# Is AI changing the GRC staffing requirement?

**The sampled roles support a change in work content, not a conclusion that AI has eliminated the need for GRC staff.** FNBO explicitly assigns output validation, prompt refinement, configuration and ongoing optimisation. Pendo combines AI-assisted workflows with compliance ownership and security judgement. These are advertised responsibilities, not measured productivity outcomes. ([firstnational.wd12.myworkdayjobs.com](https://firstnational.wd12.myworkdayjobs.com/fnbocareers/job/Sr-Analyst--AI-Systems-Integration_R-20261209?utm_source=openai))

For a buyer evaluating AI-enabled GRC, this distinction suggests three separate responsibilities:

| Responsibility to assign | Proposed evidence of competence | Procurement consequence |
|---|---|---|
| **Operate the AI-enabled workflow** | Document inputs, configuration, permitted uses and escalation paths | Require an administrator handover, not just a feature demonstration |
| **Evaluate its outputs** | Test unsupported mappings, missing evidence and inconsistent answers against a controlled dataset | Budget review and regression-testing time |
| **Approve consequential decisions** | Establish who can accept risk, approve exceptions or close findings | Keep decision authority explicit rather than hidden inside automation |

NIST’s AI RMF Core addresses documented responsibilities, personnel training and executive accountability. Its framework is voluntary; NIST also states that AI RMF 1.0 is being revised. These are useful governance reference points, not proof that a specific AI-GRC product or staffing model satisfies every applicable obligation. ([airc.nist.gov](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/?utm_source=openai))

Practitioner discussion is directionally consistent but weaker evidence. The April 2026 TPRM Podcast episode featuring Ayoub Fandi discusses systems thinking, stakeholder alignment and moving beyond simply automating existing compliance work. Its published episode notes are useful qualitative context; they are not a hiring survey, and the programme identifies a commercial sponsor. ([tprmpodcast.com](https://tprmpodcast.com/episodes/grc-wrong-problem?utm_source=openai))

**Buyer recommendation:** treat projected AI labour savings as a hypothesis to test. Compare the time needed to prepare, review, correct, approve and maintain the workflow—not merely the time taken to generate an answer.