GRC Intelligence takes the stage at CRX ‘26

“GRC, as we know it, is no longer enough.”

That was the message Optro CEO Raul Villar Jr. brought to the stage at CRX ’26, where leaders, practitioners, and innovators gathered to explore the evolving world of GRC. As AI transforms how organizations operate and risks become increasingly complex, the demands on GRC teams are changing, too.

The executive keynote centered on the introduction of GRC Intelligence, Optro's system that helps organizations move beyond documenting risk to understanding it and taking action. Through a series of product announcements and demonstrations, the Optro leadership team showed how a trusted system of record, an intelligent system of action, and human oversight can work together to transform how GRC gets done.

GRC Intelligence: The next evolution of GRC

For years, GRC technology has helped organizations collect information, document controls, manage workflows, and report on what happened. Those capabilities remain essential, but the demands on GRC teams have changed, as Raul described. Organizations are navigating increasingly complex risks, new regulations, and the rapid adoption of AI. Collecting information isn’t enough. Teams must parse why the information is significant and determine how to take action.

This shift led Optro to introduce GRC Intelligence. Rather than simply adding AI capabilities to existing workflows, GRC Intelligence connects two essential parts of the platform:

• A trusted system of record: Connects the risks, controls, evidence, obligations, and vendors that give GRC teams a reliable foundation for their work.
• An intelligent system of action: Uses AI agents that reason over an organization's specific policies, objectives, and GRC data to interpret information, execute tasks, and return results to the trusted system of record.

Connecting these capabilities turns insight into action. For AI agents to deliver meaningful results, access to information isn’t enough. They need accurate, structured data and a clear understanding of how the different parts of an organization's GRC program work together. And when agents act, every action must be traceable, reviewable, and accountable.

GRC Intelligence Platform is built to help teams move beyond identifying risks and opportunities to act on them.

From the CRX stage, GRC Intelligence became tangible

With the vision established, Optro's product leaders showed attendees how to put it into practice. Through a series of demonstrations, the team showed how agentic AI can support work across audit, risk, and compliance, from gathering evidence and testing controls to coordinating stakeholders and managing third-party risk.

The common thread was straightforward: give AI the context and tools to take on more of the work, while giving professionals the visibility and control to oversee it.

Agentic Compliance brings intelligence into the work

One capability introduced during the keynote was Agentic Compliance. Compliance teams spend considerable time manually gathering evidence, preparing for audits, and keeping information current across stakeholders and systems, leaving less time to identify and prevent issues.

Agentic Compliance is designed to help shift that balance. By bringing AI agents into compliance workflows, Optro helps teams automate activities such as scoping, evidence gathering, and audit preparation, reducing the manual effort involved while maintaining human oversight.

The significance goes beyond automating individual tasks. Within the GRC Intelligence Platform, agents can work within the context of an organization's controls, obligations, and existing evidence rather than treating each activity as a standalone request. That connection helps teams spend less time coordinating information and more time identifying gaps, evaluating emerging issues, and determining where action is needed.

It's a practical expression of the larger idea introduced at CRX: intelligence becomes more useful when it can participate in the work itself, with professionals retaining the context and judgment to guide it.

Agentic capabilities extend across GRC

Agentic Compliance is part of a broader set of capabilities showcased during the executive keynote. Autonomous Testing is an additional agentic capability that expands testing across all control types to deliver full population coverage, reduce manual effort, and free teams to focus on strategic, judgment-based work.

Kieran Taylor demoed the new Autonomous Testing capability, with agents executing control testing procedures, examining supporting evidence, and identifying exceptions. One example involved tracing a variance in a financial reconciliation, with the agent documenting its findings in an exportable Excel workpaper. This illustrated how Autonomous Testing can take on detailed testing activities while preserving the evidence and documentation auditors need to review the results.

The team also introduced additional capabilities across the platform:

• Agentic Third-Party Risk Management: Streamlines vendor assessment workflows, including onboarding and due diligence tasks, helping teams assess risk more efficiently while maintaining control over policy and outcomes.
• Agentic Stakeholder Management: Reduces evidence follow-up by helping preparers resolve gaps before submission, so teams can start testing sooner.
• AURA Risk Assessment: Analyzes data and recommends evidence-backed risk scores, helping teams assess risk faster and prioritize work more consistently.

Together, these announcements demonstrated how Optro brings intelligent assistance across GRC in one connected platform. Instead of siloed tools that solve isolated problems, these capabilities draw on shared information and integrate into the workflows teams already use.

AI governance makes action accountable

The keynote also addressed a question that becomes increasingly important as organizations adopt AI: How do you govern the technology that's now doing more of the work?

Guru Sethupathy brought that question into focus during the closing product presentation. As organizations deploy AI across their operations, they face two related responsibilities: governing the AI being introduced throughout the enterprise and ensuring that the AI agents working inside their GRC programs operate responsibly.

Optro's expanded AI Governance capabilities, strengthened by the acquisition of FairNow, help organizations discover AI use, identify associated risks, and prioritize systems for human review. A unified inventory brings together AI introduced through vendors, employee use, and internally developed applications, giving organizations greater visibility into the technology operating across their businesses.

That same approach to governance extends to the agents operating within the GRC Intelligence Platform, with actions logged, cited, and reviewable. As Guru emphasized, putting AI to work and governing its use are two sides of the same challenge.

The more technology can do, the more human judgment matters

For all the technology introduced during the keynote, Optro's leadership returned to a distinctly human message. AI can gather information, execute testing procedures, identify exceptions, and coordinate work. But it doesn't eliminate the need for the expertise GRC professionals bring to their organizations.

Professionals still determine risk appetite, establish guardrails, evaluate findings, and make decisions that require an understanding of business context and consequences. As technology takes on more operational work, teams have an opportunity to redirect their attention toward critical thinking, professional judgment, and advising the business.

As Optro CMO April Crichlow reminded attendees, the growing presence of AI across organizations makes the role of GRC professionals more important, not less. AI may change how GRC work gets done, but the judgment behind the decisions remains firmly in human hands.

Explore more from CRX ’26

CRX ’26 offered a closer look at how GRC is evolving, from the introduction of GRC Intelligence to new agentic capabilities designed to help teams move from information to action. Across the executive keynote, one message remained clear: intelligent technology can take on more of the work, but trusted information and human judgment remain essential.

See the GRC Intelligence vision unfold

Watch the executive keynote