Legacy GRC or AI-native GRC: digitizing is no longer enough

The word describes an architecture rather than an age. A legacy platform is built around a forms-and-workflow engine: the framework, the policy and the evidence are attachments it stores without understanding them. Every act of interpretation stays human, and whatever is specific to your organisation arrives through heavy configuration or consulting days. These products remain solid at storage and reporting. What they cannot do is read a document and turn it into an analysis.

Rarely at the point of creation: a first risk register or compliance matrix sits perfectly well in a spreadsheet. The limits show up at update time. A scope shifts, a framework moves to a new version, a piece of evidence expires, a contributor changes role, and the whole thing has to be reworked by hand with no reliable way of knowing what was already reviewed. Then there is memory: a spreadsheet does not keep why a risk was accepted last year, or who accepted it.

A handful of questions during a demo settles it. Does the AI write into the data model, or only answer in a chat panel beside it? Is it present across every module, or in just one? Is each output tied to its source, reviewable and versioned? Ask to see a deliverable produced in front of you rather than a screenshot. Bolted-on AI speeds up finding information; AI-native software does the work itself and leaves it open to verification.

An auditor does not certify a tool. They examine a management system and the evidence behind it: whether the content is accurate, where each statement comes from, who approved it and when it was last reviewed. A deliverable that was generated, then read and signed off by a named owner, meets those conditions; one that nobody reviewed does not, whether an AI or a person wrote it. Traceability is the real test, not the drafting method.

No. No body certifies that a platform is AI-native: the phrase describes an architecture, not a standard. What does exist, and is certifiable, is ISO/IEC 42001, published in 2023, which defines a management system for artificial intelligence, alongside ISO/IEC 27001 for information security. On top of that sits the European regulation on artificial intelligence, in force since 2024 and applying in stages. A vendor offering you an AI GRC certificate is selling something else.

No, and doing it in one move is the surest way to fail. What works is picking one scope where the work actually hurts (a risk assessment, a supplier questionnaire campaign, a mapping between two frameworks), running it alongside the existing process and comparing the deliverables. What you have already written stays usable: policies, matrices and treatment plans are documents, and a platform designed for AI should be able to take them as a starting point. Check that during the demo.

Three thresholds keep coming up. The second framework, because each control now has to link to several requirements without being re-keyed. The second contributor, because versions start multiplying. The first audit, because the evidence, its date and its approver all have to be found again. Below those thresholds a spreadsheet is fine. Above them, the time goes into formatting and searching rather than into analysis. With Vailor, the AI reads your documents and prefills the risk assessment: your experts spend their time checking and deciding, not re-keying.