AI Governance Institute
← News
Research2026-05-06

AI Governance Requires Integrated Privacy, Cybersecurity, and Legal Functions, ISACA Article Argues

What happened

ISACA, the global professional association focused on IT governance and audit, published Collaboration and the New Triad of AI Governance on December 31, 2025. The article argues that effective AI governance requires the formal integration of privacy, cybersecurity, and legal functions across the full AI life cycle, rather than allowing those functions to operate independently. It references the EU AI Act, the NIST AI Risk Management Framework, and multiple U.S. executive orders as converging regulatory frameworks that collectively make siloed governance approaches structurally inadequate. The piece identifies transparency and accountability as shared obligations that no single organizational function can satisfy alone. While the article does not introduce a new standard or impose binding obligations, it reflects ISACA's institutional position that enterprise AI governance programs must be organized around cross-functional accountability structures with defined decision rights and a shared risk register.

Why it matters

  • ·Regulatory exposure: The EU AI Act simultaneously requires conformity assessments, data governance documentation, and cybersecurity robustness measures, meaning compliance programs built around a single function such as legal review or data protection will be structurally incomplete and potentially non-compliant.
  • ·Operational impact: Organizations relying on ad hoc coordination between privacy, security, and legal teams will face gaps in AI risk coverage as frameworks like the NIST AI RMF demand integrated governance, mapping, measurement, and management activities that span organizational silos.
  • ·Organizational risk: Without a formally chartered cross-functional AI governance committee, ownership of AI obligations that sit at the intersection of privacy, security, and legal risk will remain unclear, increasing the likelihood of accountability failures and delayed responses to incidents or regulatory inquiries.

Governance controls affected

BRD-002AI Governance Committee Charter and Decision RightsBRD-007Federated AI Governance DesignBRD-009Unified Multi-Framework AI Risk RegisterCMP-007EU AI Act Conformity Assessment and FRIA ProcessALC-005Regulatory Audit Readiness

What to do now

  • ☐Audit current AI governance structures to determine whether clear ownership is assigned for obligations that span privacy, cybersecurity, and legal functions, and document any gaps.
  • ☐Expand AI system inventories to capture not only the systems in use but also their risk classifications and the specific regulatory requirements triggered under the EU AI Act, NIST AI RMF, and applicable U.S. executive orders.
  • ☐Establish or formalize a cross-functional AI governance committee with defined decision rights, documented escalation paths, and a shared risk register that consolidates inputs from privacy, security, and legal teams.
  • ☐Use ISACA's triad model as an authoritative reference when building internal business cases for dedicated AI governance resources, particularly when presenting program investment proposals to executive leadership or boards.
  • ☐Review whether existing incident response playbooks and escalation paths reflect multi-domain AI risk scenarios that require coordinated action across privacy, cybersecurity, and legal functions.

What to watch next

Compliance teams should monitor whether ISACA supplements this article with more prescriptive guidance, such as updated audit frameworks or certification requirements that operationalize the triad model. Teams operating under the EU AI Act should track the European AI Office's publication of implementing acts and conformity assessment guidelines, which will clarify how multi-domain obligations are expected to be satisfied in practice. Enforcement signals from EU data protection authorities and sector-specific regulators in financial services will also indicate how aggressively cross-functional compliance gaps are being scrutinized.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-06

Telstra's Role-Based AI Policy Overhaul Offers a Replicable Governance Blueprint

A case study published by the University of Technology Sydney documents how Telstra restructured its AI governance program around role-based policy ownership and simplified intake and impact assessment workflows. The research, produced through UTS's Human Technology Institute, identifies specific operational changes that reduced friction in AI triage while strengthening accountability. Enterprise compliance teams can extract a practical operating model from the findings.

Research2026-09-03

ISO 42001 Implementation Gap Exposed: Clause-by-Clause Guide Sets Audit Baseline

enz.ai has published a detailed implementation guide for ISO/IEC 42001:2023, covering each clause of the standard from scoping and leadership through internal audit and Annex A control mapping. The guide gives compliance teams a structured path for standing up a conformant AI management system before pursuing formal certification. Organizations facing regulatory expectations of structured AI governance can use the guidance to assess and close readiness gaps.

Research2026-09-01

SR 26-2 Forces Banks to Rethink Model Governance From Inventory to Board Oversight

The OCC and Federal Reserve's revised model risk management guidance, SR 26-2, resets supervisory expectations for U.S. banks by shifting to a materiality-based approach that covers both traditional statistical models and AI systems, replacing the SR 11-7 framework that had governed bank model governance since 2011. Practitioner analysis from CRA identifies four areas banks must redesign: inventory scope, model tiering, validation independence, and governance alignment up to the board. A companion implementation guide from Lumenova AI adds concrete steps, including inventory rationalization and a distinct governance lane for agentic and generative AI, while a proposed academic framework maps a six-layer control architecture for bringing GenAI systems into SR 26-2 scope. Banks that still run AI governance and model risk management as separate programs face the most immediate pressure to harmonize them.