ISO 27001, SOC 2, and NIST assume humans made decisions and left a paper trail. That assumption is breaking.
Imagine an auditor sitting across from your engineering team. They're working through your change management controls. They want to know: who approved this code change? What was the review process? Is there evidence that a qualified person made a deliberate decision?
Six months ago, the answer was straightforward: here's the pull request, here's the review, here are the approvals.
Today, the honest answer for many teams is: "We described the problem to Claude, it suggested this implementation, we thought it looked right, and we merged it."
That answer is not covered anywhere in ISO 27001. It barely appears in SOC 2. NIST is only now beginning to grapple with it. And the gap between those frameworks and how engineering teams actually work in 2026 is widening every week.
