Just 1.6% of GRC functions have ‘fully integrated’ AI into their processes, and 32% haven't adopted AI for GRC purposes at all — despite 47% of firms planning to increase automation investment more broadly.
Concern about AI-driven job displacement is comparatively low: 41.3% of GRC professionals say they are ‘not concerned at all’.
Key Statistics
- Only 1.6% of GRC functions have ‘fully integrated’ AI into their processes.
- 32.0% are ‘in the early stages’ of incorporating AI into their compliance framework.
- 32.0% have not yet adopted AI for GRC purposes at all.
- 41.3% are ‘not concerned at all’ about AI-driven job displacement in GRC; only 11.3% are ‘very concerned’.
- 32.8% of GRC functions report ‘little or no engagement’ in other departments' AI implementation.
- 23.5% of GRC functions have a full ‘partnership approach’ with the business on AI implementation.
Source: ICA Global GRC Survey 2025. Survey of 383 practitioners across 87 countries and 30+ sectors.
How embedded is AI within GRC at your firm?
AI adoption within GRC functions is real but still early-stage. Only a combined 3.2% of firms say AI is either ‘fully integrated’ or something their GRC department ‘relies heavily on’.
Roughly a third are in early implementation and a further third haven't adopted it at all — a near-even three-way split between leading, following, and not yet starting.
| Level of AI adoption | % of respondents |
|---|---|
| AI is fully integrated into our GRC processes | 1.62% |
| Our GRC department relies heavily on AI for monitoring and reporting | 1.62% |
| We are in the early stages of incorporating AI into our compliance framework | 31.98% |
| AI plays a role in our efforts, but there are areas still managed manually | 14.57% |
| AI is used sporadically within GRC | 12.55% |
| AI has not yet been adopted for GRC purposes in our firm | 31.98% |
| I'm not sure | 5.67% |
Concern about AI-driven job displacement in GRC
Anxiety about AI replacing GRC roles has eased since the early wave of ChatGPT-era concern: a clear majority (78.6% combined) are either ‘not concerned at all’ or only ‘slightly concerned’, and just 11.3% are ‘very concerned’.
| Level of concern | % of respondents |
|---|---|
| Not concerned at all | 41.30% |
| Slightly concerned | 37.25% |
| Very concerned | 11.34% |
| Not sure | 10.12% |
GRC's involvement in supporting other functions' AI implementation
Engagement varies widely by firm. Nearly a third of GRC functions (32.8%) report ‘little or no engagement’ in other departments' AI rollouts, while a similar-sized group (32.4%) are engaged early as a supporting consultancy, and 23.5% have a full partnership approach with the business.
| Level of GRC engagement | % of respondents |
|---|---|
| Partnership approach with compliance and business | 23.48% |
| Early engagement, supporting consultancy role to the business | 32.39% |
| Late-stage engagement in a supporting/consultancy role | 11.34% |
| Little or no engagement | 32.79% |
Summary
The overall picture is a function that's cautious rather than resistant: GRC professionals aren't blocking AI, but adoption within GRC itself is lagging other business units (the Bank of England reported 75% financial-sector AI usage by the end of 2024, concentrated in Operations and IT), and involvement in AI governance elsewhere in the business is inconsistent from firm to firm.