Artificial intelligence can draft security policies, collect audit evidence, and fill out vendor questionnaires in minutes. So why would companies still hire governance, risk, and compliance (GRC) professionals?

In her October 23, 2026 video Will AI replace GRC Cybersecurity?, cybersecurity professional Nicole Enesse advances a provocative answer: AI may create more governance work than it eliminates. Her most useful point is not a jobs forecast but a practical distinction: automating compliance tasks is not the same as being accountable for an organization’s risks.

That idea is worth examining without turning it into a promise of job security. Here is what changes, and how to prepare.

What GRC means beyond paperwork

GRC brings together three related responsibilities:

  • Governance: establishing decision rights, organizational objectives, and applicable policies.
  • Risk management: identifying harm scenarios, assessing likelihood and impact, selecting treatments, and accepting residual risks.
  • Compliance: demonstrating adherence to relevant legal, contractual, and standards-based requirements.

In practice, there are two layers. Operational work includes collecting logs, maintaining inventories, mapping controls, completing questionnaires, and assembling reports. Decision work includes setting priorities, negotiating resources, explaining exposure to business leaders, and documenting who approves exceptions.

AI can assist with both, but the most immediate impact is on operational work.

Five arguments from the video, examined

1. More AI creates another risk surface

Adopting an assistant or an autonomous agent does more than save time. It raises questions about confidential data, vendors, identity, system access, model evaluation, human oversight, and incident response.

Enesse highlights two practical references:

They are not interchangeable. A voluntary framework guides practices; a management-system standard sets requirements and can support certification processes. Not every company is required to obtain certification.

Legislation introduces another layer. The European Union’s AI Act applies in stages: certain prohibitions and AI literacy provisions began applying in February 2025, general-purpose AI governance obligations in August 2025, and various transparency obligations in August 2026. High-risk rules for certain Annex III uses are scheduled for December 2027, while some regulated Annex I products have until August 2028. Applicability depends on the type of system and the organization’s role. See the European Commission’s official implementation information.

Critical distinction: more governance requirements can create GRC projects, but they do not, by themselves, establish how many net new jobs will exist.

2. AI automates tasks; jobs combine tasks and decisions

A tool can draft a questionnaire answer, locate evidence in a repository, or suggest mappings between frameworks. But its output still needs to be checked for accuracy, currency, access permissions, and traceability.

ActivityPossible AI assistanceNecessary human control
Security questionnairesDraft from authorized evidenceVerify claims before submission
Evidence collectionFind and organize recordsConfirm integrity, scope, and freshness
Control mappingPropose NIST/ISO correspondencesApprove mappings and their limitations
Risk assessmentsOutline scenarios and treatmentsSet risk appetite, priorities, and ownership
Exceptions and acceptancePrepare documentation and optionsAuthorize decisions and record accountability

This does not imply every technical task is trivial to automate. Testing whether a control truly operates as intended may require integrations, test criteria, and independent checks.

3. Accountability cannot be delegated to a chatbot

A perfectly written policy does not approve a budget or take responsibility for the consequences of a breach. Models can help model scenarios, but an organization still has to decide who accepts residual risk, based on what evidence, and for how long.

Consider a company connecting an AI agent to its billing platform. The agent must read invoices and suggest adjustments. Control documentation can be automated; an accountable person must decide whether the agent can approve refunds, what the monetary cap should be, and when dual approval is required.

The practical rule is to separate recommendation, authorization, and execution.

4. Asking the right questions becomes more valuable

The video emphasizes problem selection and good ideas over flawless execution of bad plans. In GRC, one useful question may prevent months of pointless controls: “Which unauthorized action would be most costly?”, “Who manages the credentials?”, or “What evidence would reveal abuse?”

This takes business context. An automatically generated risk matrix can look impressive while missing the dependency that would actually disrupt the company.

5. Changing behavior is harder than drafting policies

Documentation does not protect a company if employees share credentials, disable controls, or rely on unauthorized tools. GRC specialists must translate technical risks into understandable decisions for product, sales, finance, and executive teams.

Adoption depends on incentives, agreements, training, and measurement. AI can assist these efforts, but it does not automatically replace human coordination.

The missing nuance: GRC headcount may still decline

Enesse distinguishes traditional GRC from GRC engineering, which she associates with technical automation. The boundary is debatable. Building controls as code, integrating evidence systems, and automating testing can be core capabilities of a modern GRC function—not an opposing profession.

More importantly, keeping a human approval step does not guarantee the same headcount. If a team can process twice as many questionnaires in fewer hours, the organization could redeploy staff, recruit different specialists, or shrink repetitive operational roles.

The video’s prediction that GRC jobs will “explode” is a professional opinion, not a statistical forecast demonstrated in the video. The creator also advertises a GRC mentoring program, a commercial interest worth noting.

A better question is not “Will GRC disappear?” but which combination of analysis, judgment, engineering, and communication will remain scarce?

Build a practical AI GRC portfolio project

You can start without an expensive certification by designing a fictional case study, using no actual customer information, for a company considering a customer-support AI agent.

  1. Set the scope. What AI system will be used, which information can it see, and which actions can it take?
  2. Build an inventory. Document the owner, vendor, purpose, processed data, permissions, and dependencies.
  3. Identify six risks. Examples include data leakage, incorrect responses, excessive privileges, malicious instructions, vendor dependence, and inadequate audit trails.
  4. Map potential controls. Use the NIST AI RMF functions as a guide and consult the relevant ISO/IEC 42001 categories without claiming unverified requirements.
  5. Propose treatments. For every risk, specify mitigation, owner, evidence, review frequency, and residual risk.
  6. Set human decision points. Identify who approves new permissions, exceptions, and high-impact actions.
  7. Prepare two deliverables. A control register and a one-page executive summary highlighting exposures, costs, and the top three priorities.

A small sample risk register might look like this:

RiskProposed controlEvidenceOwner
The agent sends sensitive data to an unapproved serviceVendor allowlist and classification rulesConfiguration and access logsSecurity and data owner
The agent issues an incorrect refundPer-transaction cap and human approvalAuthorization historyOperations
Recurring failures are not noticedPeriodic incident and response-sample reviewTest reports and follow-up logRisk team

The achievement is not asking an LLM for 30 policy documents. It is being able to justify your controls, acknowledge limitations, and explain how to test whether they work.

Conclusion: from producing documents to making and evidencing decisions

AI is likely to reduce a meaningful share of GRC paperwork while introducing new risks that someone must identify, prioritize, and govern. Both outcomes can happen at once.

People pursuing this field should combine security foundations, risk management, AI standards, evidence automation, critical thinking, and business communication. The differentiator will not be typing procedures faster. It will be knowing which risk matters, which control works, and who is responsible for the decision.

Sources