Compliance Is Quietly Becoming an Evidence Problem
For most of my career, enterprise trust has worked one way: you prove you’re trustworthy by writing it down. Policies, audit reports, screenshots, certifications. Produce enough paperwork showing your controls exist and work, and you’ve shown you can be trusted.
That worked for a long time, for one reason: the paperwork could keep up. Software shipped a few times a year, infrastructure sat still for months, and proving you were compliant once a year was a fair stand-in for being secure the other 364 days.
But the systems we govern today look very different from the ones that shaped this model.
We’re auditing a photo of a moving car
Today, infrastructure spins up and tears itself down automatically. Teams ship to production dozens of times a day. Models get retrained, prompts drift, agents do work people used to. Modern systems are built to move, yet most of how we prove trust still assumes they’ll hold still long enough to pose for a photo.
This creates a growing challenge at the heart of modern compliance. Weeks before an audit, teams collect screenshots and configs to describe an environment that will have changed by the time anyone reviews it. What we capture is often yesterday’s environment rather than today’s, and as systems accelerate, that gap becomes harder to ignore.
FedRAMP 20x is the canary, not the story
FedRAMP is the program that lets cloud providers sell to the U.S. government, and for over a decade it was the DMV of compliance: 12–18 months, $500K to $2M+, often needing a federal agency to sponsor you first. In fifteen years, about 400 companies made it through. FedRAMP 20x, announced in March 2025, is the biggest rethink of that program in a decade, and three changes matter.
First, you stop writing essays about your controls and start showing the scoreboard. Old FedRAMP graded you against the full NIST 800-53 baseline, 156 controls for Low, 323 for Moderate, through written narratives. 20x swaps that for a short list of Key Security Indicators: 56 for Low, 61 for Moderate. A KSI isn’t a paragraph you write; it’s an outcome you prove. “Describe how you enforce MFA” becomes “show me the live data that phishing-resistant MFA is on for 100% of your privileged users right now.”
Second, evidence has to be machine-readable, not a PDF someone assembled by hand, structured JSON/OSCAL emitted by your systems. Compliance, in other words, becomes code.
Third, the check is continuous, not once a year. For Moderate systems, machine-checked indicators get re-validated at least every three days. The annual audit, as the big event everyone scrambles toward, quietly stops being the point.
None of this lowers the bar, the KSIs still map back to the same NIST controls. What changes is the question. The old one: can you periodically assemble convincing paperwork that your controls exist? The new one: can your systems continuously throw off trustworthy proof that those controls still work? That’s the difference between trust you declare and trust your systems demonstrate. FedRAMP didn’t invent that shift, it just noticed it out loud. And once you see it, you see it everywhere: continuous controls monitoring, Vanta and Drata, cloud tools checking configs in real time, identity platforms re-scoring risk on every login. One story underneath all of them, trust is moving from documents you assemble to evidence your systems give off while running.
AI doesn’t start this fire, it just turns off the sprinklers
If cloud computing lit this, AI makes it impossible to walk away from. Old-school software is predictable; AI refuses to sit still. Models evolve, prompts change, agents call other tools, decisions go from “if this, then that” to “probably this.” Once your environment changes by the hour, proving you were compliant one day last spring stops meaning much.
So “AI creates scary new governance problems” is only half true. AI is really dragging an old problem into the light: the way we prove trust barely evolved while the things we govern changed completely. Which is why AI governance can’t be one more documentation exercise. It has to become an operational muscle, watching and explaining what your systems do continuously, not once a quarter.
Trust becomes an engineering job
Here’s the real consequence. “We enforce phishing-resistant MFA” used to be a sentence in a policy doc, backed by a one-time screenshot. Now it’s a live query against your identity provider, Okta, Entra, AWS IAM, proving MFA is on for 100% of privileged users right now, regenerated automatically. The control didn’t change. What changed is that proving it is now something your system just does, instead of something a stressed human assembles the week before an audit. Evidence stops being a thing you make and becomes a thing your systems give off, like heat.
That rewrites job descriptions. For security teams, generating evidence becomes part of the architecture, not a fire drill. For engineers, telemetry becomes governance infrastructure, not just debugging exhaust. For boards, compliance shifts from reading last quarter’s report to watching continuous assurance. For investors, the edge tilts toward whoever’s systems can prove themselves automatically while they run, a different kind of moat, and a sturdier one.
The bottom line
For a long time, compliance has centered on proving you follow a standard. As AI-native systems mature, I increasingly think that definition is expanding. Compliance is becoming an evidence system, its job isn’t only to satisfy an auditor, but to continuously earn trust with everyone who depends on you: customers, regulators, partners, insurers, and increasingly, other software talking to yours.
FedRAMP 20x didn’t create this. Cloud computing did. AI is pouring gas on it. FedRAMP just turned the lights on. The companies that win the next decade won’t be the ones with the thickest compliance binders. They’ll be the ones whose systems can show, continuously, that they’ve earned the trust. In an AI-native company, trust isn’t something you declare once a year and file away. It’s something your systems have to earn, every single day.
From an industry perspective, this shift may also redefine where enterprise security spending goes. If trust increasingly depends on continuously generated, machine-readable evidence rather than documentation assembled for an audit, then evidence itself becomes part of the production infrastructure. That creates demand not just for better compliance software, but for systems that can continuously observe, verify, and demonstrate trust while they run.
Whether you’re building enterprise software, leading security, or investing in infrastructure, the question is becoming the same: how does a system continuously prove that it deserves to be trusted?
The post Compliance Is Quietly Becoming an Evidence Problem appeared first on Chasing Polaris – Wickey's blog.
Source(s):
Wang, W. (2026, June 27). Compliance Is Quietly Becoming an Evidence Problem. Security Boulevard. https://securityboulevard.com/2026/06/compliance-is-quietly-becoming-an-evidence-problem/