Why Annual Cloud Compliance Is No Longer Enough

A practical approach to continuous cloud governance, automated controls and EU AI Act readiness

Cloud environments can change significantly between annual audits. New accounts are created, permissions are updated, security settings drift and AI systems are modified. An organisation may pass an audit in January but develop serious compliance gaps only a few weeks later. For CEOs and CTOs, the important question is no longer simply, “Did we pass our last audit?” The more useful question is, “Can we prove that our cloud environment is compliant today?”

Annual audits remain important because they provide independent assurance. However, they only show the condition of selected systems and controls during a particular period. They may not reveal a storage bucket that became publicly accessible after the audit, a privileged user who received excessive permissions or a security service that was accidentally disabled. This gap creates a need for continuous cloud compliance, where controls are monitored and evidence is collected throughout the year.

From Periodic Audits to Continuous Assurance

Continuous cloud compliance is an operating model in which an organisation regularly evaluates its cloud resources against approved security, regulatory and business requirements. Instead of waiting for auditors to request screenshots and spreadsheets, the organisation produces timestamped evidence directly from its cloud systems.

This approach gives management a more accurate view of risk. It also allows technical teams to detect problems earlier, identify the person responsible and record how the issue was resolved. Annual audits can then focus on validating the effectiveness of the governance system rather than spending most of their time collecting basic evidence.

Manual compliance processes usually depend on screenshots, documents, emails and samples. This information can quickly become outdated and may cover only part of the cloud environment. Automated compliance provides broader and more regular coverage by checking defined accounts, regions and resources. It can also send findings to the correct teams and maintain a history of remediation and approved exceptions.

Automation should not remove human responsibility. It should handle repeatable checks while allowing people to focus on decisions that require business, legal or technical judgement.

A Simple Cloud Governance Model

Leadership and regulatory requirements → Cloud policies and controls → AWS accounts, workloads, data and AI systems → Continuous monitoring and evidence → Remediation, exceptions and human review

The results of human review feed back into the policies and controls, creating a continuous improvement cycle.

The model begins with leadership and accountability. Executives define the organisation’s risk appetite, provide funding and appoint responsible control owners. Legal, risk and compliance teams interpret regulations, standards and contracts. These requirements are then converted into clear technical controls, tests and evidence requirements.

The controls are applied across cloud accounts, workloads, databases, identities and AI systems. Continuous monitoring tools observe changes and evaluate whether resources remain compliant. When a control fails, the finding is prioritised and sent to the appropriate owner. The organisation then remediates the issue or approves a documented exception. Lessons from these events are used to improve the control design.

Three Controls to Automate First

The first control should focus on cloud resource configuration and exposure. It should continuously check important settings such as encryption, public access, network exposure, security logging and approved deployment regions. AWS Config can record resource configurations and evaluate them against managed or custom rules. AWS explains that configuration recording is performed on a best-effort basis and that some changes may take longer to appear, so organisations should also measure the freshness and coverage of their evidence (Amazon Web Services [AWS], n.d.-c).

The second control should address privileged access and cloud account boundaries. Organisations need to know who has powerful access, which regions can be used and whether workloads are operating inside approved organisational units. AWS Control Tower provides preventive, detective and proactive controls for governed multi-account environments. Preventive controls block prohibited actions, detective controls identify non-compliance and proactive controls check resources before they are provisioned through supported processes (AWS, n.d.-b).

Not every access or configuration decision should be automated. Emergency access, high-risk remediation and important business exceptions should continue to require human approval. Every exception should identify an owner, explain the business reason, describe any compensating control and include an expiry date. An exception without an owner or expiry date can easily become a permanent weakness.

The third control should cover security findings, logging and evidence retention. Security findings should be centralised rather than scattered across different accounts and tools. AWS Security Hub CSPM performs continuous or scheduled security checks, combines findings from AWS services and partner tools and supports response workflows through services such as Amazon EventBridge (AWS, n.d.-a).

Each evidence record should show the affected resource, cloud account, region, control version, evaluation time, finding status and remediation action. If an exception was approved, the evidence should also contain the approval and its expiry date. Missing monitoring data should itself be treated as a control failure because an organisation cannot prove compliance for systems it cannot see.

How the AWS Services Work Together

AWS Control Tower, AWS Config and AWS Security Hub CSPM perform different but connected functions. AWS Control Tower establishes a governed multi-account environment and applies organisational guardrails. AWS Config records and evaluates resource configurations. AWS Security Hub CSPM consolidates findings, checks resources against enabled standards and helps teams prioritise their response.

Security Hub standards can map regulatory or industry requirements to technical controls and run checks against those controls (AWS, n.d.-d). However, a successful technical check does not automatically prove complete regulatory compliance. The organisation must still determine which regulations apply, which systems are in scope, whether its controls are suitably designed and whether the available evidence is sufficient.

Technical automation provides the evidence, but management remains accountable for interpreting that evidence and making risk decisions.

Preparing for the EU AI Act

Cloud governance is increasingly connected with AI governance because many AI systems are developed, deployed and monitored in cloud environments. The EU Artificial Intelligence Act introduces obligations related to transparency, risk management, documentation, human oversight and accountability (European Parliament & Council of the European Union, 2024).

