Three types of AI compliance products now reach CFOs under the same label. Governance platforms catalog which AI tools a company uses. GRC systems map AI risk to legal and audit controls. Finance-specific workflow layers document who signed off on an AI-assisted output before it touched a report. Each solves a different problem.

The Signal  — CFOs buying without a clear problem statement are picking the wrong layer. The right question before buying: where is your evidence gap? Most auditors will ask for human-review documentation on AI-assisted finance outputs before they ask for an AI governance platform. Start with the documentation layer. What to watch: Vendors in all three categories are expanding their feature sets. The CFOs who clarify what they need first will spend less and move through auditor questions faster.

PwC announced an AI Center of Excellence on May 11 to deploy audit AI at scale. Five days earlier, the PCAOB listed AI audit validation as a research priority, meaning formal standards are 18 to 24 months out. In the gap, firms are validating their own tools using internal protocols they write themselves.

The Signal  — There's no independent body, no PCAOB certification and no industry testing framework for audit AI right now. The firms deploying tools today are also writing the playbooks for how those tools get validated. When standards arrive, firms that skipped documentation will face retroactive compliance work. What to watch: Start documenting tool selection decisions and testing protocols now. The firms with records will have the easier conversation when the PCAOB standard lands.

Grant Thornton launched gtap, a proprietary audit platform that treats AI as core firm infrastructure rather than a vendor add-on. The firm built its own stack instead of buying from a third party. For large firms, that approach is becoming table stakes. For smaller ones, it's a signal that infrastructure decisions are arriving.

The Signal  — Smaller firms can't build what Grant Thornton built. But deciding not to respond is also a strategy — and probably the wrong one. The practical options are to build in-house, buy from specialized vendors, join a network with shared infrastructure, or define a niche practice where deep AI infrastructure isn't required. What to watch: Platform-level decisions are happening among smaller firms right now. Step one is auditing your own tool stack to understand what client data flows where.