GRC 9.0: Why the last generation is called Embedded GRC – a prediction

Where Rasmussen's model ends

Michael Rasmussen describes the GRC market in generations. For him, GRC 7.0, “GRC Orchestrate”, is the present up to around 2030: an interplay of decision context (intelligence), agents with clearly regulated authority (action) and capabilities that business functions build themselves (configuration). For the period from around 2030 he sketches GRC 8.0, “Quantum GRC”: digital twins of the enterprise with which organisations play through possible futures before they decide – he calls it a “Risk Holodeck”. GRC 20/20 We examined the model in detail in GRC 7.0: What Michael Rasmussen's GRC Orchestrate means for organisations.

After that, the model ends. Rasmussen does not describe a generation 9.0, and to our knowledge no one else has defined one either.

This article fills that gap with an assessment of our own. It is important to say this up front: what follows is not an analyst model and not a summary of someone else's research, but our reasoned prediction – derived from developments that can already be evidenced today. At the end, we name the objections that speak against it.

One question orders all the generations

Read generations 1.0 to 8.0 in sequence and, at their core, they answer the same question: where does governance take place?

Follow this line and exactly one place is still missing: the system itself. Not a GRC tool alongside the business, but governance as a property of the systems that run the business.

Our thesis: GRC 9.0 is Embedded GRC

We expect the next generation to begin around 2035 and to have three characteristics.

Compliance becomes a property of systems

Today, teams prove after the fact that systems meet requirements: they collect screenshots, export reports, fill in audit templates. In the next generation, applications come into the world with machine-readable control commitments, and the evidence arises in operation as a by-product. The building blocks already exist: OSCAL describes requirements, controls and assessments in machine-readable form (see What is OSCAL?), FedRAMP already accepts packages in this format (see FedRAMP goes machine-readable), SBOMs and CBOMs describe software and cryptographic components. An audit then examines the generating system and its configuration – no longer a thousand individual pieces of evidence.

Trust is exchanged between organisations by machine

Supplier assessment today means: sending out questionnaires, filing the answers, repeating it every year. NIS2 and DORA already place supply chains under obligations, with risk management and contractual commitments, and from the end of 2027 the Cyber Resilience Act brings machine-readable SBOMs as manufacturer documentation. The next step is foreseeable: a supplier evidences a control once, cryptographically signed, and all its customers take over the evidence by machine. The questionnaire does not die of a ban; it dies of becoming redundant.

The scarce resource is accountability

Rasmussen's own core thesis on GRC 7.0 is: AI makes software features cheap; reliable information, context and accountability become valuable. Thought through to the end, this means: when agents assess, simulate and execute, exactly one task remains as the human core – deciding who is liable for what and which risk an organisation consciously carries. The System of Record of the next generation is therefore no longer a document archive, but a register of decisions and authority.

Why from 2035

A year in a prediction is open to attack, which is why we justify it twice over.

First, the rhythm of the model itself: according to Rasmussen, GRC 7.0 runs from 2025 to 2030, and GRC 8.0 begins around 2030. The more recent generations last about five years, so the next one would begin around 2035.

Second, regulation points to the same year independently. By 2035, the EU-wide transition to post-quantum cryptography is meant to be largely complete, and the NIST draft IR 8547 phases out RSA and ECC after 2035 (the deadlines in detail: Post-quantum cryptography: the 2026, 2030 and 2035 deadlines and which of them are binding). On the way there, cryptographic inventories, CBOMs and machine-readable evidence are emerging across the board – as an urgent recommendation of the EU roadmap and the German guideline, and for NIS2 entities also legally underpinned via the state of the art. The very infrastructure that Embedded GRC presupposes is therefore emerging right now – not out of vision, but driven by regulation.

We do not want to be more precise than “from around 2035”. Attaching a to-the-digit year to a prediction spanning eight years would be false precision.

Two objections we take seriously

The Holodeck objection. GRC 8.0 presupposes a data quality that many organisations today do not reach even for their cryptographic inventory – which the EU roadmap envisages by the end of 2026 and which in many places is only now coming into being. We therefore expect simulation to hold up first in narrow, well-modellable slices, such as supply-chain or outage scenarios, and not as a twin of the entire enterprise. Anyone allocating budget today should put it into data quality rather than simulation tools.

The counter-thesis: fragmentation instead of convergence. Things can also turn out differently. Regulation is currently growing faster than its harmonisation: the AI Act, DORA, NIS2, the Cyber Resilience Act and national special paths each impose their own requirements with their own reporting channels. Instead of a convergent discipline, silos per legal domain could emerge again – this time each with agents of its own. That would be GRC 1.0 at a higher level. Which of the two directions wins will be decided by whether the machine-readable formats become cross-domain or specific to each regulation.

What already pays off today

The practical thing about this prediction: the preparation is the same whether or not it comes true. Those who maintain requirements, measures and evidence in a structured, machine-readable form today are well positioned for either direction – for Embedded GRC in any case, and in a fragmented world a structured inventory is the only realistic chance of serving several legal domains without duplicated work. The same applies to delimiting authority: those who record today what an agent may propose and what a person must decide are building the register of decisions that will later form the core.

That is why the work does not disappear with the category GRC. What shifts is what people do: less gathering of evidence, more making decisions and being accountable for them.

Conclusion

Our prediction in one sentence: GRC 9.0 begins around 2035, is in substance called Embedded GRC – governance as a property of systems, federated trust between organisations, accountability as the last human instance – and is the last generation, because after it governance is no longer a category of its own. Nothing about this is certain except the direction of the infrastructure: machine-readable requirements, inventories and evidence are taking hold, driven by regulation. Whether that leads to convergence or fragmentation is open. The preparation is the same in both cases.

Sources

• GRC 7.0 – GRC Orchestrate: The Architecture, Economics, and Competitive Reset of the GRC Market (GRC 20/20 Research, October 2026)
• GRC: An Ancient Discipline, a Snowy February, and the Architecture of What Comes Next (Michael Rasmussen, 14 October 2026)
• A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (EU PQC Workstream of the NIS Cooperation Group, June 2025)
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards (Initial Public Draft, 12 November 2024)