A bank evaluating how to govern its AI usually already owns a GRC platform - the governance, risk and compliance system where policies live, risks are logged, and audit evidence is assembled. So the natural question is: why would AI need anything the GRC platform does not already do?
For a lot of what a bank governs, it would not. For AI specifically, the honest answer is that GRC and AI governance were built around different assumptions, and the gap between those assumptions is where banks get caught.
This is not an argument that GRC is obsolete. It is an argument that AI sits awkwardly inside a tool designed for a different shape of risk, and it is worth understanding exactly where the awkwardness is before deciding how to cover it.
What GRC was built to do
Traditional GRC platforms are built around a particular model of risk: identifiable, ownable, and relatively stable between reviews. A risk is entered into a register, assigned an owner, assessed, mitigated, and revisited on a cycle. Controls are mapped to frameworks, evidence is collected for audit, and the whole thing runs on a cadence - quarterly, annually, around an audit date.
That model is a good fit for most of what a bank manages. Operational risk, credit risk, the control environment behind a regulated process - these are things that can be enumerated, assigned, and reviewed periodically without much being lost between reviews. GRC is, in effect, a system of record for risks a human has already identified and written down.
The key assumption underneath it is that the risk is known. Someone identifies it, and the platform helps manage it from there. For a static estate, that assumption holds.
Where AI breaks the assumption
AI breaks the "the risk is known" assumption in two specific ways, and they are the two things a register-and-cadence model is least equipped for.
The first is discovery. A GRC register governs the risks entered into it - but the defining problem of AI risk is that much of it is never entered, because nobody knows it is there. An AI feature switched on inside an existing tool, a model wired into a workflow, an assistant that arrived in a vendor update: these do not announce themselves to the person maintaining the register.
GRC has no native mechanism to find them, because it was never designed to - it assumes the risk reaches the register through a human who already knows about it.
The second is pace. Even for the AI a bank does know about, the risk profile changes faster than a review cycle. A model is retrained, a feature is added, a vendor swaps its sub-processor, and the register entry, accurate at the last review, quietly stops describing the thing. A cadence built around audit dates cannot track a dependency that changes between them.
So the gap is not that GRC does the job badly. It is that two of AI governance's core jobs - finding the AI, and keeping pace with it, sit outside what a register-and-cadence system was architected to do at all.
What AI governance adds
Purpose-built AI governance is, in architectural terms, the layer that produces the inputs a GRC register assumes it already has. It starts where GRC can't: with discovery of the AI actually running in the estate, including the features and providers nobody recorded.
It then classifies each one against the frameworks that apply - for an EU bank, the EU AI Act, DORA, GDPR and NIS2 at once, often against the same tool, and it does both continuously, because the estate it is watching does not hold still.
The relationship is not either/or. The AI governance layer and the GRC platform fit together: AI governance finds and classifies the AI and produces the framework-specific outputs, and those outputs can feed the GRC system of record where the bank's wider risk and audit picture lives.
One generates the AI inputs; the other holds them alongside everything else. A bank that tries to make its GRC platform do the discovery-and-classification job is asking a system of record to be a system of detection, which is not what it is.
Why this matters more for a bank
For an EU bank the gap is sharper than for most organisations, for two reasons.
The first is regulatory density: a single AI tool in a bank can attract obligations under four regimes simultaneously, each with its own classification logic and evidence demands. A register built to map one control to one framework strains when one tool has to be assessed against four at once, continuously.
The second is supervision: banks are examined, and an examiner testing AI governance will test it against the estate as it actually is, not as the register last described it. The distance between those two is exactly the distance a cadence-based system leaves open.
I will be straight about the practical upshot, because it is not "replace your GRC." A bank's GRC platform remains the right home for most of its risk and compliance picture. The point is narrower: the specific work of finding AI, classifying it against several regimes, and keeping that current is a different capability from maintaining a risk register, and expecting one tool to do both is where the coverage gap opens.
The bank that governs AI well is not the one with the biggest GRC platform. It is the one that recognised finding-and-classifying AI as a job of its own, and gave it a tool built for that job, feeding the register it already had.
Frequently asked questions
What is the difference between AI governance software and a GRC platform?
Montro's position is that they are built around different assumptions. A GRC platform is a system of record for risks that have already been identified - it registers, assigns, assesses and reviews them on a cadence. AI governance software is a system of detection and classification: it discovers the AI actually running in the estate, classifies each tool against the applicable frameworks, and does so continuously. GRC assumes the risk reaches it; AI governance generates that input. The two complement each other rather than overlap.
Can a bank use its existing GRC platform to govern AI?
For part of the job, yes - the GRC platform remains the right home for the bank's overall risk and compliance record, including AI risks once they are identified. What it is not architected to do is find the AI in the first place, or keep pace with how fast AI risk changes between review cycles.
Those are the gaps a purpose-built AI governance layer fills, feeding its outputs into the GRC system of record.
Why is AI harder to govern than other bank risks?
Because two assumptions that hold for most risks break for AI. Most bank risks are known and relatively stable between reviews; AI risk is often undiscovered (features switched on without anyone recording them) and fast-changing (models retrained, vendors swapping sub-processors). A register-and-cadence model handles known, stable risk well and undiscovered, fast-changing risk poorly, which is why AI needs a capability GRC was not designed to provide.
Does an EU bank need both GRC and AI governance?
In practice, yes - they do different jobs. The GRC platform holds the bank's broad risk and compliance picture and its audit evidence; the AI governance layer discovers and classifies the AI estate against the EU AI Act, DORA, GDPR and NIS2, and keeps it current.
The effective pattern is the AI governance layer feeding the GRC system of record, not one replacing the other.
