Confide launches agentic GRC platform to govern AI and humans alike
Confide, the governance, risk and compliance (GRC) software company founded by Wirecard whistleblower Pav Gill, has launched a unified agentic governance platform designed to replace the fragmented collection of point solutions that most large organisations currently rely on for compliance. The platform is notable not only for consolidating traditional GRC functions into a single audit trail, but for extending that governance framework to cover AI agents operating alongside human workers, a design choice that reflects where enterprise software is heading.
The timing is deliberate. Regulatory volume is accelerating: the company cites approximately 61,000 new regulations introduced globally each year, with regulators increasingly demanding continuous proof of compliance rather than periodic attestation. For legal, compliance and risk teams already stretched across multiple disconnected tools, that creates a structural problem. Purchasing a separate point solution for every new regulatory requirement is no longer commercially or operationally viable.
Governing the agentic workforce
The platform's most strategically significant feature is its approach to AI governance. Confide allows organisations to define precisely which tasks AI agents can execute autonomously, where human sign-off is required, and when humans can override agent decisions. Every action, whether taken by a person or an agent, is logged in a defensible, timestamped audit trail. That approach speaks directly to an emerging regulatory expectation: that companies will need to account not only for what their employees did, but for what their AI systems decided.
Pav Gill framed the urgency plainly: "Legacy GRC tools were never built for a world where billions of AI agents will help run companies, with humans in the loop. We built Confide to allow professionals to defensibly manage and audit trail critical issues from start to finish, whether those issues involve people, AI agents or both."
The platform integrates case management, policy, risk and audit functions, alongside workflows covering third-party risk, incident response, health and safety, law enforcement requests and AI governance. It is model-agnostic, meaning it is designed to connect with whichever large language models or automation tools a company already uses, rather than requiring teams to overhaul existing standard operating procedures.
The convergence angle: compliance infrastructure meets the agentic enterprise
The Confide launch sits at the intersection of two converging forces that cross-sector leaders should be tracking. The first is the rapid deployment of agentic AI inside regulated industries, financial services, healthcare, legal, manufacturing, where the consequences of an undocumented autonomous decision can be regulatory, reputational or legally actionable. The second is a parallel tightening of corporate governance expectations globally, from the EU AI Act's accountability requirements to the UK FCA's operational resilience rules and US SEC disclosure obligations around AI use.
Together, these create demand for a new category of enterprise software: governance infrastructure that is natively designed for hybrid human-agent workforces, rather than retrofitted from legacy GRC tools built for a pre-AI compliance environment. Confide is positioning itself as an early entrant in that category.
For capital allocators watching enterprise software, the broader market backdrop is relevant. The GRC software market has historically been dominated by incumbent platforms such as ServiceNow, OneTrust and MetricStream, all of which are now adding AI features to legacy architectures. A purpose-built agentic-governance layer, designed from the outset to treat AI agents as governed entities rather than just productivity tools, represents a structurally different product thesis. Confide says it is backed by more than 50 GRC leaders, including chief compliance officers from Fortune 100 companies and members of the ISACA board, which at minimum signals credibility with the buyer community it is targeting.
The company holds ISO 27001 certification and SOC 2 attestations, and reports end users across more than 150 countries. Whether it can translate advisory-board legitimacy into enterprise contracts at scale, against incumbents with far larger distribution footprints, is the open question the next funding announcement will likely need to answer.