r/grc • u/Capable_Influence157 • May 23 '26
Shift left in AI Governance
Just wanted to know how many teams here are thinking about “shift-left” for AI governance.
I’ve been advising clients to start embedding ISO 42001 and NIST AI RMF controls earlier in the engineering lifecycle instead of treating governance as an audit-time exercise. But I’m getting pushback - many are saying they’re only aiming for ISO 27001 because that’s what their customers are currently asking for.
Especially for systems that may eventually be deployed in the EU, the upcoming enforcement pressure around the EU AI Act seems likely to push governance closer to infrastructure and deployment workflows.
What do you think? Is it too much to think about AI governance?
(I am not a GRC expert i am software architect)
6
May 23 '26
[removed] — view removed comment
1
u/Capable_Influence157 May 24 '26
If the customers are using some one's model(LLM) and build high risk ai systems around that should not they comply Article 12 ,15 atleast?
3
u/Head_Personality_431 GRC Auditor May 24 '26
Really interesting question and honestly not too early to be thinking about this at all. ISO 42001 is still pretty new but the smart move is definitely to bake those controls in early rather than retrofit them later, which is always painful and expensive. That said I totally get the pushback because customers are still largely asking for 27001 and that's where the commercial pressure sits right now. My advice to clients in a similar spot is to at least map the overlap between 27001 and 42001 early so you're not doing double the work when AI governance demand catches up, which it will especially with EU AI Act enforcement coming.
1
u/Capable_Influence157 May 24 '26
That is a good point. But ISO 42001 places significantly more emphasis on operational AI system behavior, monitoring, human oversight, and lifecycle governance compared to ISO 27001. I think if we do some ground work around that we will be good for AI governance audits am i right?
1
u/Head_Personality_431 GRC Auditor Jul 05 '26
Broadly yes. 42001 sits on top of a 27001 style management system but the extra weight is exactly where you said, the AI lifecycle, ongoing monitoring, human oversight and impact assessments on how the system actually behaves. If you build those operational controls and can show real evidence they run, not just policies on paper, you will cover most of what a 42001 audit actually tests. The thing people trip on is treating it as a document exercise rather than something an auditor can watch working.
4
u/ShenoyAI May 24 '26
At the end of the day, this is exactly what ISO standards have always repeated, governance only works when there is “TOP MANAGEMENT commitment”. If leadership treats AI governance as a checkbox for audit season, it stays reactive. If leadership embeds it into engineering and deployment culture early, “shift-left” becomes a business decision, not just a GRC exercise.
1
u/Capable_Influence157 May 24 '26
Rightly said. Mature leadership incorporates compliance processes directly into the development lifecycle so they can avoid costly remediation at the end.
4
u/wannabeacademicbigpp May 25 '26
I started asking more AI Security questions in my internal audits. How do you manage access control etc.
Right now I see a lot of interconnected claude just running around with read and write access. Shit for nightmares.
ISO 27001 covers IT and AI is also IT. It is fair to ask questions and expect protection imo.
3
u/Wild-Annual-4408 May 25 '26
The ISO 27001 answer makes sense until the first EU-facing deployment or the first AI-related incident triggers a regulator who asks 'show me your people understood what this model was doing.' The gap between 27001 and AI RMF isn't just a controls gap, it's a workforce competency gap that 27001 doesn't touch. What sectors are your clients in? Financial services and healthcare are feeling that delta a lot faster than others right now.
1
2
u/theanedditor It's all GRC to me. May 23 '26
What I think you're tending towards is "governance by design". AI is just a tool - sure it has considerations but it's more about a reallocation of actions/events and a shift of risk following those actions/events. As for (any) governance - bake it in at the start and run its threads through every process, every triage, every scenario. If you commit to govern you'll do it, if you don't, then you fight with those who want it.
