The Italian Competition Authority has opened an investigation into Microsoft Ireland Operations and Microsoft, arguing that the company may have crossed that line when it increased the price of Microsoft 365 after incorporating its Copilot and Designer artificial intelligence services into the subscription.
Compliance is becoming too dynamic, evidence-heavy, and operationally connected to cybersecurity to be managed as a static documentation exercise. The opportunity for AI is not to replace governance judgment, but to help organizations turn evidence into defensible decisions faster.
Recently, I asked buyers to inspect the machinery. This week, I am asking vendors to open the hood. The conversation about AI in GRC has reached a turning point. The market has heard the vision. It has seen the demos. It has absorbed the language of orchestration, agentic intelligence, autonomous assurance, and dynamic decision support. The frameworks have been published. The white papers have circulated. The analyst briefings have been given. The conference keynotes have landed.
The window between discovering a software vulnerability and seeing it exploited is shrinking, according to the Dutch financial markets regulator, which is urging organizations to strengthen core cybersecurity practices as advanced artificial intelligence accelerates the pace and sophistication of cyberattacks.
Somewhere inside a government agency, a public institution, or a private company, an employee is almost certainly pasting information into an AI tool that nobody formally approved. The employee is probably not trying to circumvent policy. They are trying to get through their workday. A chatbot can summarize a report in seconds. A coding assistant can solve a technical problem faster than a colleague can respond to a message. An automated note-taking application can generate meeting minutes before participants have even left the call. The attraction is obvious. So is the speed with which these tools have spread through workplaces.
When European Commission President Ursula von der Leyen unveiled a new package of technology proposals this week, she did not frame it as an industrial policy announcement. She framed it as a matter of control.
A Swedish startup called Eggsplain spent the spring working with the country's privacy regulator on a question that has become surprisingly difficult to answer. When an AI supplier fine-tunes a model using personal data, who is actually responsible for that data?