Risk warriors.

Today’s theme is change risk.

Regulations are becoming operational, vendors are quietly adding AI capabilities, cyber threats are accelerating, and businesses are discovering that a control tested six months ago may still exist perfectly while protecting against a risk that has already changed.

That is a very GRC problem.

A major milestone just passed: Article 50 transparency obligations under the EU AI Act began applying August 2. These include requirements around informing people when they interact with certain AI systems and identifying or labeling specified AI-generated or manipulated content. European Commission enforcement powers for obligations covering the most advanced general-purpose AI models also took effect August 2.

This is where regulatory tracking has to turn into control traceability.

For applicable requirements, GRC should be able to connect:

Regulation → Obligation → Business Process → Control → Owner → Evidence → Testing

And there's an important wrinkle: proposed EU changes could provide transitional relief for some existing generative-AI systems, but the Commission explicitly says Article 50 currently applies from August 2 regardless.

Translation:

New research reported today says 83% of healthcare organizations surveyed view unauthorized shadow AI as a critical business and data risk, while data-sovereignty concerns are also elevated.

And this isn't unique to healthcare.

Shadow AI can create:

Stop framing shadow AI exclusively as:

A better ERM framing is:

Now you've translated a technical issue into business risk.

SecurityWeek argued today that the AI governance gap increasingly belongs at the leadership level rather than sitting exclusively with Legal or Technology. The central issue is organizational accountability: somebody must own how AI risk is identified, accepted, monitored, and escalated.

One of the most important questions GRC can ask isn't:

It's:

If the answer involves four committees, three departments and the phrase “it depends”...

we may have found today's governance issue.

Current third-party AI guidance highlights a nasty TPRM problem: existing SaaS products are adding AI functionality that can introduce new models, subprocessors and data flows after the vendor was originally assessed.

Meanwhile, third-party breach data shows why downstream dependencies matter. Black Kite's 2026 report says each vendor breach in its analysis affected an average of 5.28 downstream organizations, illustrating the expanding blast radius of supply-chain incidents.

This makes material-change management incredibly important.

Don't reassess vendors only when contracts renew.

Trigger reassessment when they introduce:

Otherwise your vendor may technically be “assessed” while the product you assessed no longer exists.

Traditional audit question:

Better question:

That distinction matters as AI and cyber risks change faster.

NYDFS has specifically urged regulated organizations to update risk assessments for frontier-AI cyber threats, accelerate vulnerability-management thinking where appropriate, coordinate with critical third parties and downstream providers, and consider additional validation of AI-generated code.

A control can be:

✅ Documented
✅ Performed
✅ Evidenced
✅ Audited

…and still be ineffective against today's risk.

That's why mature GRC programs test control effectiveness, not merely control existence.

The NYDFS frontier-AI advisory is particularly interesting from a GRC perspective because it doesn't create a shiny new AI compliance regime. Instead, it tells organizations to use their existing cybersecurity risk-management framework to address the changing threat.

That's an important signal.

Regulators may increasingly expect organizations to demonstrate that existing:

adapt when the external risk environment changes.

That's dynamic GRC.

Axios reports today that security leaders are facing growing decision fatigue as AI-driven cyber threats accelerate and the security-product market becomes increasingly crowded. CrowdStrike reportedly observed an 89% increase in AI-driven cyberattacks, including attacks targeting AI infrastructure itself.

This creates a subtle business risk:

More threats + more vendors + more products + more alerts does not automatically equal less risk.

Mature risk management asks:

Which scenarios materially threaten our business objectives?

Then fund controls against those scenarios.

Otherwise you get cybersecurity Whac-A-Mole with an enterprise budget.

Today's control worth stealing:

Possible triggers:

That connects ERM + GRC + TPRM + Cybersecurity beautifully.

That's today's leadership conversation.

Ask:

Notice the difference.

You're no longer asking the vendor to prove they were secure last year.

You're asking whether their risk changed.

Residual risk is based on assumptions about:

Change one assumption and your residual risk can change.

A risk rating is a decision at a point in time.

It isn't a tattoo.

Shadow AI remains a material data and business-risk concern.

Third-party AI exposure continues expanding as existing SaaS vendors embed models and AI capabilities.

AI-powered cyber activity is increasing while security leaders face growing complexity in deciding which defenses matter most.

And EU AI transparency requirements are no longer something organizations can put in the “future regulation” column.

There is a common denominator:

The strongest programs aren't creating a separate process for every new AI problem.

They're strengthening the risk operating model:

ERM identifies material business scenarios.

GRC translates obligations into controls and evidence.

TPRM monitors external dependencies and material vendor changes.

Cybersecurity validates technical exposure and control effectiveness.

Compliance tracks changing regulatory obligations.

Internal Audit independently challenges whether the system works.

Business owners make informed residual-risk decisions.

That's where I think GRC is headed:

If you hear these today, locate the control owner and the coffee machine:

☕ “Nothing changed—we're using the same vendor.”

☕ “They only added an AI feature.”

☕ “We passed the audit last year.”

☕ “The risk assessment is still current.”

☕ “Compliance hasn't told us we need to change anything.”

And today's premium selection:

Ah yes.

The famous absence-of-evidence control framework.

Today's risk story is not AI.

It's change management.

Regulations change.

Threats change.

Vendors change.

Technology changes.

Business processes change.

Therefore:

The future of GRC isn't creating more controls.

It's creating a governance system capable of recognizing when yesterday's controls no longer adequately manage today's business risk.

Today's drivers:

If the first answer is clear but the second one isn't...

that's today's GRC conversation. ☕🛡️