Conversational GRC: work with your risk data from the AI agent you already use
Risk and compliance teams at financial institutions live in more tools than they would like. Controls sit in the GRC platform. Evidence sits in SharePoint. The board deck lives in PowerPoint. And increasingly, part of every day is spent inside an AI assistant like Claude or Microsoft Copilot, drafting, summarising, and analysing.
The deeper issue is not the number of tools. It is what all that switching costs. Gartner research puts it starkly: risk and compliance teams spend up to 40% of their time on manual data collection and reporting. That is work which does not require their expertise. Chasing evidence, compiling reports, reconstructing the same control documentation every audit cycle. Time that is not spent on the judgment only a risk professional can provide.
The CERRIX LLM integration is one practical step toward closing that gap. It connects CERRIX to the AI agent your team already uses, so you can work with your live risk and compliance data in plain language, without opening the platform.
What conversational GRC actually means
Through the CERRIX API, you connect the platform to Claude, Microsoft Copilot, or ChatGPT. From there, your team can ask questions and carry out tasks against real GRC data in natural language. No new tool to learn, no extra login. The data stays in CERRIX, the agent simply reaches it on your behalf, and every request stays inside the permissions you already have.
The short demo shows three things this makes possible. Each one is small on its own. Together they change how much of the day a risk professional spends assembling information versus acting on it.
1. Query your GRC data in plain language
Instead of logging in, filtering, and exporting, you ask.
"Show me every control I own and when it was last tested." The agent pulls the answer live from the CERRIX control register and returns it as a table in seconds. Control ownership, test status, linked risks, all queryable in the same window where you were already working.
Why it matters: the second-line risk manager spends less time building the picture and more time reading it. And because the answer comes straight from the register rather than a spreadsheet someone exported last month, you are looking at what is true today.
2. Take action without leaving the chat
Reading data is only half of the work. The integration can also make changes.
In the demo, the agent attaches a SharePoint link to a task and marks that task as done. On its own that is three clicks and a context switch. Multiply it across a team managing hundreds of controls, actions, and findings, and those minutes add up to a real share of the week.
The follow-up discipline that keeps a control framework current becomes far easier when updating it is a single sentence rather than a workflow. Less admin friction means fewer tasks that quietly fall through.
3. Turn results into board-ready reporting
What boards and regulators ask for is a clear, current view of where you stand. Producing it is usually a manual job: pull the numbers, format the slides, and hope they are still accurate by the time the meeting starts.
In the demo, the agent takes control testing results straight from CERRIX and turns them into a board-ready presentation. Because the underlying data is pulled live from the platform, the report reflects the state of your controls now, not the state they were in when someone last exported the data.
Watch it in action
Meet conversational GRC: the CERRIX LLM integration working on live GRC data, straight from the AI agent your team already uses.
Here is what the walkthrough covers, and what each step replaces:
Part of a bigger shift: from periodic and manual to continuous and intelligent
None of this is a standalone gadget. It is a small, concrete expression of where CERRIX believes GRC is heading, a shift we unpack in What does GRC look like in 2030?, the recap of Joachim Jonkers' on-demand webinar of the same name.
The operating model most organizations still run was built for a slower world: periodic assessments, evidence gathered by hand, and a patchwork of disconnected tools. It was not built for DORA, NIS2, the EU AI Act, and CSRD, which all expect continuous oversight rather than an annual attestation. The result, as CERRIX CPO Joachim Jonkers describes it, is a widening credibility gap: the distance between what a regulated organization is now expected to demonstrate and what a manual operating model can actually deliver.
Intelligent GRC is the answer CERRIX is building toward. Automation and AI layered on top of a single source of truth, so risk monitoring becomes continuous, evidence flows in automatically, and reporting reflects the present rather than the last review cycle. Three shifts define it:
Conversational GRC sits squarely inside that third shift. Every minute the agent saves on pulling a control list or assembling a report is a minute returned to interpretation, advice, and the honest conversations with the board that only a person can have.
There is an important sequencing point here, and it is easy to miss. CERRIX's position is that automation comes first and AI second. AI does not create value in isolation. It creates value when it operates on structured, centralized, connected data. Feed it fragmented inputs and it produces noise, not insight. This is precisely why the integration works: the agent queries a platform where risks, controls, evidence, and testing already live in one connected model. The AI is powerful here because the foundation beneath it is solid. Pointed at a pile of spreadsheets, the same agent would have nothing reliable to reach.
Built for the way regulated teams have to work
For a bank, insurer, or pension fund, the idea that an AI can touch your GRC data raises exactly the right questions. The integration is built around them.
- Everything runs on the CERRIX API. The agent is not handed a copy of your data. It queries the platform directly.
