Independent customer-benchmark study
N = 275 programs
Inventory, Risk & Control Evidence for AI
Table of Contents
ToggleHow 275 Continuum GRC programs govern generative AI, machine-learning systems, and third-party AI services — framework adoption, inventory completeness, evidence gaps, and the labor cost of getting AI into the compliance program.
Executive Summary
AI is already inside most compliance scopes in this sample. What is missing is not interest — it is inventory discipline, risk classification, and assessable evidence. Programs that bolted AI onto an existing SOC 2 or NIST library without a system register, human-oversight records, and vendor AI clauses produced the largest gap lists. Programs that treated AI systems as first-class assets — with owners, risk tiers, and mapped controls — closed those gaps faster and spent less labor sustaining them.
Study Methodology
Independent analysis of 275 Continuum GRC customer programs from January 2025 through June 2026. An AI system is any generative AI service, trained or fine-tuned model, decisioning model, or third-party AI feature that processes organizational data or influences a business or security decision in scope of a formal assessment.
Of the 275 programs, 187 (68%) had at least one AI system in scope. Maturity, inventory, and evidence metrics below are calculated on that AI-active subset unless noted as full-sample. Framework mix of the full sample: CMMC 38%, FedRAMP/StateRAMP 22%, SOC 2 19%, NIST 800-53/FISMA 12%, other 9%.
AI systems in scope
AI Governance Maturity
Most programs are past “no policy” and still short of continuous control. The middle band has an AI use policy and a partial inventory, but incomplete risk tiers, thin testing evidence, and weak vendor AI clauses.
Maturity bands (AI-active programs, n=187)
| Band | Share | Typical state |
|---|---|---|
| Ad hoc | 24% | AI in use, no register, reactive answers to assessors |
| Foundational | 41% | Policy exists, partial inventory, limited testing evidence |
| Managed | 26% | Full inventory, risk tiers, mapped controls, recurring review |
| Advanced | 9% | ISO 42001 or equivalent operating, continuous monitoring, vendor AI clauses enforced |
Framework Adoption
ISO/IEC 42001 is rising but still early. NIST AI RMF is the most common mapping target among U.S. programs. EU AI Act obligations appear where products or users sit in the EU, not only where the company is headquartered.
AI framework posture (AI-active programs)
| Framework or obligation | In active use | Exploring / planned |
|---|---|---|
| Internal AI use policy only | 71% | — |
| NIST AI RMF mapping | 34% | 29% |
| ISO/IEC 42001 (pursue or certified) | 19% | 27% |
| EU AI Act readiness work | 16% | 22% |
| SOC 2 criteria extended for AI | 28% | 18% |
| FedRAMP / CMMC AI overlay notes | 14% | 21% |
Inventory & Classification
You cannot govern what you have not named. Average AI-active program lists 4.2 systems or services. Completeness of that list — and a risk tier for each entry — separates managed programs from foundational ones.
Inventory completeness
What is on the register
| Asset type | Share of inventoried items |
|---|---|
| Third-party SaaS with generative AI features | 38% |
| Enterprise copilots / assistants | 24% |
| Internally fine-tuned or hosted models | 17% |
| Decisioning / scoring models | 12% |
| Other (agents, RPA+LLM, research tools) | 9% |
Control Evidence Gaps
Assessors ask for proof of inventory, risk assessment, human oversight, data handling, testing, and incident response for AI systems. The weakest evidence families in this sample were bias/fairness testing and post-deployment monitoring records.
Share of AI-active programs with current evidence
| Evidence type | Present | Coverage |
|---|---|---|
| Approved AI use policy | 71% | |
| AI system inventory | 63% | |
| Human oversight / escalation design | 52% | |
| Complete system or model cards | 41% | |
| Data-handling / training-data notes | 36% | |
| Bias / fairness testing evidence | 28% | |
| Post-deployment monitoring records | 24% |
Third-Party AI Risk
Most AI exposure in this sample arrives through vendors, not custom model training. Programs that only ran a generic SOC 2 questionnaire on those vendors missed model-training rights, retention of prompts, subprocessors, and opt-out of training. The 31% with explicit AI clauses were far less likely to carry open findings on third-party AI during assessment.
Labor & Cost
AI governance is a layer on top of existing frameworks, not a free add-on. Manual programs spent about 180 hours a year keeping inventory, risk reviews, policies, vendor AI assessments, and control narratives current. Automated programs spent about 55 hours.
Annual AI-governance hours, manual programs
Manual annual labor at $125/hr
Annual hours when inventory, mapping, and authoring are automated
Automated annual labor — 69% below the manual path
Annual AI-governance hours
Annual AI-governance labor cost
Automation & A.ITAMBot
A.ITAMBot accelerates AI control narratives and readiness writing
Where AI controls are mapped in Continuum GRC, A.ITAMBot reduced authoring time for AI policies, system-card language, risk statements, and assessment narratives by 92% — the same rate measured on classic control writing — because the bottleneck is structured drafting from a mapped record, not the subject matter alone.
What automation covers well
- AI system register as a living inventory
- Control mapping from NIST AI RMF / ISO 42001 into the unified library
- Vendor AI questionnaire workflows and evidence storage
- Narrative drafts for policies, system cards, and risk statements
What still needs humans
- Risk-tier decisions and prohibited-use calls
- Acceptance of residual model risk
- Bias testing design and interpretation
- Live demos of human oversight for assessors
Measured effect
- 69% less annual AI-governance labor when inventory and mapping are automated
- 92% less time on AI-related technical writing with A.ITAMBot
- Fewer late findings on “no inventory” and “no AI policy”
Recommendations
- Build the AI system register first. Everything else — risk tier, control map, vendor clause — depends on a named inventory.
- Classify every entry (limited, high-impact, prohibited). 59% without a tier cannot prioritize testing or oversight.
- Map AI controls into the same library as SOC 2, NIST, CMMC, or FedRAMP. Do not maintain a parallel spreadsheet program.
- Require AI-specific vendor questions and contract language for any SaaS feature that trains on or retains prompts.
- Collect operating evidence for human oversight and post-deployment monitoring the same way you collect access reviews — on a schedule.
- Use A.ITAMBot for policy, system-card, and risk-statement drafts once the inventory and control map exist.
Continuum GRC and AI Governance
Continuum GRC (IT Audit Machine®) and A.ITAMBot™ treat AI systems as governed assets: inventory, risk classification, control mapping across NIST AI RMF and ISO 42001, vendor evidence, and assessor-ready narratives. In this sample, automated AI-governance programs ran at about 55 hours a year versus 180 hours for manual programs — a 69% reduction — before counting the 92% authoring gain on AI-specific technical writing.
AI governance is no longer optional for programs that already claim strong security and privacy controls. The benchmark is whether the AI system is named, classified, evidenced, and written into the same system of record as every other in-scope control.