Audit independently challenges whether all of this actually works.

And business owners—not the GRC team—ultimately own the business risk.

That last sentence matters.

GRC should enable informed risk decisions.

It shouldn't become the organization's risk storage facility.

If you hear these today, pour generously:

☕ “Nothing changed. It's the same vendor.”

☕ “The AI functionality isn't material.”

☕ “Human approval is required, so we're covered.”

☕ “We have backups.”

☕ “The regulation only became effective last week.”

And today's premium selection:

Wonderful.

How's the risk doing?

Today's lesson is bigger than AI:

Risk changes.

Vendors change.

Regulations change.

Business processes change.

Technology changes.

Controls therefore need to be:

observable → measurable → challengeable → adaptable.

The next generation of GRC won't win by documenting more controls.

It will win by helping leadership answer:

That's risk management.

Regulatory: EU AI transparency obligations are now operational. (JD Supra)

Business: Shadow AI continues creating measurable data and governance exposure. (FinanzNachrichten.de)

Third Party: Manus demonstrates how regulatory and ownership changes can create operational risk without a cyber incident. (Manus)

GRC: AI adoption continues outpacing compliance controls, while audit teams struggle with continuous evidence readiness. (Business Wire)

If we know the vendor's security rating but can't answer that question...

we're measuring the supplier instead of managing the business risk.