Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Governing AI and Emerging Technology
Enable, don’t block
Staff are already using AI tools, and the business wants the productivity they promise. A security manager who simply says no loses influence and pushes use into the shadows. ISACA’s 2026 CISM update factors in “today’s technologies”, and the expected role is clear: make adoption safe, through governance, risk assessment and guardrails.
What can go wrong
| Risk | Example |
|---|---|
| Data leakage | Confidential data pasted into an external model that stores or trains on it |
| Prompt injection | Hidden instructions in a document make an AI assistant leak data or misuse its tools |
| Unreliable output | Errors, made-up facts or biased decisions acted on without checks |
| Model and data poisoning | Tampered training data or models produce harmful behaviour |
| Third-party and IP | Vendor terms allow data use; copyright and licensing questions |
| Shadow AI | Unapproved tools used by staff outside any control |
Governing AI
- Policy and ownership: an AI use policy, an accountable owner and oversight by the steering committee.
- Inventory: every AI tool, model and use case, including AI features inside existing SaaS products.
- Assess risk: data, security, accuracy, bias, legal and vendor risks, with privacy and legal involved.
- Approve with controls: approved tools, data rules, human oversight, logging.
- Monitor and review: usage, incidents, model and vendor changes, new regulation.
Frameworks and regulation
| Framework | What it gives you |
|---|---|
| NIST AI Risk Management Framework | Four functions for AI risk: Govern, Map, Measure, Manage |
| ISO/IEC 42001 (2023) | Requirements for a certifiable AI management system, similar in style to ISO 27001 |
| EU AI Act | A risk-based law: prohibited uses, high-risk systems with strict obligations, transparency duties for limited-risk systems; obligations phasing in from 2025 |
| OWASP Top 10 for LLM applications | Common technical risks in AI applications |
Controls that work
- Approved tools: enterprise versions that don’t retain or train on the organisation’s data.
- Data rules: which classifications may go into which tools.
- Human oversight: people review AI output before important decisions.
- Technical guardrails: input and output filtering, least-privilege access for AI agents and tools, logging.
Example. A law firm finds staff pasting client documents into a free chatbot. Instead of a ban, it licenses an enterprise AI service that doesn’t retain or train on data, allows only that tool for confidential material, blocks the free ones and trains staff. Usage rises, and so does control.
The same approach works for any emerging technology, from IoT to quantum-safe cryptography: understand the business case, assess the risk, set guardrails and monitor.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step before adopting a new technology | Assess the business case and the risk |
| Best response to unapproved AI use | Govern it: policy, approved tools, data rules |
| Certifiable AI management system standard | ISO/IEC 42001 |
| NIST AI RMF functions | Govern, Map, Measure, Manage |
| Who owns the risk of an AI use case? | The business owner, advised by security, legal and privacy |
In short
- Emerging technology is a business opportunity and a risk; the security manager's job is to enable safe adoption, not to block it.
- AI risks include data leakage, prompt injection, unreliable or biased output, poisoned models or data, vendor and IP issues, and shadow AI.
- Governance steps: policy and ownership, inventory, risk assessment, approval with controls, monitoring and review.
- NIST AI RMF (Govern, Map, Measure, Manage) and ISO/IEC 42001 (a certifiable AI management system) provide structure.
- The EU AI Act takes a risk-based approach, from prohibited uses to high-risk systems with strict obligations, phasing in from 2025.
- The same approach applies to any emerging technology: understand the business case, assess the risk, set guardrails, monitor.
Exam traps
- Banning AI outright usually drives it underground (shadow AI); govern it instead.
- AI risk isn't only a security issue; legal, privacy, ethics and the business owner are involved.
- AI features inside existing SaaS products need assessment too.
- Approving a tool once isn't enough; models and vendor terms change.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What can go wrong
Governing AI
1 / 9