Introduction
Artificial Intelligence (AI) is changing the way professionals across industries approach their everyday work. Governance, Risk and Compliance (GRC) is no exception.
For GRC professionals and developers, AI is creating new opportunities to automate repetitive activities, analyze information faster, improve productivity, and approach familiar problems differently.
But does AI mean replacing GRC professionals and developers?
Not necessarily.
The more important opportunity may be AI augmentation—combining AI with human expertise, domain knowledge, technology, data, and automation to work smarter.
Where It Started: Traditional Governance, Risk and Compliance (GRC)
For many years, working in Governance, Risk and Compliance (GRC) meant something very different from talking about Artificial Intelligence.
As a GRC professional and software developer, much of my work traditionally centered around:
- Understanding business requirements
- Configuring GRC platforms
- Developing workflows and calculations
- Creating reports
- Troubleshooting issues
- Supporting releases
- Keeping systems running
In other words: BAU—business as usual.
And there is nothing wrong with BAU.
Behind every functioning enterprise GRC platform are countless hours spent reviewing requirements, analyzing configurations, testing changes, investigating defects, validating data, preparing releases, and supporting users.
However, much of that work can also be repetitive.
We search through configuration files.
We compare spreadsheets.
We trace where fields are being used.
We review logs looking for the source of an error.
We create similar technical documentation repeatedly.
We write scripts to automate tasks that have become too time-consuming to perform manually.
For a long time, this was simply part of the job.
Then AI entered the conversation.
Then Came AI
At first, AI felt like something happening somewhere else.
It was being discussed in technology conferences, news articles, product announcements, and social media. Suddenly, everyone seemed to be talking about Generative AI, Large Language Models, automation, copilots, and the future of work.
And naturally, one question started appearing:
Will AI eventually replace what we do?
For someone working in technology, it is difficult to completely ignore that question.
AI can:
- Write code
- Analyze documents
- Summarize information
- Generate test cases
- Explain errors
- Analyze data
- Produce documentation in seconds
Tasks that once required significant manual effort could suddenly be accelerated dramatically.
My perspective gradually shifted from:
“What will AI do to my job?”
to:
“What can AI do for my job?”
That small change in perspective made a big difference.
If You Can’t Beat It, Learn to Work With It
There is an old saying:
“If you can’t beat them, join them.”
That idea feels surprisingly relevant to the AI transformation happening today.
AI isn’t something I can simply ignore and expect to disappear.
So rather than treating AI as competition, I started looking at it as another tool.
I didn’t stop being a GRC professional.
I didn’t stop being a developer.
And I certainly didn’t become an AI expert overnight.
Instead, I started experimenting with how AI could complement the knowledge and skills I already had.
That is an important distinction.
The objective wasn’t:
AI instead of GRC expertise.
It became:
AI + GRC expertise.
And that combination opened a completely different way of thinking about everyday work.
Starting Small
My journey with AI didn’t begin with building sophisticated machine-learning models.
It started with much simpler questions.
I would encounter a repetitive task and think:
“Can I automate this?”
I would receive a large configuration file and wonder:
“Can I analyze this programmatically instead of reviewing everything manually?”
I would encounter an error and ask:
“Can AI help me understand possible causes before I spend hours investigating?”
I would need to build a script and think:
“Can AI help me create the first version faster?”
These aren’t revolutionary AI use cases.
But they are practical ones.
Sometimes the biggest productivity improvements don’t come from building something revolutionary. They come from improving the work we already do every day.
From Manual Analysis to AI-Assisted Analysis
Consider something common in enterprise GRC environments: impact analysis.
Suppose a team wants to modify or remove a field.
Before making that change, someone needs to understand where that field is being used.
Questions may include:
- Is it included in a view?
- Is it referenced by a calculation?
- Does a workflow depend on it?
- Is it required?
- Is it read-only?
- Does it contain enumerated values?
- Is another field dependent on those values?
- Could changing it affect reporting?
Traditionally, answering those questions may involve reviewing multiple configuration files, spreadsheets, system screens, and technical documentation.
Now imagine combining Python, APIs, data analysis, and AI.
A tool can extract configuration information automatically.
Python can organize and compare it.
AI can assist with developing the logic, interpreting results, identifying patterns, and documenting findings.
Instead of spending most of the time collecting information, the GRC professional can spend more time understanding what the information actually means.
That is where I started seeing the real value of AI.
AI Doesn’t Need to Replace the Process
When people hear “AI in GRC,” it is easy to imagine a future where AI automatically identifies risks, evaluates controls, interprets regulations, and makes decisions.
Those capabilities will continue to evolve.
But there is another side of AI in GRC that is equally interesting:
Using AI to make the people doing GRC more effective.
Think about the everyday activities surrounding a GRC platform:
- Requirements analysis
- Configuration reviews
- Impact assessments
- Technical documentation
- Test-case generation
- Data analysis
- Log analysis
- Troubleshooting
- Reporting
- Development
- Release preparation
Many of these activities contain opportunities for AI assistance.
The goal isn’t necessarily to give AI control of the process.
The goal is to remove unnecessary manual effort from the process.
The Developer’s Role Is Changing Too
AI is also changing how I think about software development.
Traditionally, when I encountered a requirement, my first thought might have been:
“How do I build this?”
Now I find myself asking a slightly different question:
“What is the best way to solve this?”
Maybe it requires configuration.
Maybe it requires Python.
Maybe it requires an API.
Maybe it requires analytics.
Maybe AI can accelerate part of the solution.