- Your permissions still apply. Users only ever see and change what their role already allows. "The controls you own" means yours, because the integration inherits the same roles and rights that govern the platform itself.
- Changes stay traceable. Actions taken through the agent are recorded in CERRIX like any other change, so your audit trail stays intact.
It sits on the same foundation the platform already stands on: ISO/IEC 27001 certified, ISAE 3402 Type II verified, with your data hosted in Europe. The convenience of working from your AI assistant does not come at the cost of the controls you are accountable for.
AI that assists, people who decide
CERRIX's position on AI in GRC is consistent: AI should empower risk professionals, not replace them. Human sign-off stays central to every AI-assisted step. Security and regulatory compliance are built into each feature rather than bolted on afterwards. And every capability is judged on real impact, not on novelty.
The integration reflects that directly. It removes the busywork around your data, the exporting, the reformatting, the clicking between tools. It does not make the judgment calls. A risk professional still decides what a control result means, whether a risk is acceptable, and what the board needs to hear. What changes is the ratio: more of the day on judgment, less on assembling the inputs for it. That is the same move the vision describes for the second line, from data collector to strategic advisor, made concrete in a single window.
See it in practice
Conversational GRC is a small shift with a large effect. Your risk and compliance data stops being something you have to go and fetch, and becomes something you can reach from where you already work.
Discover how AI is built into every step of the CERRIX GRC workflow, and see what conversational GRC could look like for your team.
.png)
Conversational GRC: work with your risk data from the AI agent you already use
Query your controls, update tasks, and generate board-ready reports, all from Claude or Microsoft Copilot. Conversational GRC, running securely on the CERRIX API.
.jpg)
CERRIX vs ServiceNow: GRC software compared across features, pricing, and compliance
CERRIX vs ServiceNow: GRC Software compared across features, pricing, and compliance (2026)
.jpg)
AI in GRC: beyond the hype. What actually works at every level of adoption
Key takeaways from the CERRIX panel on AI in GRC, with practitioners from CERRIX, AuditAgent and 8weeks.co sharing what actually works.
.avif)
Top European GRC tools in 2026: An insider's comparison
This blog compares the top GRC platforms available to European organizations in 2026
What Does GRC Look Like in 2030?
By 2030, AI in GRC will automate evidence collection, control monitoring, and routine reporting across all three lines of defense, shifting risk managers from administrative work to strategic advisory roles
The Complete GRC Chain: Connecting Regulatory Change Management, Risk, and Controls in One Platform
The future of Governance, Risk & Compliance (GRC) lies in connecting regulatory change management directly to risks, controls, incidents, actions, and assurance activities in one integrated platform.
Embedding automation into your risk operating model: Where AI fits and how to make It work
This second part focuses on what makes that automated model intelligent. Where AI fits. What it means for risk professionals in practice.
From checkbox to continuous: How to embed automation into your risk operating model
What it means to truly embed automation into the risk operating model: what changes, what stays the same, and what it takes to make it work in practice.
.jpg)
Why CERRIX acquired Ruler, and what it means for the future of GRC
CERRIX acquires Ruler to connect regulatory change with risk management.
%20(1).png)
Why Data Quality Is the Foundation of AI and Automation in GRC
A strategic look at why structured data in a GRC tool is imperative for automation, AI enabled workflows, and real time risk insights.
.jpg)
Internal Control Framework Challenges: Why COSO and ISO 31000 Implementations Struggle in Practice
Why do internal control framework implementations (COSO, ISO 31000) struggle? Explore common challenges in process design, ownership, tooling, and governance
%20(3).jpg)
Control Assurance Explained: How Organizations Move from Control Testing to Continuous Monitoring
Discover how modern control assurance moves beyond periodic testing to continuous monitoring, with clear ownership, automation, and expert opinion.
Incident Management under DORA: What Risk and Compliance Leaders Need to Rethink
Incident Management under DORA: What Risk and Compliance Leaders Need to Rethink
.jpg)
Hoe u ISO 31000 Risicobehandeling in de Praktijk Toepast: Inzichten voor Risk- en Complianceleiders
A practical recap of CERRIX ISO 31000 risk treatment webinar
%20(1).jpg)
Hoe Wij CERRIX GRC Gebruiken voor het Beheren van Ons ISMS. ISO 27001 in de Praktijk
Wij gebruiken onze eigen CERRIX GRC-software om het ISMS van CERRIX te beheren. Zo maken we van compliance een continu proces en laten we zien hoe ISO 27001 onderdeel wordt van de dagelijkse praktijk.
%20(1).jpg)
Hoe bereken je risicokans en -impact?
Leer hoe je risicokans en -impact berekent volgens ISO 31000. Ontdek hoe gestructureerde risicobeoordeling, scoringsmodellen en risicomatrices bijdragen aan effectief risicomanagement met CERRIX.
