The signal
Security and compliance tools increasingly use AI to adjust access and flag risky activity in real time. Fully self-adjusting controls are rare and auditors are still working out how to review them.
Where it could lead
Faster-changing risks need faster controls. But if the rules change themselves, companies need new ways to prove they’re still in control.
Evidence that would strengthen the case
- Audit standards updated for AI-managed controls
- Regulators accept continuous AI monitoring as evidence
- Companies report fewer incidents and lower compliance costs
What could prevent it
- An AI-adjusted control causes a serious failure or fraud
- Auditors refuse to certify systems they can’t fully explain
- Regulators require human sign-off for every change