As part of its research for the AI in Risk and Compliance 2026 report, Parker & Lawrence Research spoke with technology providers developing tools to help firms strengthen risk identification, assessment and oversight.
The latest instalment of The Demo Room features Riskonnect, whose Integrated Risk Platform brings together technology assets, controls, incidents, policies and regulatory requirements to help organisations manage risk across the enterprise.
The interview forms part of the wider AI in Risk and Compliance 2026 report, produced by RegTech Analyst and Parker & Lawrence Research, which examines how technology providers are addressing emerging challenges in risk and compliance. Download the full report here.
Technology risk is rarely static. Changes to critical assets, third-party dependencies, internal controls or regulatory obligations can quickly alter an organisation’s exposure. However, many businesses continue to rely on periodic assessments, separate inventories and spreadsheets, making it difficult to understand how one development might affect other areas of the enterprise.
The expansion of AI is adding another layer of complexity. Organisations must account for growing numbers of models, data flows and third-party relationships, while considering risks that traditional assessment frameworks may not adequately capture. Although AI can help automate asset management, impact assessments, control mapping and remediation, firms first need reliable ways to understand and manage the risks associated with these technologies.
The challenge is compounded by fragmented internal processes. Technology teams typically manage asset and configuration records, risk teams oversee controls and risk assessments, while compliance teams interpret regulatory requirements. Cybersecurity, operational resilience, audit and third-party risk functions may also maintain separate records of critical services and dependencies. Without a connected view, organisations can struggle to establish how individual changes affect their overall risk position.
For example, an incident could compromise several controls, a regulatory update could change the requirements applying to particular assets, or a supplier failure could threaten the resilience of an important business service. Disconnected records make it harder to identify these relationships and determine the appropriate response. Teams may spend time reassessing low-impact changes while overlooking more significant developments, with further manual work required to prepare impact statements, mitigation plans and control updates.
Simply introducing an AI assistant does not resolve these weaknesses. Language models working with incomplete or unreliable information can produce convincing but inaccurate risk assessments. Effective AI-driven risk management therefore depends on having structured enterprise data, dependable change signals and clear relationships between the records used to inform decisions.
Riskonnect addresses this challenge through a context-aware technology risk workflow that combines connected risk data, rules-based processes, retrieval-grounded language models and AI agents within existing risk management operations.
At the centre of the approach is a connected model linking technology assets, risks, controls, causes, consequences, incidents, policies, regulations and related records. By bringing these relationships together, the platform gives risk teams a broader context for assessments and reduces the need to reconcile information manually.
Rules-based processes identify changes and assemble the relevant records before generative AI is used. This allows routine steps to remain consistent, predictable and auditable, while providing models with the information needed to interpret the significance of developments.
Riskonnect’s Risk Signal Agent then assesses changes against an organisation’s risk appetite, asset criticality and governance framework. It recommends whether a reassessment is necessary and explains the rationale behind the recommendation. Human reviewers retain responsibility for accepting or rejecting consequential actions, ensuring that material risk decisions remain subject to appropriate oversight.
The platform also applies retrieval-grounded models to compare internal policies with regulatory requirements. These models can identify potential gaps, explain their significance and help translate the findings into practical tasks for technology risk teams. Keeping the underlying regulatory sources and connected enterprise records available for review supports the traceability of the resulting analysis.
Riskonnect extends these capabilities into the response process. The platform can draft risk descriptions, risk appetite statements, business impact assessments, mitigation plans, playbooks and suggested controls in a consistent format. AI agents can then coordinate assessments, remediation activities and policy updates through defined review stages, helping teams move from identifying a potential issue to organising the response.
According to Riskonnect, its approach can reduce the time spent understanding unfamiliar regulations by more than 80%. The company also cites lower labour costs and earlier identification and resolution of risks. These are company-reported outcomes, and the results organisations achieve will depend on factors including data quality, implementation and existing risk management processes.
Parker & Lawrence Research identifies continuous materiality assessment as a particularly important aspect of Riskonnect’s approach. Rather than treating every change as requiring the same level of attention, the platform helps teams evaluate developments against their risk appetite, asset criticality and governance requirements. This enables organisations to determine which changes warrant a fresh assessment, understand why they matter and establish what action should follow.
The underlying architecture also supports accountability by separating deterministic processes from AI-driven interpretation and workflow coordination. Rules-based logic prepares the relevant information, retrieval-grounded models interpret the evidence and draft outputs, and agents coordinate subsequent activities. People retain authority over material decisions, an important consideration in technology risk management, where recommendations must be explainable and consistent with established governance frameworks.
However, the effectiveness of this approach will depend on the quality of the data underpinning it. Incomplete asset inventories, unreliable dependency mappings or disconnected risk and control records can limit the accuracy and usefulness of AI-generated recommendations. Organisations that fail to address these foundational weaknesses may struggle to realise the full benefits of automation.
Firms will also need evidence that AI agents can distinguish significant changes from routine activity without generating excessive alerts or overwhelming risk teams. Proposed remediation must remain aligned with internal policies, regulatory obligations and the organisation’s risk appetite, while human oversight should be maintained wherever decisions carry material consequences.
As AI adoption continues to expand the technology environments that organisations must oversee, the ability to connect risk information and identify meaningful changes will become increasingly important. Riskonnect’s approach demonstrates how combining structured enterprise data, AI-driven analysis and human oversight could help firms move away from periodic assessments towards more continuous and context-aware technology risk management.
Read the original post from Parker & Lawrence Research here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