.jpg)
Why the Three Lines of Defense Model Is Outdated? What Every Board Should Know About the Three Lines Model
Three Lines Model Explained: Why Boards Must Move Beyond 3LOD
.jpg)
What Is ISO 31000 and How Does It Work?
Discover what ISO 31000 is, how it works, and why it’s essential for risk management in 2025. Learn the principles, framework, and how tools like CERRIX help organizations turn ISO 31000 into practice.
.jpg)
How to Write an Incident Report That Stands Up to Audits
Learn how to write incident reports that are clear, evidence-backed, and audit-ready. Includes a template, best practices, and compliance alignment for risk professionals.
.jpg)
How to Implement ISO 31000: Real-Time Risk Decisions with AI‑Enabled Tools
Discover how to move beyond compliance and operationalize ISO 31000 using AI, real-time dashboards, and structured risk assessments. Learn from webinar insights and best practices tailored for financial services and regulated industries.
%20(1).jpg)
What’s Blocking Your ISMS Rollout? 7 Fixable Challenges for Financial Institutions
Discover the 7 biggest blockers in ISMS rollout for financial institutions—and how to solve them. Learn practical strategies to secure buy-in, define scope, streamline controls, and prepare for ISO 27001 certification.
.jpg)
Trends Driving ISMS Adoption in 2025: What Risk & Compliance Leaders Need to Know
Discover the top trends pushing organizations toward ISMS adoption in 2025—from regulatory changes and remote work to threat evolution and AI. Learn what to prioritize to stay ahead in risk and compliance.
What Is an ISMS? A Practical Guide for Risk & Compliance Leaders in 2025
An Information Security Management System (ISMS) is more than policy—it’s your organization’s shield against evolving threats, regulation, and reputation risk. Discover what ISMS means, how to implement it, and why it matters in 2025.
.jpg)
The Intelligent Future of GRC: How AI is Reshaping Governance, Risk & Compliance in 2025
Explore how AI is transforming GRC in 2025—from predictive insights and automation to ethical oversight. Learn what features matter, what risks to manage.
.jpg)
How Do You Implement an ISMS in Financial Services Without Slowing Down Innovation?
Implementing an ISMS in financial services? Explore a practical, risk-aligned roadmap tailored for banks, fintechs, and insurers to meet ISO 27001, GDPR, and DORA compliance—without compromising agility.
How Do You Build a Robust ISMS Framework Based on ISO 27001?
Learn how to build a robust ISMS framework aligned with ISO 27001. Discover the key components—people, policies, processes, and controls—to strengthen security and achieve compliance.
.jpg)
When to Conduct Risk Assessments: 6 Enterprise-Critical Moments
Learn when to conduct risk assessments—annual, quarterly, after incidents or change—and how CERRIX ensures continuous compliance.
.jpg)
How do you build a system of quality management that works under ISQM 1?
Learn how to build a system of quality management under ISQM 1. Move beyond compliance to an operational model that proves audit quality.
Top GRC Platforms Compared: Risk Assessment Tools for 2025
Discover the top GRC platforms for 2025 with a focus on risk assessment tools.
What Are Risk Scoring Methods for Financial Institutions? [2025 Guide]
From Risk Assessment to Risk Management: Moving Beyond Checklists in 2025
Understand the evolution from risk assessment to strategic risk management in 2025. Learn why leading organizations are embedding risk into decision-making—and how GRC platforms like CERRIX support this shift.
What is risk management? A strategic guide for leaders in 2025
How Audit Firms Embed ISQM into Daily Practice
In our second ISQM webinar, experts from RSM, Grant Thornton, and CERRIX shared practical insights on how audit firms can embed ISQM into the heart of their operations.
Embedding ISQM 1 into the DNA of Your Audit Firm: A Risk-Based Approach to Quality Management
Discover how to implement ISQM 1 with a risk-based approach. Learn how audit firms can embed quality management into daily operations and governance.
%20(1).avif)
CERRIX User Conference 2025
Op 12 maart 2025 kwamen marktleiders, verzekeringsexperts en CERRIX-klanten samen voor de CERRIX User Conference 2025, een dag van kennisuitwisseling, inzichtelijke discussies en samenwerking over de toekomst van risicobeheer, compliance en AI-gestuurde GRC-oplossingen.
Van spreadsheets tot GRC-software: waarom pensioenfondsen een moderne benadering van risicobeheer nodig hebben
CERRIX en BR1GHT versterken langdurige samenwerking om oplossingen voor bestuur, risico, compliance en audit te verbeteren
DORA implementeren: van compliance tot veerkracht op lange termijn
