By Yair Kuznitsov, Co-Founder & CEO, Anecdotes

Every week I talk to enterprise GRC teams who understand exactly what agentic AI can do for their profession. They've read the articles, seen the demos, and can articulate the difference between AI that makes a workflow go a little, or even a lot faster, and an agent that replaces it entirely.

Yet still, some remain reluctant to make the shift to agentic GRC.

When I ask why, the conversation moves away from technology pretty quickly. Most of them have the "AI budget" available, but something is holding them back from making the move and they can't always name what it is.

The conversations all eventually lead to the same place, even if they can’t say it in so many words: they're not sure who they are when the operations aren't theirs anymore. It's an identity and even value question above all else.

Most GRC practitioners carry an implicit belief about where their value comes from. That belief isn't wrong, but it's describing a role that's being restructured, and those who make the transition the fastest will be the ones leading the industry in the coming years.

The Competence That Got Us Here

GRC professionals built their expertise around operational competence. Knowing how to gather the right evidence, managing audit cycles under pressure and keeping a complex compliance program running when it's understaffed and under-resourced have been signs of a valuable GRC team member for years.

That competence took years to develop, and the people who have it are genuinely good at what they do and are rightfully valued by their business.

The problem with agentic GRC is that it doesn't reward that competence the same way. Agents can gather evidence, open remediation tasks and can manage most of the audit cycle alone. Given that agents can handle those operations, the actual question is what a GRC professional is supposed to be doing instead, and most organizations haven't asked it yet.

The Shift They've Been Waiting For

GRC wasn't designed to be an operational function. It was designed to help organizations understand and manage risk. The evidence collection, the audit cycles, the status updates were always implementations of that purpose, not the purpose itself. The practitioners who got into this field weren't drawn to it because of the “fun” of evidence collection.

They cared about whether the organization was actually protected, or just appearing to be, and wanted to provide that insight to the business.

What happened over time is that the tooling didn't scale with the programs, and the operational burden consumed everything. The people who were supposed to be thinking about risk spent most of their time keeping the machine running, not because it was ever the point of the role, but because someone had to do it and there wasn't another way.

What Agents Do, and What They Can't

Someone has to define the risk appetite, decide what "remediated" actually means, know when the output looks right and when something is missing that the system can't see.

Agentic GRC in Anecdotes is built around exactly this model. The agents handle the operations end to end, based on the robust data foundation we have spent years building, and the logic the GRC team defines. 

When agents can handle the evidence chains, control testing, and audit prep, the question of what GRC should actually be doing shifts. And for practitioners with real depth, that answer is what they've always known how to do. But that doesn't make the shift easy.

Redefining a role is hard and comes with real fears. Many people are worried about their jobs because of AI, some more rightfully than others.

For GRC professionals specifically, this is less a threat than it is the opportunity they've been waiting for.

The practitioners who've made this shift describe it less like learning something new and more like getting permission to do what they were trained to do.

Their job became telling the agents what matters: setting the right risk appetite, deciding which controls are genuinely protecting something and which ones exist because they always have, knowing when an automated finding is a real problem and when it's noise, and translating business context into compliance logic in ways no agent can replicate, because that translation requires judgment built from years of experience.

That judgment has been sitting in GRC teams all along, waiting for the operational load to lift.

The organizations that move first on this won't win because their teams are better at AI. They'll win because their GRC teams finally have the time and the mandate to do what compliance was supposed to do: think clearly about risk, act on what actually matters, and stop managing a program and start leading one.

Why Letting Go Feels Like Losing

The reluctance that comes up in these conversations makes more sense when you frame it this way.

Practitioners aren't afraid of losing their value; they're afraid of losing the operations that became their identity, even though those operations were never what they wanted. Letting that go feels like losing something, which makes it hard to see what's waiting on the other side. And what is waiting is far more aligned with why they got into this work in the first place.

The shift, when it happens, is less a transformation than a return to what the role was always supposed to be.

Learn more about agentic GRC with Anecdotes at anecdotes.ai

Sponsored and written by Anecdotes.