Transparency requirements under Article 50 became applicable on 2 August 2026. These requirements include informing people when they are interacting with certain AI systems and marking or labelling specified AI-generated or manipulated content (European Commission, 2026b).

The European Commission’s current guidance also reports revised enforcement dates for certain high-risk AI systems. Rules for systems used in areas such as biometrics, critical infrastructure, education, employment and migration are expected to apply from 2 December 2027. Requirements for certain AI systems integrated into regulated products are expected to apply from 2 August 2028 (European Commission, 2026a). Organisations should continue monitoring official guidance and obtain legal advice when determining their obligations.

For AI Act readiness, an organisation should maintain a clear inventory of its AI systems. Each system should have named business and technical owners, information about its models and datasets, deployment locations, access records and change history. The organisation should also retain system logs, incident records, testing evidence and details of human oversight.

Continuous cloud compliance can help collect and maintain this evidence. However, it cannot replace legal interpretation, conformity assessments, fundamental-rights reviews or human responsibility for AI-related decisions.

New Research on Automated Compliance Mapping

A new research paper published as an arXiv preprint on 7 July 2026 examines how specialised language models can help automate the mapping of cloud security controls to technical metrics and related requirements.

In Automated Compliance Mapping in Cloud Security With Domain-Adapted Sentence Transformers, Bianchi, Petrillo, Martinelli and Petrocchi created a base dataset containing 3,499 semantic pairs from European cloud-security standards and technical metrics. The researchers expanded the dataset to as many as 13,996 samples using translation and AI-assisted paraphrasing (Bianchi et al., 2026).

The fine-tuned models performed better than the tested zero-shot models. The largest reported improvement for control-to-metric mapping was 0.228 nDCG@10 points, while the best cross-standard result reached 0.870 nDCG@10 across all queries (Bianchi et al., 2026).

The research suggests that AI could help organisations compare controls across different frameworks, identify related technical metrics and reduce the manual effort involved in maintaining compliance mappings. However, the paper is a preprint, and its results should be treated as emerging research. AI-generated compliance mappings still need strong data-quality controls, explainable results and expert human review. AI can recommend a connection between requirements, but it should not make the final decision about whether an organisation is compliant.

Moving to Continuous Compliance

An organisation does not need to automate its entire cloud environment immediately. A practical starting point is one important service, cloud platform or AI workload. The organisation should first define its accounts, regions, data, identities, vendors and regulatory obligations. It should then connect each important requirement to a control owner, technical test, evidence source and response procedure.

The next stage is to apply suitable AWS Control Tower controls, enable the necessary AWS Config recording and rules, and centralise relevant findings in AWS Security Hub CSPM. Evidence-retention requirements and exception procedures should be defined at the same time.

Once the basic system is operating, the organisation should test it by deliberately creating safe control failures. The test should confirm that the change is detected, a finding is created, the correct owner is notified, the issue is resolved and the evidence is preserved. False positives, missing accounts, expired exceptions and slow evidence collection should then be reviewed.

Executives should receive a simple scorecard showing control coverage, evidence freshness, detection time, remediation time and the number of overdue exceptions. These measurements provide a clearer view of governance effectiveness than a single annual pass-or-fail result.

Conclusion

Continuous compliance is not the same as putting governance on autopilot. Automation should perform repeatable checks, identify changes and refresh evidence. People must remain responsible for risk decisions, legal interpretation, exceptions and control design.

A strong governance model should be able to explain what changed, which control detected it, who was responsible, what action was taken and what evidence proves the outcome. This is the difference between passing an audit once a year and being able to demonstrate compliance continuously.

At LINO Consulting & Research, we help leaders turn complex cloud, AI and compliance challenges into clear business decisions. Through strategic consulting, evidence-based research and executive enablement, we assess cloud governance models, identify compliance gaps, prioritise controls and develop practical roadmaps for continuous assurance.

Whether you are improving cloud governance, preparing for the EU AI Act or introducing automated compliance controls, we provide focused recommendations that connect technical requirements with business priorities.

Learn more at LINO Consulting & Research.

References

Amazon Web Services. (n.d.-a). AWS Security Hub CSPM documentation. Retrieved August 18, 2026.

Amazon Web Services. (n.d.-b). Control behavior and guidance. Retrieved August 18, 2026.

Amazon Web Services. (n.d.-c). Evaluating resources with AWS Config rules. Retrieved August 18, 2026.

Amazon Web Services. (n.d.-d). Standards reference for Security Hub CSPM. Retrieved August 18, 2026.

Bianchi, J., Petrillo, L., Martinelli, F., & Petrocchi, M. (2026). Automated compliance mapping in cloud security with domain-adapted sentence transformers [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2607.06364

Certive. (n.d.). Certive. Retrieved August 18, 2026, from https://certive.io

European Commission. (2026a, July 6). Guidelines for providers and deployers of AI high-risk systems.

European Commission. (2026b, August 2). Safer and more transparent AI.

European Parliament & Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official Journal of the European Union.

We turn market complexity into executive decisions

Get in Touch

office@lino-consulting-research.com

© 2026. All rights reserved.

Imprint

Privacy Policy

General Terms and Conditions