ISACA: Point-in-Time AI Compliance Cannot Survive Legal Scrutiny
What happened
ISACA published Legally Defensible AI: Governance That Can Stand Up to Scrutiny on September 4, 2026, setting out a practitioner framework for AI governance programs that can withstand regulatory inquiry, litigation, and audit. The guidance distinguishes sharply between compliance as a periodic exercise and governance as a continuous evidentiary function, arguing that defensibility depends on documented proof at every stage of the pre- and post-deployment lifecycle. Key requirements identified include a live, maintained AI system inventory, named accountability for each system, a documented legal basis for deployment, and a traceable risk assessment record that is updated as systems and operating contexts change. The publication arrives as EU AI Act enforcement has formally begun and as regulators and courts in multiple jurisdictions are demonstrating that documentation gaps, not just technical failures, attract enforcement consequences. It reinforces concerns raised by Collibra and others that static AI compliance documentation is no longer sufficient in a landscape where continuous oversight expectations are hardening across frameworks including ISO/IEC 42001:2023.
Why it matters
- ·Regulators and courts are increasingly treating documentation gaps as independent governance failures. The EU AI Act enforcement apparatus and active litigation trends mean that an AI governance program that cannot produce timestamped, ownership-attributed evidence across the full model lifecycle is exposed, regardless of the underlying model's technical performance.
- ·Named accountability is now a baseline defensibility requirement, not an organizational preference. If compliance teams cannot identify who is responsible for each AI system and demonstrate that the responsible party actively maintained oversight throughout the deployment period, the organization has no credible answer to a regulator or plaintiff who asks who was in charge when something went wrong.
- ·A static AI inventory is functionally a liability. ISACA's guidance implies that any organization running an annual or quarterly inventory refresh, rather than a continuously maintained register, cannot produce the evidence required to show that its governance program was operational at the moment of an incident or audit inspection.
Stay ahead of stories like this
Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit your current AI inventory process to determine whether it is continuously maintained or periodically refreshed, and assign a named owner accountable for real-time accuracy.
- ☐Review each AI system record to confirm it includes a documented legal basis for deployment and a risk assessment that has been updated since the system last changed in scope, data inputs, or operating context.
- ☐Map ownership assignments across your AI system portfolio and confirm that named owners have documented their oversight activities, not just their title designations.
- ☐Test whether your existing audit trail infrastructure can produce a chronological evidence record for a specific system spanning pre-deployment approval through current operation, and identify gaps before a regulator or court requests it.
- ☐Align your AI lifecycle governance documentation standards with ISO/IEC 42001:2023 clause requirements and cross-check against any EU AI Act conformity assessment obligations applicable to your system portfolio.
What to watch next
Compliance teams should monitor EU AI Office enforcement actions closely over the coming months, as early cases are likely to test exactly the documentation and accountability standards ISACA describes. Guidance from national market surveillance authorities on what constitutes adequate lifecycle evidence will shape how the bar is set in practice. Teams operating under financial services model risk frameworks should also track any supervisory updates that extend SR 26-2 logic into AI-specific documentation requirements, since the evidentiary standard ISACA outlines maps closely onto the model validation and governance expectations that banking regulators are already articulating. The NIST AI documentation guidance draft is also worth monitoring for alignment, as it may become a reference standard in U.S. enforcement and procurement contexts.