Agent-based systems automate recurring IT compliance processes across the entire lifecycle of (AI) software — from reviewing external IT service providers and collecting evidence to continuously checking implemented controls — connecting to the existing GRC and IT landscape.
This AI use case is presented in collaboration with
Agent-based systems can automate recurring IT compliance processes across the entire lifecycle of (AI) software — from the review of external IT service providers, through the collection of the required evidence, to the continuous checking of the implemented controls. Specialized AI agents that run in the background can connect to the existing GRC and IT landscape and continuously evaluate policies, contracts, questionnaires and technical documentation of the IT assets.
Financial institutions are subject to a steadily growing number of IT-related compliance requirements — driven above all by DORA, which for most institutions has replaced the BAIT as the authoritative IT supervisory framework, supplemented by requirement catalogs such as those from MaRisk, ISO/IEC 27001 and the EU AI Act. It becomes particularly labor-intensive when purchasing third-party software and AI systems: every new service provider and every new system must be assessed, documented with evidence and continuously monitored. However, a large part of this governance work (e.g. control assessment, evidence collection, service-provider review and audit preparation) is carried out largely manually and is usually spread across traditional GRC platforms (ServiceNow, RSA Archer, Collibra, etc.), Confluence, SharePoint and Excel lists. IT compliance thus usually remains a point-in-time state, and the compliance function becomes the bottleneck for every new application, every service provider and every additional requirement.
The automation of IT compliance processes in financial institutions is hindered by several factors:
The consequences are delayed approvals when introducing software, high resource consumption in the compliance function, and a compliance status that can only be demonstrated at the time of the audit with considerable effort. Agentic compliance solutions transfer this manual work into a continuous, AI-supported process — without necessarily replacing the existing GRC and system landscape:
In our projects in which these agentic solutions have been used, time savings of 50-70% in IT governance were quickly realized. In particular, the automation of the initial assessments as well as the control checks, alongside documentation management, usually offers the greatest savings potential.
The use case is based on specialized AI agents for GRC tasks that evaluate content from the existing system and tool landscape and transform it into traceable, audit-proof results for the respective IT assets or third-party providers. The agents should be governed by a tool interface that can represent the necessary and organization-specific GRC logic. A representation via widely used agent tools and MCP servers is possible, but not recommended for critical compliance checks.
| RISK | DESCRIPTION | POTENTIAL MITIGATIONS |
|---|---|---|
Inaccurate outputs | The AI model may deliver inaccurate information or draw wrong conclusions. In this context, it may happen that the LLM misinterprets complex IT compliance frameworks (such as DORA) or incorrectly summarizes evidence from provider documents, which leads to inaccurate compliance reports or assessments. | Source-based evaluation (RAG): Strict alignment of the model to the provided policies and data sources, as described in the use case. Copy-on-write mechanism: Through a "human-in-the-loop" review, it is ensured that all proposed compliance changes are reviewed by a subject-matter expert (2nd LoD) before they actually take effect. |
Data exfiltration | The AI agents require extensive access to potentially highly sensitive internal IT architecture descriptions, supplier descriptions and GRC systems. A security vulnerability could be exploited to forward this confidential data to unauthorized parties. | Ensure that the agents have strict filters for outbound data traffic (runtime enforcement). Agents should only be able to communicate with the internal (GRC) tools and the authorized LLM API. |
Excessive agency | The ability to communicate with other systems via extensions or to take actions in response to a prompt. If autonomous AI agents can directly change a compliance status or send information to connected systems, this could lead to uncontrolled actions if the AI model malfunctions or is compromised. | Limit the scope of action: Enforce the established "sign-off mechanism" (copy-on-write) at the API level, or restrict the agent tools so that they cannot trigger any irreversible workflows but can only analyze and make suggestions. |
Risk
The AI model may deliver inaccurate information or draw wrong conclusions. In this context, it may happen that the LLM misinterprets complex IT compliance frameworks (such as DORA) or incorrectly summarizes evidence from provider documents, which leads to inaccurate compliance reports or assessments.
Source-based evaluation (RAG): Strict alignment of the model to the provided policies and data sources, as described in the use case.
Copy-on-write mechanism: Through a "human-in-the-loop" review, it is ensured that all proposed compliance changes are reviewed by a subject-matter expert (2nd LoD) before they actually take effect.
Risk
The AI agents require extensive access to potentially highly sensitive internal IT architecture descriptions, supplier descriptions and GRC systems. A security vulnerability could be exploited to forward this confidential data to unauthorized parties.
Ensure that the agents have strict filters for outbound data traffic (runtime enforcement). Agents should only be able to communicate with the internal (GRC) tools and the authorized LLM API.
Risk
The ability to communicate with other systems via extensions or to take actions in response to a prompt. If autonomous AI agents can directly change a compliance status or send information to connected systems, this could lead to uncontrolled actions if the AI model malfunctions or is compromised.
Limit the scope of action: Enforce the established "sign-off mechanism" (copy-on-write) at the API level, or restrict the agent tools so that they cannot trigger any irreversible workflows but can only analyze and make suggestions.
Under the EU AI Act, a pure GRC/IT compliance automation can, in this form, be interpreted as not high-risk; however, depending on the use and role, transparency requirements (Chapter IV) could apply.
Under the GDPR, if the evaluated sources contain personal data, the legal basis, purpose limitation and data minimization (Art. 5, 6) must be ensured. Since every recommendation of the AI is signed off by a human, there is no solely automated decision within the meaning of Art. 22. When using an external AI/model provider, a data-processing agreement (Art. 28) as well as data security and residency (Art. 32) must be observed.
Under DORA, if the agent solution is obtained from an external provider, it is itself an ICT service provider and is subject to ICT third-party risk management (Art. 28–30), including inclusion in the register of information. The system supports DORA compliance and must then at the same time itself be integrated in a DORA-compliant manner.
The frameworks mentioned partly interlock; scope and specific obligations depend on the type of company, the role (provider/deployer), the implementation of the AI use case and the risk class. This must be examined in every case.
AI only delivers real added value in the financial sector when it is not only useful but at the same time compliant and trustworthy. This is exactly where BearingPoint and trail work together: BearingPoint brings the specialist industry expertise and consulting to identify and implement the right, value-generating AI use cases; trail delivers the technical structures to bring AI into operation quickly and in a compliant manner.
Talk to us if you want to implement AI solutions that deliver real added value while also standing up to regulatory requirements.
Register, classify, assess, monitor, and document this AI use case — fully guided by trail's AI Governance platform & GRC Agents.
