Archer® Launches a Harnessed Digital Workforce for GRC, Grounded in 492 Purpose-Built Models: Archer Evolv™ Foundation and Archer Evolv™ Workplace

Built on proprietary models trained since 2017, purpose-built digital full-time employees, called AI Operators, join risk, compliance and security teams under their supervision, inside the GRC harness and the system of record those teams already trust.

OVERLAND PARK, Kan.--(BUSINESS WIRE)--Archer® today launched Archer Evolv™ Foundation and Archer Evolv™ Workplace, putting a governed digital workforce to work inside the GRC system of record enterprises already trust. Archer Evolv Foundation is the shared AI intelligence layer beneath that workforce, holding every Operator inside the controls and permissions already in place. Archer Evolv Workplace is the marketplace through which customers select governed AI Operators and assign them to their own teams. Both are in production with customers today. Dozens of Operators are already at work across Foundation, Audit, Third-Party Risk, IT Risk and Operational Risk, growing to more than 200 by the end of 2026 and more than 500 by the end of 2027. They arrive as enterprises adopt AI faster than they can govern it.

Eighty percent of Fortune 500 companies are running active AI agents, yet only 14% have full security approval for them. This week, leaders of frontier AI labs publicly weighed slowing development over safety concerns. The question for every board is no longer whether AI will act on the company's behalf. It is whether anyone can verify if the action was allowed. When decisions carry no assurance, AI risk rises.

That question now lands on three desks:

1. The CRO needs to know which risks changed before the board inquires.
2. The CCO needs to trace regulation to obligation, control, and evidence before an examiner does.
3. The CISO needs visibility into what AI is running, what agents can touch, and what evidence exists when they act, consistent with guidance from CISA and NSA.

Those were three questions for three functions. One AI action now answers to all of them at once: a risk event, an obligation and a security exposure in the same instant. Risk, compliance and security are merging because the work no longer divides. That requires AI that understands the records, relationships and controls behind all three and can be defended when it acts. Agents are making decisions across the enterprise. Archer Evolv governs the ones that matter.

“Archer Evolv brings together two things no one else in GRC has: 25 years as the system of record the world's most regulated enterprises trust, and AI built for this domain since 2017, not bolted on last year," said Bill Diaz, Chief Executive Officer of Archer. "The models, data and experts that came with Compliance.ai now run across all of Archer. GRC teams do not need another AI tool sitting outside the way they work. They need AI that understands their business, was built responsibly from the start, and can be defended to their board."

One architecture for the future of GRC

Archer Evolv is built around three connected systems:

• System of Record, Archer GRC: The trusted enterprise environment connecting risks, controls, regulations, audits, third parties, evidence, workflows and other critical GRC context.
• System of Intelligence, Archer Evolv Foundation: Foundation is what every Operator draws on, and it is four things. Access to Archer's 492 purpose-built models, so reasoning starts from models trained on GRC rather than a general-purpose one. Connections into the system of record wherever it runs, SaaS or on-premise. A prompt experience where anyone with permission asks any record, application or relationship a direct question in plain language and receives an answer in seconds with the source record cited, honoring the roles already configured in Archer. And the harness, the runtime that constrains and governs every Operator: it persists state, so an Operator never loses the thread across long running work, confines every action to a defined scope, and reports progress to the supervisor who owns the result. That is what lets an Operator work at scale and still stand up to review.
• System of Outcomes, Archer Evolv Workplace: Archer Evolv Workplace is a marketplace of purpose-built AI Operators that function as digital full-time employees: each hired for a specific job, granted a specific scope, supervised by a named person and accountable through the same audit trail as everyone else. They work for the team, never instead of it. System of Outcomes also includes Evolv Solutions and Domains.

Reliable AI agents need a GRC-specific harness given its additional risk and compliance requirements. The harness holds the work together: it carries state across long-running tasks, so an Operator does not lose the thread, confines every action to a defined scope, and reports progress up to the supervisor who owns the result. That is what makes scale dependable rather than risky.

Context is enterprise AI’s most valuable input: what an organization decided, why, under which obligations and with what evidence. Archer customers have built that business profile in their system of record for years. Archer Evolv Foundation puts it to work with a data-readiness layer that deduplicates, normalizes and quality-checks every signal before it reaches an Operator, so AI reasons from accurate, current records.

Purpose-built, not prompted

An Operator can only enforce an obligation someone has correctly identified from a regulation and mapped to a control. Archer’s legal and regulatory experts in the loop build and version-track Archer's data of more than 22 million regulatory documents. That data, with 250 million GRC records, feeds 492 purpose-built models developed by more than 200 AI engineers and GRC domain experts. In Archer's production evaluation of legislative effective dates, a leading general-purpose model was confidently wrong in a meaningful share of cases. Archer Evolv resolved 100% of the same set, because low-confidence work routes to an expert rather than shipping with no flag. For productivity, an agent is sufficient. For control, only an Operator is defensible.

“General-purpose AI starts with a prompt. Enterprise GRC AI starts with context,” said Kayvan Alikhani, Chief Product & Technology Officer at Archer. “The models, the data, the expert review and the harness took years to build. A general-purpose agent can hold a conversation. A GRC Operator must hold a week of work, inside a defined scope, with a record of everything it did. Our customers do not have to build any of it. We already did, and it is available today. Each one is clear on what it can read, propose and change, so experts stay in control."

About Archer

Archer powers how the world's leading enterprises govern risk, compliance, and regulatory change. More than 1,300 organizations run on Archer, including half the Fortune 500 and 37 of the top 50 global banks. A new regulatory change lands somewhere in the world every seven minutes, and agentic AI is outpacing most teams' ability to govern it. Archer replaces static controls and periodic reviews with purpose-built AI grounded in the deepest regulatory data and domain expertise in GRC: 22 million regulatory documents and 250 million GRC records, validated by more than 200 AI engineers and GRC domain experts. Every result traces back to its source, and every decision can be defended. Archer delivers solutions across the full range of GRC, including regulatory change management, AI governance, third-party risk, and IT and security risk.

Learn more at archerirm.com.

Explore Archer Evolv™ Foundation and Archer Evolv™ AI Workplace to see the platform behind this.

For more on what this means for the digital GRC workforce, read AI Capability Arrived First. AI Proof did not.