Does AI Governance Merge with GRC or Create a New Silo

In June 2026, Gartner published its first Magic Quadrant for AI Governance Platforms, assessing 13 vendors. An independent analysis of that publication finds that artificial intelligence is dissolving the boundaries that previously separated AI governance, data and analytics governance, business process governance, IT governance and classic GRC. For those responsible for governance, risk and compliance, this raises a structural question: should AI governance be integrated into the existing GRC function, or built up as a separate discipline alongside it. Regulation and standards already offer some initial guidance.

What Does the First Magic Quadrant for AI Governance Platforms Show?

In June 2026, Gartner assessed 13 vendors of AI governance platforms for the first time, confirming a distinct market for software that manages AI risk.

An independent analysis of the publication places the finding in a broader context: artificial intelligence is dissolving the boundaries that previously separated AI governance, data and analytics governance, business process governance, IT governance and GRC. This points less to a new, isolated discipline than to an extension of existing governance tasks to cover AI-specific questions. For organisations with an established GRC system, the relevant question is therefore less about adding another platform and more about which existing processes should absorb AI risk.

How Does the AI Act Regulate the Relationship Between AI Risk Management and Existing Processes?

Article 9 of the AI Act requires a continuous risk management system throughout the lifecycle of high-risk AI systems, but explicitly allows this system to be integrated into processes that already exist.

Under Article 9(10), providers already subject to risk management obligations under other Union law may integrate the relevant aspects into their existing processes rather than building a parallel system. Article 17 additionally obliges providers of high-risk AI systems to maintain a quality management system, and Article 10 sets out specific requirements for data governance and data quality: datasets must be relevant, representative, free of errors and complete, as far as this is possible. The legislator itself therefore applies an integration logic, even though the substantive requirements are new for many GRC functions. This stance contrasts with the public debate about the AI Act stifling innovation or imposing overregulation.

What Does ISO/IEC 42001 Offer as a Standalone Standard for AI Management Systems?

ISO/IEC 42001:2023 is the first international standard to set requirements for establishing, implementing, maintaining and continually improving an AI management system.

Like other management system standards, ISO/IEC 42001 is designed as a system that can be certified on its own, but it can equally be docked onto existing GRC structures, for example an existing information security or quality management system. This dual compatibility mirrors the logic of the AI Act: AI governance requires its own specialist building blocks, but does not need to be anchored organisationally apart from the rest of risk management. For those responsible for GRC, the decision therefore shifts from structure to resources: who contributes the expertise needed to handle intelligent risks, and which existing process carries the evidence.

Where Do Swiss Supervisors and Legislators Stand on AI Governance?

In Supervisory Notice 08/2024, FINMA does not call for a standalone AI governance structure but for the extension of existing governance, risk management and control systems, while the Federal Council is moving towards sector-specific AI regulation.

FINMA bases its Supervisory Notice 08/2024 on findings from ongoing supervisory activity and states that most financial institutions are still at an early stage of development. Every supervised institution must reconsider the effect of AI use on its risk profile and adapt its governance, risk management and control system to the applicable regulatory framework. As Switzerland has no AI-specific legislation, FINMA follows a risk-based approach that covers operational, data, IT and cyber risk as well as legal and reputational aspects.

The Federal Council has decided to ratify the Council of Europe’s AI Convention and to adapt Swiss law accordingly; Federal Councillor Albert Rösti signed the Convention on behalf of Switzerland. The Federal Department of Justice and Police, together with the Federal Department of the Environment, Transport, Energy and Communications and the Federal Department of Foreign Affairs, is to prepare a consultation draft by the end of 2026 setting out measures on transparency, data protection, non-discrimination and oversight. Legislative amendments are intended to be as sector-specific as possible, while any cross-sector rules should be limited to core areas touching on fundamental rights. The current maturity level of institutions is described in detail in FINMA’s survey on the use of artificial intelligence.

How Can This Integration Be Implemented in Practice?

The first step is to take stock of the AI applications already in use and map them to existing risk registers, controls and data protection processes.

The function responsible for GRC should complete this mapping within the current planning cycle before deciding on a separate AI governance function. Only after that can it be assessed which AI-specific gaps require additional expertise, for example around data quality under Article 10 of the AI Act or the explainability of model decisions. In most cases, these gaps can be closed through new roles and review steps within the existing structure, rather than through an additional silo.

FAQ

Frequently asked questions

Does a company need to set up a new department for AI governance?

No. The AI Act, ISO/IEC 42001 and FINMA Supervisory Notice 08/2024 all point towards integrating AI governance into existing governance, risk management and control structures. A standalone AI governance function is worthwhile only once the existing GRC structure demonstrably cannot cover the AI-specific requirements.

What does Article 9 of the AI Act require regarding risk management for high-risk AI systems?

Article 9 of the AI Act requires a continuous risk management system throughout the lifecycle of high-risk AI systems. Under Article 9(10), providers already subject to risk management obligations under other Union law may integrate these aspects into existing processes rather than building a parallel system.

Can ISO/IEC 42001 be certified on its own, or only as an addition to existing systems?

Like other management system standards, ISO/IEC 42001:2023 is designed as a system that can be certified on its own, but it can equally be docked onto existing GRC structures, for example an existing information security or quality management system. This dual compatibility mirrors the integration logic of the AI Act.

What role does FINMA Supervisory Notice 08/2024 play for Swiss financial institutions?

FINMA does not require a standalone AI governance structure but the extension of existing governance, risk management and control systems. Every supervised institution must reconsider the effect of AI use on its risk profile and follow a risk-based approach, since Switzerland has no AI-specific legislation.

What is the first practical step in embedding AI governance into GRC?

The first step is to take stock of the AI applications already in use and map them to existing risk registers, controls and data protection processes. Only after that can it be assessed which AI-specific gaps require additional expertise, before deciding on a separate AI governance function.

Sources

1. Article 9, risk management system for high-risk AI systemsAI Act Service Desk, European Commission
2. Supervisory Notice 08/2024 on governance and risk management in AIFINMA