AI Governance Institute
← News
Research2026-05-06

AI Governance Requires Integrated Privacy, Cybersecurity, and Legal Functions, ISACA Article Argues

What happened

ISACA, the global professional association focused on IT governance and audit, published Collaboration and the New Triad of AI Governance on December 31, 2025. The article argues that effective AI governance requires the formal integration of privacy, cybersecurity, and legal functions across the full AI life cycle, rather than allowing those functions to operate independently. It references the EU AI Act, the NIST AI Risk Management Framework, and multiple U.S. executive orders as converging regulatory frameworks that collectively make siloed governance approaches structurally inadequate. The piece identifies transparency and accountability as shared obligations that no single organizational function can satisfy alone. While the article does not introduce a new standard or impose binding obligations, it reflects ISACA's institutional position that enterprise AI governance programs must be organized around cross-functional accountability structures with defined decision rights and a shared risk register.

Why it matters

  • ·Regulatory exposure: The EU AI Act simultaneously requires conformity assessments, data governance documentation, and cybersecurity robustness measures, meaning compliance programs built around a single function such as legal review or data protection will be structurally incomplete and potentially non-compliant.
  • ·Operational impact: Organizations relying on ad hoc coordination between privacy, security, and legal teams will face gaps in AI risk coverage as frameworks like the NIST AI RMF demand integrated governance, mapping, measurement, and management activities that span organizational silos.
  • ·Organizational risk: Without a formally chartered cross-functional AI governance committee, ownership of AI obligations that sit at the intersection of privacy, security, and legal risk will remain unclear, increasing the likelihood of accountability failures and delayed responses to incidents or regulatory inquiries.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

BRD-002AI Governance Committee Charter and Decision RightsBRD-007Federated AI Governance DesignBRD-009Unified Multi-Framework AI Risk RegisterCMP-007EU AI Act Conformity Assessment and FRIA ProcessALC-005Regulatory Audit Readiness

What to do now

  • ☐Audit current AI governance structures to determine whether clear ownership is assigned for obligations that span privacy, cybersecurity, and legal functions, and document any gaps.
  • ☐Expand AI system inventories to capture not only the systems in use but also their risk classifications and the specific regulatory requirements triggered under the EU AI Act, NIST AI RMF, and applicable U.S. executive orders.
  • ☐Establish or formalize a cross-functional AI governance committee with defined decision rights, documented escalation paths, and a shared risk register that consolidates inputs from privacy, security, and legal teams.
  • ☐Use ISACA's triad model as an authoritative reference when building internal business cases for dedicated AI governance resources, particularly when presenting program investment proposals to executive leadership or boards.
  • ☐Review whether existing incident response playbooks and escalation paths reflect multi-domain AI risk scenarios that require coordinated action across privacy, cybersecurity, and legal functions.

What to watch next

Compliance teams should monitor whether ISACA supplements this article with more prescriptive guidance, such as updated audit frameworks or certification requirements that operationalize the triad model. Teams operating under the EU AI Act should track the European AI Office's publication of implementing acts and conformity assessment guidelines, which will clarify how multi-domain obligations are expected to be satisfied in practice. Enforcement signals from EU data protection authorities and sector-specific regulators in financial services will also indicate how aggressively cross-functional compliance gaps are being scrutinized.

Related Coverage

Research2026-11-07

External AI Audits Cannot Stand Alone, California Frameworks Show

A Law360/MLex commentary by Maria Dinzeo and Amy Miller examines California's emerging independent AI audit frameworks. It finds that current evaluation methods cannot reliably confirm that advanced AI models are safe. The analysis concludes that external audit reports should be treated as one layer of evidence, not a substitute for internal controls, continuous monitoring, and residual-risk acceptance. Compliance teams that treat an audit certificate as a compliance endpoint face unresolved governance exposure.

Research2026-11-06

IIA Sets Banking AI Audit Baseline With 12-Bank Input

The Institute of Internal Auditors has published a principles-based audit structure for AI in banking organizations, developed with input from 12 global banks. The guide covers governance and policy, risk taxonomy, model risk management, cybersecurity, operational resilience, third-party management, and AI literacy. It gives internal audit teams a practical basis for scoping AI reviews and testing whether controls are actually working.

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.