The compliance stories enterprise IT leaders actually read.
Volume 342, Issue 4 · 8 articles from 4 issues
Governing systems that construct responses rather than follow defined paths calls for observation over prescription.
Jon Stevens-Hall examines the governance problem posed by autonomous systems that construct responses rather than follow predetermined paths. Drawing on complexity theory and the Cynefin framework, he argues that prescriptive rule-setting fails when the behavior space cannot be enumerated in advance.
The alternative proposed is continuous observation, including LLM-as-judge techniques, that allows creative freedom within defined boundaries while detecting when outputs drift outside them.
For service management teams asked to govern agents they did not specify, it is one of the more rigorous treatments available.
Data governance policies often fail to translate into real compliance, and the article details why and how to fix it.
Chris Tozzi identifies six reasons data governance policies fail to produce actual compliance: misalignment with operational reality, unclear ownership, resource constraints, governance processes too slow for compliance timelines, weak incentives that reduce compliance to "box-ticking," and regulatory change outpacing policy updates.
To fix this, the article recommends embedding automation directly into governance systems, including automated controls that enforce rules without manual intervention, continuous real-time monitoring, automated report generation, clear accountability with automated reminders, and automated regulatory change management.
The conclusion urges shifting from manual compliance processes to integrated, automated governance controls.
IT leaders' governance workload has surged even as AI itself saves employees time, straining oversight capacity.
OneTrust research cited in the piece finds IT leaders now spend 26% more time on AI governance and risk work than a year ago, even as frontline employees save nearly a full workday weekly using AI tools.
The gap stems from unapproved AI usage, citizen-developer apps, and incident response consuming leaders' hours rather than building durable controls.
Experts warn that awareness and time spent don't equal readiness, and organizations must embed governance into operating models before autonomous agents multiply the burden.
Role-based access control governs credentials, but agents need governance at the context layer instead.
Traditional agent governance frameworks focus on access controls and credentials while the real problem is controlling the context agents use to reach decisions. Agents synthesize across sources with goal-driven logic, so an agent can hold entirely valid permissions and still assemble a wholly inappropriate combination of data.
The article notes real-world model degradation around 100,000 to 200,000 tokens, making context selection within finite limits a governance problem rather than a matter of adding more data.
It cites agent data injection attacks succeeding 31-43% of the time against structured data by corrupting small, trusted facts. Compliance-grade governance must record what data was accessed, what context shaped the output, and what logic executed - not merely log events.
CIOs face shadow AI, embedded vendor AI and autonomous agents outpacing governance frameworks, the piece warns.
The article argues CIOs face AI capabilities spreading through the enterprise faster than governance can keep up, citing 69% of organizations suspecting unauthorized employee AI use alongside embedded AI in vendor software and autonomous agents that could leak IP or alter code.
It calls for continuous discovery mechanisms, runtime security control planes, visibility into vendor updates, and treating governance as foundational strategy rather than an afterthought.
As one expert notes, a complete view of AI use is much harder than keeping a list of approved projects, so proactive infrastructure is needed now.
Cybersecurity GRC Frameworks: A Complete Guide for Businesses
Cybersecurity GRC connects governance, risk, and compliance into unified structures rather than isolated functions.
The guide examines major frameworks including NIST CSF 2.0, ISO 27001, SOC 2, PCI DSS, and HIPAA, each serving different regulatory and business contexts.
Organizations should select frameworks based on industry requirements and data handling obligations rather than perceived strength. Successful GRC programs require clear ownership, continuous monitoring between audits, and regular testing to maintain effectiveness as threats and systems evolve.
Encode AI policy as build- and runtime controls in the delivery pipeline instead of running governance as separate compliance.
Adnan Masood makes the case that AI governance only works when it is embedded in engineering systems rather than run as a parallel compliance function.
He defines governance by design as encoding policy into build and runtime controls that enforce access, constrain actions, capture evidence, and measure drift.
The practical program involves threat modeling, standardized reusable governance components, policies expressed as executable code, CI/CD gates, and runtime enforcement.
Placing these alongside existing quality checks and security testing lets organizations operate AI responsibly while still shipping quickly, rather than trading speed for control.
Periodic compliance audits can't keep pace with cloud-native infrastructure that changes hourly.
Author Ramachander Rao Thallada argues that 'point-in-time controls verification just isn't going to cut it anymore' for infrastructure built on Kubernetes, serverless and infrastructure-as-code, since a compliance snapshot from one month can be irrelevant by the next as services and permissions change.
He proposes shifting from 'were we compliant last quarter?' to 'are we compliant right now?' using controls-as-code tools like OPA and Kyverno, automated evidence generation from CI/CD pipelines, real-time drift detection, and dynamic risk scoring.
Success requires GRC teams to embed directly with engineering and accept real-time visibility over polished quarterly reports, starting small on critical controls before expanding.
More from Compliance · All IT section newsletters · This week