SureCloud pushes AI-driven GRC model to ease compliance strain

SureCloud CEO Nick Rafferty says regulated companies need to move beyond manual governance, risk and compliance work as teams struggle with rising regulatory demands. A 2025 SureCloud study found 60% of UK enterprises still use spreadsheets daily alongside paid GRC tools, underscoring a capacity gap the company says responsible automation can help close.

Why it matters: - Regulated companies are facing more compliance work than existing teams can handle. - The pressure spans cyber assurance, operational resilience, third-party risk, privacy and AI governance. - SureCloud argues that responsible automation can improve audit readiness, reduce backlogs and limit the need to add headcount.

What happened: - Business Reporter published an article featuring Nick Rafferty, CEO of SureCloud, on the future of governance, risk and compliance operations. - Rafferty says organisations across regulated sectors need to rethink the GRC operating model as regulatory demands rise. - SureCloud cited 2025 research showing 60% of UK enterprises still rely on spreadsheets daily alongside paid GRC tools. - The same research found more than half of organisations struggle to keep up with more than five major regulations.

The details: - The article says manual work such as evidence reviews, vendor assessments, compliance checks and audit preparation increasingly needs support from specialist AI assistants. - SureCloud describes those assistants as virtual compliance managers, vendor managers and auditors. - The company says the new approach can improve audit coverage, accelerate reporting and keep compliance readiness continuous. - The operating model is meant to support execution, not just visibility dashboards and reporting tools. - SureCloud says the new architecture should embed role-based permissions, transparent audit trails, defined authority limits and human oversight for higher-risk decisions. - The company also says codifying expertise into repeatable skills and automated systems can reduce dependence on individual employees and improve consistency.

Between the lines: - The core problem is not a lack of GRC software. It is the gap between software that shows issues and systems that actually help teams do the work. - SureCloud is positioning AI as a control layer for compliance operations, not a replacement for governance. - The emphasis on permissions, audit trails and human review reflects the need to make automation acceptable in regulated environments.

What's next: - Organisations looking to modernise GRC operations are being pushed to move from manual workflows to AI-assisted execution. - SureCloud says companies adopting this model should be able to handle more compliance work without proportionally growing teams. - The company points readers to its article for more detail on transforming the legacy model.

The bottom line: - SureCloud is betting that the next phase of GRC is responsible automation: AI that helps teams execute, while humans keep control of the highest-risk decisions. - More information is available at SureCloud's website.