Or maybe AI isn’t appropriate for that particular problem.
The important thing is that the toolbox has expanded.
A developer no longer has to think only in terms of writing code.
Increasingly, development is about orchestrating technologies to solve problems efficiently.
But AI Can Still Be Wrong
There is one lesson that becomes very clear when working with AI:
A confident answer isn’t necessarily a correct answer.
AI can generate code that looks perfectly reasonable but contains subtle errors.
It can suggest an approach that technically works but doesn’t fit the architecture.
It can misunderstand a business rule.
It can summarize something while missing an important detail.
And in GRC, those details matter.
A calculation may determine a risk rating.
A workflow may control an approval process.
A configuration may affect access or reporting.
A regulatory interpretation may influence a compliance decision.
This is why human expertise becomes more important, not less important, as AI adoption grows.
Someone still needs to:
- Validate the result
- Understand the context
- Challenge the recommendation
- Know when the AI is wrong
Domain Knowledge Becomes the Advantage
One concern often heard about AI is that people who have spent years developing specialized skills may suddenly find those skills less valuable.
I see it differently.
AI can help someone generate Python code.
But experience tells you whether that code belongs in a production environment.
AI can propose a workflow.
But GRC knowledge tells you whether that workflow reflects the actual business process.
AI can analyze a dataset.
But domain expertise tells you which relationships actually matter.
AI can summarize a requirement.
But experience helps identify what wasn’t explicitly written.
And AI can generate an answer.
Experience helps you recognize when that answer doesn’t make sense.
That is why I don’t believe the future belongs only to “AI experts.”
There will also be enormous value in professionals who can combine:
Domain Expertise + Technology + Data + AI
From Traditional GRC to AI-Augmented GRC
The biggest transformation for me hasn’t been replacing traditional GRC activities.
It has been augmenting them.
I still work with requirements.
I still work with configurations.
I still troubleshoot.
I still analyze data.
I still deal with workflows, calculations, reports, testing, releases, and production issues.
But now there is another question running in the background:
“Is there a smarter way to do this?”
That might mean automation.
It might mean analytics.
It might mean using AI.
Sometimes it is simply using AI to help develop a small tool that saves hours of repetitive work.
Those small improvements accumulate.
And over time, BAU starts looking different.
It becomes:
AI-Augmented BAU
What AI-Augmented GRC Could Look Like
Imagine a GRC environment where AI doesn’t replace the GRC professional but works alongside them.
For example:
Risk Analysis:
A risk analyst receives hundreds of records and AI helps highlight unusual patterns.
Troubleshooting:
A developer receives an error log and AI helps narrow the possible root causes.
Configuration Impact Analysis:
A configuration team needs to understand the impact of changing a field, and an automated tool identifies dependencies across the platform.
Testing:
A testing team receives a new requirement and AI helps generate initial test scenarios.
Reporting:
A reporting team analyzes risk information and AI helps identify trends worth investigating.
Document Analysis:
A GRC professional reviews a large document and AI helps extract relevant information—but the professional validates the interpretation.
In every case, AI does part of the heavy lifting.
The human remains responsible for judgment.
That distinction is critical.
The Future Isn’t Human vs. AI
The conversation around AI is often framed as competition:
- Human versus machine
- Developer versus AI
- Jobs versus automation
But I think the more useful conversation is about augmentation.
AI is becoming another layer in how we work.
Just as spreadsheets changed analysis, APIs changed integration, and automation changed repetitive processing, AI is changing how we interact with information and technology.
The professionals who benefit most may not necessarily be those who know everything about AI.
They may be the ones who know enough about AI to apply it effectively to the problems they already understand deeply.
Start With What You Already Know
For anyone working in GRC who is wondering where to begin with AI, my suggestion is simple:
Don’t start with AI. Start with your work.
Look at what you do every week.
Ask yourself:
- What takes too long?
- What is repetitive?
- What requires searching through large amounts of information?
- What analysis do you repeatedly perform?
- What could be automated?
- What requires human judgment—and what doesn’t?
Those questions will often reveal better AI opportunities than simply asking:
“How can we use AI?”
The best use cases usually begin with a real problem.
Still Learning, Still Building
My own journey from traditional GRC toward AI-augmented GRC is still evolving.
It has expanded from GRC configuration and software development into automation, Python, APIs, data analytics, and increasingly AI-assisted solutions.
There is still much more to learn.
And that’s part of what makes this transformation interesting.
AI doesn’t erase the experience we already have.
It gives us another way to use it.
The GRC knowledge remains.
The development experience remains.
The understanding of business processes remains.
The lessons learned from years of troubleshooting remain.
AI simply becomes another capability we can bring to the problem.
From BAU to What’s Next
I started in an environment where GRC technology largely meant configurations, workflows, calculations, reports, integrations, troubleshooting, and BAU support.
Today, those things are still part of the job.
But the way I approach them is changing.
Instead of seeing AI as something that might eventually compete with my role, I would rather learn how to make it strengthen my role.
Instead of asking whether AI will change GRC, I think the more important question is:
How will we use AI to make GRC better?
For me, that is what AI-augmented GRC means.
Not replacing the professional.
Not replacing experience.
Not allowing AI to make every decision.
But combining human judgment, domain expertise, technology, data, automation, and AI to work smarter and solve problems differently.
Perhaps “If you can’t beat them, join them” isn’t quite the right phrase after all.
A better one might be:
Don’t compete with AI. Learn how to make AI work with you.
And that may be one of the most important skills we bring into the next generation of GRC.
