Those 4 are in the role cards below. The other 14 are still active in the market and they all feed the data in the market section. The trends come from all 18, not just the ones worth applying to right now.
What the full picture is showing: this market isn't asking for more GRC experience in isolation. It's asking for GRC fluency that extends into AI governance. Framework knowledge, coding in some cases, and the ability to build governance infrastructure rather than just audit it. Three of the four fresh roles require some form of technical work. All four list at least one cross-border AI regulation. That is not a coincidence.
| Role | Company | Range |
|---|---|---|
| GRC Engineer | WorkOS | $175K–$275K |
| AI Governance & Risk Lead | Bloomberg | $185K–$245K |
| Senior Dir, Data Gov & Privacy | FTI Consulting | $116.5K–$256K |
| VP AI Risk Management | Moody's | $163.3K–$236.8K |
| AI Gov & Privacy Sr. Consultant | Deloitte | $118.7K–$218.6K |
| Senior GRC Analyst | Crusoe | $130K–$150K |
The Great American Artificial Intelligence Act of 2026 was introduced June 4 by a bipartisan Senate group. It creates a federal AI regulatory framework for the first time in US history. The enforcement structure is not a suggestion.
$1,000,000 per day for deploying high-risk AI systems without required impact assessments. Per day, not per violation. Risk-tiering model closely based on the EU AI Act: mandatory impact assessments, documentation, human oversight, and incident reporting before deployment for high-risk systems.
Two things matter most right now. The 3-year preemption clause. If passed as introduced, it preempts state AI laws including California AB 2885, Colorado SB 205, Texas HB 1709, and a dozen others. One federal framework instead of a patchwork. And the company size thresholds. Smaller companies may have reduced obligations, which matters for your third-party risk program as much as your own.
Whether this bill passes, gets amended, or stalls. GRC teams need to know it exists. The penalty structure will move board attention and budgets before the law takes effect. That's already happening with the EU AI Act.