The assurance record
Why the next GRC platform is judged on what it can prove, not on what it automates
The compliance platforms have converged. Five leading products, one framework list, and an analyst finding that the procurement decision often turns on which account team a buyer prefers. This paper argues that the axis that separates them next is not automation but provenance, sets out three tests any buyer can run in one meeting, and describes what a platform has to be built like to pass them.
What this paper establishes
- Three tests any buyer can run on a screen in a single meeting: every figure has a basis, every decision has a name, every action has a chain.
- One record across security frameworks, privacy law, third parties, AI systems and cryptography — so a control evidenced once answers every obligation that points at it.
- Provenance on every mapping row: 2,131 edges transcribed from an authority’s own published correspondence, each one marked as such where it is shown.
In May 2026 a published review of the five leading compliance-automation platforms reached a conclusion the category had been avoiding: two of the leaders are increasingly indistinguishable on technical capability, and the procurement decision often turns on which account team a team prefers working with.
A month earlier, Forrester had announced its evaluation of twelve GRC platforms with a summary no vendor quoted in its launch post: that many of these platforms still require too much manual data entry, offer only basic workflow automation, and are too complex, unwieldy and expensive; that artificial intelligence is providing minimal value for customers today; and that continuous controls monitoring remains at an embryonic stage and too audit-focused.
Those two findings describe one market. Every vendor in it now sells an autonomous agent, the analysts who spoke to the customers say the automation has not yet arrived, and the products have stopped differing from each other in ways a buyer can see. When that happens to a category, the next axis is not more of the same capability. It is the question the category never asked.
The question the category never asked
Open any compliance platform at a control that is marked satisfied. The screen will tell you that it is satisfied, when it was last tested, which framework it belongs to and what percentage of the programme is complete. Now ask the question an auditor, a regulator or a board member asks next, and the one a court would ask eventually.
Who decided that, on what, and can you show me it has not been changed since?
In the products as they are built today, the answer to the first part is a user identifier in a History tab, the answer to the second is a tab called Evidence containing test output, and the answer to the third is that the record is a row in a database that an administrator with sufficient rights can edit. None of those is a scandal. All of them are the result of building a system of record for an era when the work was done by people whose judgement no one doubted, and then putting a machine inside it.
The machine changes the question. When a draft can be produced in a second and filed in two, the scarce thing in a compliance programme stops being the work and starts being the accountability for it. A platform that produces a thousand judgements a month and cannot say who stands behind each one has not automated assurance. It has industrialised assertion.
Agentic assurance, defined so that it can be tested
Assurance is the word the auditors, the buyers and the analysts already use for this work, and Gartner’s own evaluation of the market is titled for assurance leaders rather than for compliance ones. Agentic is the adjective every vendor in the category adopted in the same twelve months. The pairing is ours and we are not going to dress it up as another company’s: this is the category we are choosing to be measured in.
The three tests
One: every figure has a basis
Point at any number on any screen — a rating, a score, a percentage, a mapping — and ask what it rests on. A platform passes when the answer is on the row: this document, this passage, this collector reading at this timestamp, this mapping published by this authority, or this mapping authored by the vendor on this date.
That last distinction is the sharpest. A mapping between two frameworks is an assertion with legal weight in an audit, and there are only two honest provenances for one: an authority published it, or the vendor decided it. Of the 2,311 mapping edges Conscious ships, 2,131 are transcribed from an authority’s own published correspondence and 180 are our reading, dated and labelled as ours on every screen that shows them. We have not found a competitor who carries that distinction at all.
Two: every decision has a name
Ask what the machine is allowed to do by itself. A platform passes when the answer is that it may draft, propose, collect, chase, read and calculate — and may not file a judgement. The record then shows two separate facts that most products collapse into one: that a model produced the draft, and that a named person accepted, edited or rejected it.
The construction has a second benefit the category has not noticed. It produces a measurement of the machine that no benchmark can give you: on your own records, how often your own people accept what it proposed. The platform counts it, and prints no percentage below 20 rulings, because a figure from four decisions is noise with a decimal point on it.
Three: every action has a chain
Ask whether the record can be altered, and by whom, and whether the alteration would be detectable by the organisation’s own auditor without the vendor’s cooperation. A platform passes when each entry commits to the one before it by hash, when there is no delete path in the system at all, and when the verification can be run by the customer.
One record, or five systems and a reconciliation
The second half of the argument is about scope, and it is the half a group with more than one regulator feels first. The obligations an enterprise carries no longer come from one family. A single manufacturing group in the Gulf today is simultaneously inside a national cybersecurity mandate, two or three privacy laws, a sectoral regulator’s rulebook, its customers’ contractual security requirements, a European resilience regime if it has an EU entity, an emerging set of AI obligations, and a central bank expectation about the cryptography it will still be using in ten years.
