AI and GRC: moving beyond chatbots to AI embedded in workflows

Artificial intelligence is rapidly becoming part of governance, risk and compliance (GRC) work. Summarising documents, finding information and preparing overviews are already saving teams valuable time.

But the real transformation begins when AI no longer sits alongside GRC processes and instead operates directly within risk management, internal control, audit and compliance activities.

The challenge is therefore not simply to have AI that can answer questions. It is to give AI the right context, at the right time, within the right process.

‍

AI in GRC: what are the use cases?

AI in GRC refers to the use of artificial intelligence technologies to support teams in their governance, risk management, internal control, audit and compliance activities.

It can be used to:

• Analyze data and documents
• Search for and cross-reference information
• Prepare summaries
• Identify inconsistencies
• Suggest action plans
• Assist with report writing
• Detect trends or signals requiring further analysis

However, simply connecting an AI model to a platform is not enough.

To be genuinely useful, AI must understand the context in which the user is working.

‍

Why chatbots are not enough for GRC

A conversational assistant can quickly produce a summary or answer a question.

But it generally lacks much of the relevant business context.

When an Internal Control Manager assesses a control, for example, several factors must be considered: the risk it addresses, previous results, available evidence, related incidents and actions that are already under way.

The same applies to an auditor reviewing a recommendation or a Risk Manager preparing a risk review.

An isolated piece of information rarely provides enough context.

One of the defining characteristics of GRC is that its data is interconnected.

A risk may be linked to controls, incidents, audit recommendations, indicators, obligations and action plans.

For its output to be relevant, AI needs to be able to use those relationships.

AI embedded in GRC workflows: what changes?

Embedded AI supports users directly at a specific step in a business process. It has the context needed to understand what the user is doing and to provide relevant assistance.

The experience shifts from “Ask AI a question” to “AI helps you directly at this step in the process.”

This development also reflects a trend in internal audit. In 2026, Gartner reported that 93% of surveyed audit leaders were already using AI to some extent, but only 38% had an AI strategy. Usage was still largely concentrated on individual tasks, such as planning engagements, drafting findings and reviewing documents.

So the question is no longer just about adoption. It is how to embed AI in processes so it delivers genuine business value.

‍

Three examples of AI embedded in GRC processes

Iskera presented this approach at the IIA Luxembourg Annual Conference on 8 October 2026, illustrating several practical uses of AI in internal audit and GRC processes.

1. Internal control: making assessments more reliable

When someone assesses a control, AI can analyse several elements at once:

• The control description
• The selected assessment rating
• The comment entered
• The supporting evidence provided
• The available history

It can then flag an inconsistency or insufficient justification before the assessment is consolidated.

The aim is not to make decisions on behalf of the person responsible for the control. It is to improve the quality and consistency of information from the moment it is entered.

2. Internal audit: simplifying action plan reviews

Following an audit recommendation, AI can analyse the proposed action plan and check whether it is consistent with the original finding or recommendation.

For example, it can identify:

• An incomplete response
• An action that is too vague
• An aspect of the recommendation that has not been addressed
• A similar action already included in another control framework

The auditor remains responsible for the conclusion, but has an initial analysis that allows more time for review and professional judgement.

3. Risk management: preparing risk reviews

During a periodic review, Risk Managers often need to bring together information scattered across different sources.

AI can cross-reference:

• Recent incidents
• Control results
• Audit findings
• Key performance indicators (KPIs)
• Action plans
• Historical assessments

It can then prepare a summary of significant developments and highlight items that need further analysis.

Instead of starting with a blank page, the professional starts with an already structured body of context.

These applications reflect trends in the GRC information systems market. In its 2026 GRC Software Landscape (Panorama SIGR), AMRAE highlights the potential of AI for risk mapping, prevention, internal audit, internal control and data analysis. 95% of the software vendors surveyed also identify improved qualitative analysis as one of the main objectives of AI embedded in GRC systems.

Connected data makes AI more relevant

The effectiveness of AI in GRC therefore depends heavily on the quality of the context it can access.

In an integrated platform, information is more than a collection of independent documents.

A risk, the control designed to mitigate it, an incident revealing a weakness, the resulting audit recommendation and the associated action plan can all be connected.

AI can use these relationships to deliver more relevant information.

This capability paves the way for Risk Intelligence: using data already generated through GRC activities to better understand a situation, identify significant changes and support decision-making.

What does it take to embed AI in a GRC platform?

Adding an AI model is not enough. Truly embedded AI must be able to:

• Access only relevant information
• Understand the relationships between GRC entities
• Respect user roles and access permissions
• Provide assistance at the right stage of a workflow
• Maintain a record of generated analyses and recommendations
• Allow users to review, modify, or reject the results

AI governance is therefore just as important as model performance.

This matters all the more because 52% of European internal audit leaders now rank digital disruption, new technologies and AI among their five biggest risks, according to Risk in Focus 2027. This category moved from third to second place in the risk rankings.

‍

Human in the loop: AI assists, professionals decide

Not every GRC decision should be automated.

Assessing a risk, judging the effectiveness of a control, accepting a recommendation or deciding whether an action is sufficient can have significant consequences for an organisation.

The goal is therefore not to maximise AI autonomy.

Instead, there must be a clear distinction between what AI can analyse, what it can propose, what it can automate and what must be validated by a professional.

At Iskera, this principle can be summed up as follows: AI prepares. Your teams decide. The platform maintains traceability.

This approach makes it possible to benefit from AI while retaining control over decisions and the ability to explain them.

‍

One AI model for every use case? Not necessarily

Not all use cases have the same requirements. Some demand complex reasoning and extensive context. Others prioritise speed, cost, data sovereignty or the use of a model already approved by the organisation.

A modern GRC architecture should therefore be able to select a model that suits each business need.

With this in mind, Iskera takes a multi-model approach, using the model best suited to the use case and the organisation's requirements.

‍

How Iskera embeds AI in GRC processes

Iskera's approach is to make artificial intelligence a cross-functional capability of the platform rather than a standalone feature.

It is built around:

• AI capabilities embedded directly into business workflows
• AI that can leverage the platform’s context
• A multi-model architecture
• Administration and monitoring capabilities
• Governance and traceability mechanisms
• Human validation when decisions require it

The objective is simple: spend less time searching for, consolidating or rewording information, and more time analysing it.

The future of AI in GRC will not be defined by yet another chatbot. It will depend on AI's ability to understand context, fit into processes and operate within clear governance.