Rethinking GRC Transformation in an AI-Driven World at Archer Summit: Accelerate in Rome

Written by Rossano Magro, Archer’s Sales Director for South Europe

---

There’s a point in every transformation where the conversation has to shift. The vision has been defined, the technology selected, the business case made. Then comes the harder part: How do you actually make it wo rk across a complex organization? How do you keep delivering value long after go-live?

That’s the conversation I’m most interested in at Archer Summit: Accelerate in Rome on October 14–15.

The event brings together customers, partners, and risk leaders exploring what’s happening across GRC right now, from AI governance to product innovation to the messy, complicated reality of scaling transformation. One session in particular caught my attention: “From Vision to Value: Delivering and Sustaining at Scale.” It features Fabien Massol and Pablo Valladares from Amadeus, along with Archer’s Bharath Madhuchandra, and they’re tackling something that rarely gets honest airtime: transformation is almost never as clean as the roadmap suggests.

In GRC, you’re not just implementing technology. You’re bringing together processes, people, data, systems, and competing organizational priorities. The real test isn’t go-live day. It’s whether the organization can actually adopt the platform, build on it, and keep extracting value as the business inevitably changes.

Why customer stories matter more than product specs

Here’s what I’ve learned about GRC transformation: technology solves about half the problem.

A new platform creates capabilities that didn’t exist before, sure. But capabilities only become valuable when they’re woven into how people actually work. That requires understanding what the organization really needs (not just what it says it needs), getting the right stakeholders involved, being willing to adapt processes, and building in room for the solution to evolve.

Customer stories cut through the noise here because they move the conversation from “what could this theoretically do?” to “what does it actually take to make this work inside a real organization?” That’s why I’m genuinely interested in hearing directly from the Amadeus team about their journey. Beyond just implementation, they’re taking it a step further with what it takes to make transformation stick in a complex environment, which is a very different thing.

AI is changing what GRC teams can actually do

At Archer Summit, we introduced several new capabilities designed for AI’s changing role in GRC: Archer Evolv™ Foundation, Archer Evolv™ Workplace, and Archer Evolv™ AI Compliance.

What interests me most is what these capabilities represent about the direction GRC is heading. Archer Evolv Foundation provides the intelligence layer and GRC context that lets AI work with the information and relationships already present in the organization’s risk environment. Archer Evolv Workplace builds on that with AI Operators that can handle defined GRC work under human supervision.

That’s a meaningful distinction. Instead of asking AI to generate an answer, we’re thinking about where AI can actually take on real work. A risk professional might still own the decision, but the work surrounding that decision looks fundamentally different when AI can handle the information gathering, content analysis, issue identification, and prep work.

The goal isn’t to remove people from GRC, but rather give them the capacity to focus on the decisions and judgment calls where their expertise actually matters.

Governance that works in the real world

Here’s where things get interesting, though. As organizations put AI to work in more parts of the business, a new question becomes critical: How do you govern the technology while you’re using it?

Having a good AI policy matters. Understanding what that policy says matters. But neither one answers the fundamental question: what happens when someone actually runs an AI system? That’s where Archer Evolv AI Compliance comes in. It brings governance into the runtime itself, using Amazon Bedrock Guardrails to apply controls before the model responds. It also connects activity and evidence back into the GRC environment, giving organizations real visibility into how their AI controls are working in practice.

To me, this is another example of that shift from vision to value. Saying your organization wants responsible AI is one thing. Actually building the controls, processes, and technology to make those principles operational is another. The same applies to GRC transformation more broadly: strategy only becomes valuable when it’s actually usable, when processes support it, and when the organization can point to real results.

What Formula 1 can teach risk leaders about pressure

I’m also looking forward to something completely different. Bernie Collins, Formula 1 race strategist and broadcaster, is closing the event with “High Performance Under Pressure: What Formula 1 Can Teach Us About Risk and Resilience.”

Formula 1 might seem far removed from GRC, but the underlying challenge is exactly familiar territory for risk leaders. Making decisions when conditions are constantly shifting, information is coming at you fast, and you don’t have the luxury of waiting for perfect certainty, that’s the world risk professionals live in every day. Regulations change without warning. Business priorities shift. New technologies introduce risks you didn’t anticipate. Third parties evolve. And now AI is accelerating all of that at once.

No organization can predict everything in advance. What it can do is build the capabilities, processes, and governance required to respond effectively when something changes. That’s essentially what Bernie’s talking about: making decisions that work when the pressure is on and the situation is moving.

The part of transformation that actually matters

That’s what makes Rome particularly timely. The event brings together different angles on the GRC challenge. You’ve got the Amadeus conversation about real-world transformation complexity. Product strategy and AI developments from Archer. Risk leaders thinking through how to govern AI while they’re using it. And a completely different perspective on high-performance decision-making under pressure from Formula 1.

Each conversation approaches the problem differently, but they’re all wrestling with the same core question: How do you turn strategic change into something that actually works in practice?

That’s the part of transformation I find genuinely interesting. The launch announcement is exciting. The technology is exciting. The vision of what an organization could do differently—that’s exciting too. But success isn’t measured in those moments. It’s measured later, when people are actually using the technology, when processes have shifted, when the organization is seeing measurable value, and when the program keeps evolving to meet new needs.

That’s when transformation stops being a project and becomes the way the organization operates.

As AI continues reshaping what’s possible in GRC, I think that distinction is going to matter more than ever. Organizations that can connect strategy with execution, innovation with governance, and technology with the people who actually use it will be far better positioned to handle whatever comes next.

Register for Archer Accelerate in your city: https://www.thearchersummit.com/accelerate

Learn more about Archer Evolv: https://www.archerirm.com/explore-archer

---

FAQs