ISACA is warning that organizations lack the training and governance needed to manage growing AI adoption, with only 32% of digital trust professionals believing their organizations adequately address AI risks involving privacy, bias and security. The findings were discussed at ISACA’s European conference on October 8, alongside plans for a new Advanced in AI Governance certification.
According to ISACA research, 54% of organizations are onboarding or implementing AI solutions, up from 46% in 2024. However, a 2025 survey of more than 3,000 digital trust professionals found that 32% reported no AI training for employees.
ISACA plans to launch its AI governance certification in early 2027, adding to existing credentials covering AI auditing, security management and risk. The organization said cybersecurity professionals increasingly need skills in AI oversight, configuration and monitoring as automation takes on more technical tasks.
Separately, ISACA CEO Erik Prusch warned that complying with emerging AI regulations could be significantly more challenging than implementing the Sarbanes-Oxley Act, describing it as “SOX on steroids.” He said businesses may need to establish compliance controls five to ten times faster, despite uncertainty around accountability, reporting requirements and overlapping regulations. Prusch warned that companies failing to establish adequate AI governance could face lawsuits and significant financial consequences.
Ryan McCurdy, VP of Marketing, Liquibase:
“The gap ISACA is pointing to will get a lot harder to manage as AI starts doing more of the actual work. Training employees and having an AI policy is important but what happens when an AI agent can deploy code, change a database, or take action against another critical system? At that point, having a policy that says what the AI should do isn’t enough. You need controls that determine what it can actually do.
“That’s why I think the SOX comparison is interesting. A big part of SOX was putting controls in place and then being able to prove those controls were followed. With AI, we’re potentially dealing with a much larger number of decisions happening much faster. Having a person review every one of them probably isn’t realistic.
“Companies will have to decide what AI can decide on its own, what can be handled through policy, and what actually needs a person involved. If an action meets the policies you’ve already established, let it move forward. If it doesn’t or the risk is higher, then bring someone in.
“You also need a record of what happened. If an AI agent makes a production change, I want to know what it changed, what policies it passed, what authorized it, and what actually reached production. It seems obvious but if we’re going to give AI more authority to act on its own, we also need to be able to prove what it did.”
ㅤIf you want my view, I say that companies will figure it out if there are fines, criminal charges, etc. And chances are that they will heavily keep AI locked up or heavily restrained.
ISACA finds AI governance and training gaps as enterprise adoption grows as CEO warns of mounting compliance challenges
Posted in Commentary with tags ISACA on October 13, 2026 by itnerdISACA is warning that organizations lack the training and governance needed to manage growing AI adoption, with only 32% of digital trust professionals believing their organizations adequately address AI risks involving privacy, bias and security. The findings were discussed at ISACA’s European conference on October 8, alongside plans for a new Advanced in AI Governance certification.
According to ISACA research, 54% of organizations are onboarding or implementing AI solutions, up from 46% in 2024. However, a 2025 survey of more than 3,000 digital trust professionals found that 32% reported no AI training for employees.
ISACA plans to launch its AI governance certification in early 2027, adding to existing credentials covering AI auditing, security management and risk. The organization said cybersecurity professionals increasingly need skills in AI oversight, configuration and monitoring as automation takes on more technical tasks.
Separately, ISACA CEO Erik Prusch warned that complying with emerging AI regulations could be significantly more challenging than implementing the Sarbanes-Oxley Act, describing it as “SOX on steroids.” He said businesses may need to establish compliance controls five to ten times faster, despite uncertainty around accountability, reporting requirements and overlapping regulations. Prusch warned that companies failing to establish adequate AI governance could face lawsuits and significant financial consequences.
Ryan McCurdy, VP of Marketing, Liquibase:
“The gap ISACA is pointing to will get a lot harder to manage as AI starts doing more of the actual work. Training employees and having an AI policy is important but what happens when an AI agent can deploy code, change a database, or take action against another critical system? At that point, having a policy that says what the AI should do isn’t enough. You need controls that determine what it can actually do.
“That’s why I think the SOX comparison is interesting. A big part of SOX was putting controls in place and then being able to prove those controls were followed. With AI, we’re potentially dealing with a much larger number of decisions happening much faster. Having a person review every one of them probably isn’t realistic.
“Companies will have to decide what AI can decide on its own, what can be handled through policy, and what actually needs a person involved. If an action meets the policies you’ve already established, let it move forward. If it doesn’t or the risk is higher, then bring someone in.
“You also need a record of what happened. If an AI agent makes a production change, I want to know what it changed, what policies it passed, what authorized it, and what actually reached production. It seems obvious but if we’re going to give AI more authority to act on its own, we also need to be able to prove what it did.”
ㅤIf you want my view, I say that companies will figure it out if there are fines, criminal charges, etc. And chances are that they will heavily keep AI locked up or heavily restrained.
Leave a comment »