SureCloud Ltd. has launched Gracie, a groundbreaking team of persona-based AI agents designed to transform Governance, Risk, and Compliance (GRC) operations. As the first cross-domain agentic capability in GRC, Gracie convenes AI experts across risk, compliance, audit, and third-party domains to work collaboratively on a single task, addressing the growing capacity crisis in the industry.
Addressing Compliance Fatigue
GRC has traditionally relied on skilled professionals performing manual work, but this model has become unsustainable. SureCloud research reveals that 49% of UK enterprises struggle to keep up with five or more major regulations simultaneously, while 57% cite budget constraints that hinder necessary hiring. Security risk and compliance professionals possess the expertise but lack the capacity to execute assessments, review controls, chase documents, and produce reports at the required pace.
A Virtual GRC Team
Gracie represents a major enhancement to SureCloud's GRC platform, moving beyond simple conversational AI to true autonomous agents capable of executing over 200 distinct actions within the platform. These agents are designed to augment human teams, not replace them, by handling repetitive workloads and freeing senior experts to focus on high-value tasks. The system includes Personas for every role, from Risk SMEs to Privacy SMEs, allowing customers to invoke a virtual team for specific tasks while maintaining control over policies and governance structures. Skills codify how each GRC activity is performed, ensuring consistency by leveraging SureCloud's expertise or the organization's own best practices.
Nick Rafferty, CEO of SureCloud, stated: "For two decades, GRC has been a discipline of skilled people doing manual work. The expertise was always there. The execution capacity never was. Gracie changes that equation by giving every person an agent counterpart that carries their workload, operates to their standard, and frees them to do the work only a senior expert can do. This is the moment GRC stops being a record-keeping exercise and starts being an executable one."
SureCloud was recently recognized in three categories of the Gartner Hype Cycle for Cyber-Risk Management, 2026, and in Gartner's new Innovation Insight: Cyber GRC.