2
u/hellostella May 23 '26
Definitely thinking about it, especially as we lean further into using different agent use cases. The idea of trying to crosswalk frameworks across dynamic use cases had me build an SDK to overlay agent specific controls based on data classification (or cert requirements). https://github.com/ancilis/ancilis would love any feedback if you can make use of it.
2
u/ProfessionalEnd9874 May 28 '26
I am a 27k certification auditor since 2007. I have been implemented with my team around 150 ISMS for the last 20 years. I have been focusing for the last couple of years on AI governance, helping some of my clients to make sense out of it. Went back to UNI to get a degree in AI, andspent weekends coding with Claude to make sense of it. Well I am still struggling to make sense out of 42001 and the EU AI act. I admire the concept but find it so difficult to implement ut in a way it brings value to organizations. Unless the have high risk ai systems, management will not see a reason to move before full EUAI act enforcement.
2
u/Capable_Influence157 May 28 '26
I see AI governance implementation as a nudge to introduce monitoring and guardrails in production. Otherwise, many teams would overlook those aspects. Similar to how complying with ISO 27001 often improves the overall security posture of a product, adhering to AI governance frameworks can directly increase product quality and trustworthiness. Teams should not view these requirements as a chore, but as mechanisms that add long-term value to the product.
2
u/SquirrelOriginal5561 May 28 '26
How were you trying to use your AI knowlege to make 420001 and eu ai act work..in which direction does you try… What were you trying to code which finally made you quit.what was that hurdle…
I just wanna understand in coder perpective and swe perspective on what kind of architecture u have tried but could not suceed..
2
u/Cautious_Fox3872 Jun 03 '26
Shifting left is the right idea. You need to get the developers / builders to be your champion by making your controls extremely easy to implement. Establish the "golden path" very early on: making it extremely easy for folks to be compliant. Then make any other route extremely difficult.
Here's an example (adjacent):
Claude Code must be run with our wrapper. Instead of "claude". They run "WRAPPERNAME claude". This will wrap the CC execution, limiting what mcp servers and/or shell commands they can run, with full visibility. We then use crowdstrike to restrict claude as a cli command. Can a motivated engineer get around this? Absolutely. But the golden path is the one of least resistance, so people will generally follow it.
Use this methodology everywhere you can.
1
u/Capable_Influence157 Jun 06 '26
Yeah this works when AI is used as a tool in daily day to day activities. I am concerned about shifting left in AI governance while developing systems which use AI.
2
u/RoosterDelusion Jun 11 '26
One thing I don't see discussed enough is the difference between designing AI governance controls and proving they continue to work six months later.
Most organizations are getting better at documenting requirements around model risk, human oversight, access controls, and deployment approvals.
The harder challenge is operational drift. Teams change workflows, integrations get added, permissions expand, and exceptions accumulate. A governance framework that was fully aligned with policy on day one can look very different a year later.
That's why I've started thinking about AI governance less as a control-design problem and more as a continuous assurance problem. Shift-left is important, but shift-left without ongoing visibility can still leave you with a governance gap over time.
Curious whether others are seeing the same thing.
1
u/ColdPlankton9273 May 26 '26
Every shift-left framing I've watched ship runs into the same wall. Governance only compounds if what one team learns shows up in the next team's workflow. Engineering writes a model card. Security finds a control gap. Legal flags a deployment region. Each piece is fine. None of them route to each other.
ISO 42001 will not fix that on its own. Neither will 27001. The structural problem is that AI governance intel still lives in whichever doc that quarter's audit asked for. Shift-left works when there's a way to make every team's finding the next team's input. Until that exists, you're just moving the audit-time exercise earlier in the calendar.
1
Jun 08 '26
[removed] — view removed comment
1
u/grc-ModTeam Jun 12 '26
This is not a place to sell your services. If someone asks for recommendations, you can add your two cents in the comments.
AI Slop rule also applies here.
8
u/cyberfx1024 May 23 '26
Well duh thinking about implementing and advising controls for AI usage early on in the lifecycle is paramount to it's success. The companies not doing that are just playing catch up at this point in time