Risk doesn’t wait for your next quarterly review, but most governance programs still operate as if it does. The problem is structural. Risk accelerates continuously, while governance runs on a calendar. The gap between those two speeds is where most enterprises are exposed, and many don’t realize it until something breaks.
Three pressure points are testing GRC teams right now:
- Third-party risk is moving faster than traditional vendor reviews can keep pace.
- Regulators increasingly expect real-time controls on AI, not checkbox compliance.
- Emerging risks are opening policy gaps that existing frameworks were never designed to cover.
Enterprises that are ahead have shifted from calendar-driven governance to continuous intelligence and real-time control. Those still running annual reviews are growing more exposed with each quarter.
Where the speed problem shows up
The central question isn’t whether your governance works in principle. It’s whether it moves fast enough to match how quickly risk moves. If your team spends most of its time assembling evidence and chasing questionnaires, it is documenting what already happened rather than preventing what comes next. Policies that don’t address emerging risks leave blind spots, and breaches that catch you by surprise are usually the clearest sign that the speed problem has arrived.
These developments aren’t necessarily new risks, and they aren’t obstacles to your strategy. They do make a strong case for continuing to evolve your governance, risk, and compliance approach.
Third-party risk is now the main way breaches happen
Third-party risk has been on risk radars for years, from security breaches to supply chain disruptions. What has changed is the scale of connectivity. Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches now involve a third party. Canva recently disclosed that attackers exploited a vendor’s vendor to reach company data without touching Canva’s own systems. Organizations that rely on quarterly or annual vendor reviews are working from stale information in an environment where risk signals arrive constantly.
AI and cybersecurity risk are now operational resilience issues
AI risk is on nearly every organization’s radar, and regulators are following suit. By the end of October, Eurozone banks must submit comprehensive action plans showing how they test AI systems against cyberattacks and govern frontier AI risk. The three EU financial supervisors, the EBA, EIOPA, and ESMA, have also issued a joint statement clarifying that frontier AI cyber risk falls under the Digital Operational Resilience Act’s existing ICT risk rules.
Two practical implications follow:
- AI governance can’t be a compliance checklist. Risk appetite needs to be built into model execution so that policy applies when a prompt reaches the model, not after the fact.
- Even when frameworks stay the same, the library of regulatory obligations needs regular validation.
Existing controls have emerging blind spots
Market abuse and insider trading concerns are typically handled through personal trading control programs designed for traditional securities and brokerage accounts. Prediction markets, tokenized securities, and digital assets are creating new trading venues for employees, and controls built for known risks need to account for them. An obligation-driven design helps. It evaluates controls continuously against both established and emerging obligations, flags gaps, and routes updates to policy owners with the context they need to act.
Listen to the latest episode
The newest episode of The Signal, our intelligence briefing for risk and compliance leaders, covers these three market signals and shows how the most advanced enterprises are building governance that keeps pace with change. It will help you judge whether your governance model is fast enough for the environment you operate in.
Ask your team this question: how fast are your controls adapting compared to how fast risk is moving? The answer will show you where your program stands.
Want to see how continuous, obligation-driven governance works in practice? See a demo of Archer Evolv™ and walk through how your controls can update as fast as the risks they’re meant to manage.
Frequently Asked Questions
Continuous governance monitors risk, regulatory change, and control performance on an ongoing basis, rather than relying on periodic reviews. Instead of assembling evidence before an audit or annual review, your team can see gaps as they emerge and respond while they’re still manageable.
Third-party risk signals, such as security events, compliance status changes, and supply chain disruptions, arrive continuously. A review conducted once a quarter or once a year can miss a vendor’s controls breaking down or a breach affecting one of its own vendors. Ongoing monitoring helps teams detect those signals much sooner.
Archer Evolv™ AI Compliance translates governance obligations into runtime guardrails, so policies are applied when a prompt reaches the model rather than after the fact. Each guardrail breach is logged and traceable, which supports the documentation regulators expect. Confirm the current capabilities and supported platforms with the product team before publishing, since the brand standards require approval for some product language.
Archer Evolv™ picks up regulatory statements and evaluates them against your existing control library, then surfaces gaps and routes updates to policy owners with the context they need. Teams can validate existing controls against new obligations rather than building new ones from scratch.
The Signal is Archer’s monthly look at the news and events shaping risk and compliance. Each episode brings together the stories worth watching and looks beyond the headline to understand what they reveal about the way organizations manage risk, obligations and change.