The market’s answer to that is a product each. A compliance-automation tool for the frameworks, a privacy suite for the laws, a third-party risk tool for the suppliers, an AI governance platform for the models, and a consulting engagement for the cryptography. Five systems, five records, five sets of evidence, and a quarterly reconciliation whose real purpose is to find out which of them is lying.
The reason one platform is better here is not tidiness. It is that the same control satisfies obligations from several of those families at once, and only a single record can say so. The arithmetic is published in this library: across the obligations Conscious maps, 6,127 requirement rows resolve to a library of 349 controls, and two-thirds of those controls are demanded by ten or more separate authorities.
| Domain | What is carried | Where it is set out |
|---|---|---|
| Security and sector frameworks | 56 frameworks, 16 at the authority’s own wording, 6,904 assessable rows | Paper 04 |
| Privacy law | 34 regimes with their own transfer rules, breach clocks and subject rights, including free zones as separate regimes | Paper 03 |
| Evidence and continuous readings | Intake, freshness, requests that chase themselves, readings that refuse to file when inconclusive | Paper 06 |
| Third parties | Supplier register, assessments, sanctions screening against official lists, contractual security obligations | Paper 09 |
| AI systems | An inventory of the models and agents the organisation deploys, with oversight and the record of who accepted what | Paper 08 |
| Cryptography | Inventory, agility and the migration a post-quantum timetable now requires | Paper 10 |
| The record itself | Hash-chained, exportable, verifiable by the customer, restorable and rehearsed | Papers 06 and 11 |
What this costs the vendor, and why it is the defensible position
A category claim is worth nothing unless it is expensive to copy. Three things make this one expensive, and all three are structural rather than clever.
- Provenance cannot be retrofitted. A basis column has to exist before the data does. A competitor can add one tomorrow and will still have a million rows that predate it, and a buyer only has to ask the date.
- The proposal boundary has to be enforced where it cannot be configured away. Once a product has shipped an autonomous filing agent to a thousand customers, taking it back is a downgrade they have already built workflows around.
- The refusal to ship licensed standards’ text is a cost paid up front. We carry ISO, PCI DSS, SOC 2, HITRUST, CIS, CSA, SWIFT and NERC as structure and reference numbers with our own assessor guidance, and not as reproduced text. That refusal forces the graph to be built properly, and it is why our catalogue is shaped the way it is.
Everything here is checkable, which is the point
A category claim that a reader cannot test is marketing. Every figure in this library is measured from the running product and held to it by a test that fails the build when a published document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours. The audit chain is verified by the customer’s own auditor without our cooperation. The load figures carry the hardware they were measured on.
How to use this library
Eleven papers are published in full, with no form in front of them, because a document a reader cannot quote is a document that does not travel. Three of them are worth reading before any vendor meeting, whoever you end up buying from.
- Paper 02 — The buyer’s examFifteen questions that produce different answers from different products, each answerable on a screen in one meeting. Take it into every vendor meeting on your shortlist.
- Paper 05 — The obligation arithmeticOriginal measurement across 56 frameworks and 34 regimes: how much of a multi-jurisdiction programme is distinct work, and which ten controls discharge the most obligation.
- Paper 03 — One group, many lawsThe wedge question — which of your entities may send personal data to the group warehouse — and what a platform has to model before it can answer it.
Then run the twenty-minute assessment on the entity you are least sure about. It needs no call and no account, it shows the reasoning behind every obligation it applies and every one it excludes, and it prints a record you keep whether or not you ever speak to us. If the output is wrong, the reasons are on the page, which means you will be able to say exactly where. That is the only kind of vendor claim worth making.
Sources
- 1Market review. “Top 5 GRC Platforms 2026: Vanta vs Drata vs Sprinto vs Secureframe vs Scrut”, guptadeepak.com, 15 May 2026. The observation that two leaders are increasingly indistinguishable on technical capability, and that the decision often turns on the account team, is that review’s.
- 2Forrester. The Forrester Wave: GRC Platforms, Q2 2026, announced 27 May 2026, evaluating twelve vendors. The statements about manual data entry, basic workflow automation, complexity and expense, minimal AI value today, and continuous controls monitoring being embryonic and too audit-focused are from Forrester’s own published announcement.
- 3On the category name. Gartner’s evaluation of this market is titled for assurance leaders rather than for compliance ones, and agentic is the adjective the vendors themselves adopted during 2026. The phrase agentic assurance is ours. No analyst has published it as a market name and we do not attribute it to one.
- 4Platform figures. Catalogue, mapping, library and acceptance figures are measured from the code on 1 October 2026 and held to it by a test that fails the build when a published document disagrees.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.