For decades, the Three Lines of Defence stood as the gold standard of risk management. Born in the late ’90s, canonised by Sarbanes-Oxley in 2005, and immortalised by the Institute of Internal Auditors in 2013, it became the go-to framework for boards worldwide. It’s simple clarity — *First Line owns, Second Line oversees, Third Line assures* — restored trust in a chaotic corporate era.

But as of 2025, the obituary is in: cause of death, algorithmic obsolescence.

💻 Enter AI: Real-Time Assurance

Explainable AI (XAI) and model governance now deliver oversight in milliseconds — spotting anomalies, flagging exceptions, and documenting everything with precise timestamps. Quarterly audits are giving way to continuous autonomous assurance, where the old triangle compresses into a single, self-updating feedback loop. The once-static model has flattened into a circle.

🧍 And the Humans?

No group feels the shift more than Internal Audit. Independence, once defined by organisational distance, must now be reimagined when ownership, oversight, and assurance are all embedded in the same algorithm. The real question becomes: *“Who is training the model that’s watching everything?”*

Internal Auditors may find their new mission as curators of model integrity — safeguarding fairness, transparency, and ethical governance in AI-driven systems.

🚨 AI Standards, Please!

As AI steamrolls into governance, the demand for global regulatory clarity grows urgent. Risks are no longer just technical — they reshape accountability itself. And while the Three Lines aren’t obsolete *yet*, abandoning them without a replacement would be reckless.

AI is not a “get-out-of-governance-free” card. It should augment, not replace, human oversight. The organisations that thrive will be those that balance automation with accountability, and speed with scrutiny.

🧠 Key Takeaways

* The Three Lines of Defence is fading, replaced by explainable AI and real-time model governance.

* Internal Audit must evolve into stewards of AI integrity.

* Don’t abandon legacy frameworks without a plan B.

* Keep the human in the loop — always.

So, as we raise a cup of responsibly sourced Copenhagen coffee to the *Three Lines*, let’s remember: the future of assurance isn’t less oversight — it’s smarter, faster, and still very human. Farewell, to an Old Friend: