The biggest governance conversations happening inside Indian organizations this year are no longer confined to compliance teams.

They are happening inside product meetings where engineers are redesigning consent flows. They are surfacing in boardrooms, where a string of cyber incidents has sharpened the focus on resilience and directors increasingly want live risk dashboards instead of quarterly presentations. They are unfolding inside procurement teams that now scrutinize vendors with the same intensity once reserved for internal controls. And increasingly, they are taking place wherever AI systems are making decisions that leaders did not think would need strict governance just a year ago.

Individually, none of these developments is entirely new.Together, however, they point to a larger shift. Governance, risk and compliance (GRC) is no longer simply responding to business transformation. It is beginning to shape how that transformation happens.

The first half of 2026 has made that shift difficult to ignore.

Privacy is no longer a legal exercise

For much of last year, many organizations treated the Digital Personal Data Protection (DPDP) Act as a future project. Policies were drafted, privacy notices were updated and internal discussions began, but implementation often remained on the horizon. That horizon is disappearing.

With the Rules now notified, the Data Protection Board taking shape and the Consent Manager framework expected to become operational this year, enterprises are moving beyond documentation and into execution. Consent management, personal data mapping, breach response workflows and vendor governance are becoming operational priorities rather than compliance checklists. The government’s proposal to shorten the compliance window for Significant Data Fiduciaries has only accelerated that urgency, leaving organizations with less time to translate policy into functioning systems.

The conversation has shifted from “Are we ready for DPDP?” to “Can our systems actually demonstrate compliance every day?”

Boards are asking better questions

The quarterly compliance deck is losing its place in the boardroom. Across regulated sectors, directors increasingly want visibility into what is happening now rather than summaries of what happened last quarter. Regulatory expectations are reinforcing that shift. RBI now expects boards of regulated financial entities to exercise active oversight of technology and cybersecurity risk, while SEBI’s Cyber Security and Cyber Resilience Framework places greater responsibility on boards to oversee cyber resilience.

That has changed the nature of governance reporting. Static presentations are giving way to live dashboards, measurable key risk indicators and continuous monitoring that allows boards to understand whether critical controls remain effective as the business evolves. Governance is becoming less about reporting compliance and more about proving resilience.

AI has created compliance’s biggest blind spot

Most organizations know how many people work for them. Far fewer know how many AI systems are already making decisions across their business. As generative AI and autonomous agents become embedded across customer service, HR, finance, software development and security operations, governance teams are confronting questions they have never had to answer before. Which AI systems are in production? What decisions are they making? Can those decisions be explained? Who is accountable when an autonomous agent makes the wrong call?

Those questions are increasingly finding their way into audit programmes as AI governance evolves from an emerging discussion into an operational requirement.

“Most enterprises are still discovering just how quickly AI has spread across their operations,” says Raghuveer Kancherla, Co-founder of Sprinto. “The challenge goes beyond knowing where AI is being used. It’s building governance that continuously tracks what these systems are doing, how decisions are being made and whether they remain aligned with regulatory and business expectations. AI is changing too quickly for governance to remain a once-a-year exercise.”

For many organizations, AI governance is becoming less about restricting innovation and more about ensuring innovation remains accountable.

Compliance budgets are buying technology, not just talent

Adding more people is no longer enough to keep pace with modern compliance.

As organizations navigate expanding regulatory requirements alongside increasingly complex technology environments, investment is steadily shifting towards platforms that automate governance. Gartner predicts legal, risk and compliance functions will double their technology spending by 2027, driven by growing demand for automated assurance and AI governance capabilities.That shift is already visible across Indian enterprises.

Integrated GRC platforms, continuous control monitoring, automated evidence collection, regulatory change management tools and AI-assisted risk assessments are steadily replacing spreadsheet-driven processes and periodic compliance reviews. Organizations are recognising that controls reviewed once every quarter are unlikely to keep pace with systems that change every day.

Your vendors are now part of your risk perimeter

Enterprise risk no longer stops at the edge of the organization. As businesses become increasingly dependent on cloud providers, software vendors, outsourcing partners and managed service providers, regulators are expecting companies to maintain continuous oversight of third parties rather than treating vendor assessments as a one-time procurement exercise. RBI’s Outsourcing Directions reflect that shift, while enterprises across sectors are strengthening contractual controls and continuous monitoring across their supplier ecosystems.

The implication is significant. A strong internal compliance programme offers limited protection if the vendors handling critical data or infrastructure cannot demonstrate the same level of governance. Vendor risk is steadily becoming an extension of enterprise risk.

Where investment is flowing next

These shifts are driving a new wave of GRC investment across sectors facing the greatest regulatory and operational complexity, including BFSI, fintech, healthcare, manufacturing, SaaS companies and India’s rapidly expanding Global Capability Centres (GCCs).

Much of that investment is flowing into technologies that provide continuous visibility rather than periodic assurance, including continuous control monitoring, third-party risk management, automated evidence collection, AI-assisted risk assessments, regulatory change management and identity governance.

The direction of travel is becoming increasingly clear. Compliance is no longer measured by how well an organization prepares for its next audit. It is increasingly defined by how confidently it can demonstrate trust, resilience and accountability every single day.

The author is Raghuveer Kancherla, Co-founder at Sprinto.

Disclaimer: The views expressed are solely of the author and ETCISO does not necessarily subscribe to it. ETCISO shall not be responsible for any damage caused to any person/organization directly or indirectly.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!