ISACA CEO Urges Accountability as AI Adoption Outruns Governance

Turning AI Adoption into a managed business practice requires more than permission to use new tools. ISACA CEO Erik Prusch says organizations need clear accountability, practical controls and trained staff as artificial intelligence spreads faster than governance.

In a Cyber Magazine interview, Prusch described a gap between access and oversight. ISACA’s 2026 AI Pulse Poll found that 82% of European organizations explicitly permit AI, while only 42% have a formal, comprehensive policy. One-third (33%) do not require employees to disclose AI contributions, and 20% of professionals do not know who would be accountable if an AI system caused harm.

Turning AI Adoption into Measurable Governance

Prusch said leaders should be able to demonstrate four elements before scaling AI: accountability, control, explainability and culture. A named board member or senior executive should hold responsibility across the organization. Teams also need the ability to stop or contain a system quickly when something goes wrong.

That control is not always clear. ISACA’s poll found that 59% of European organizations could not say how quickly they could stop or contain an AI system. The proposed CMMI AI Maturity Model, or CMMI AIM, gives organizations an operational model and structured appraisal process to measure maturity, rather than simply claim it.

The other two elements concern what happens after deployment. Organizations should be able to investigate incidents and explain them to leaders, regulators and other stakeholders. Employees should also be able to use AI openly within clear rules and with appropriate training.

Compliance Needs Testing and Skilled Owners

Prusch distinguished regulatory compliance from resilience. Compliance means meeting requirements for policies, controls, reporting and evidence under the EU AI Act, DORA and NIS2. Resilience means detecting, responding to and recovering from disruption, and testing those abilities in practice.

He said organizations need policies that reflect how they actually use AI, supported by trained front-line professionals who can maintain compliance, identify risks and strengthen resilience. His view aligns with wider executive discussions about board oversight of AI and the training leaders need to govern autonomous systems.

Skills remain a concern. The poll found that 54% of European respondents believed they needed to develop AI skills within six months to retain their role or advance; 79% said the need applied within a year. Yet 21% of organizations still provided no formal AI training. ISACA’s AAIR and AAISM credentials are designed to help experienced professionals build capabilities for the AI era.

Trust Depends on Shared Responsibility

Prusch said cybersecurity, audit, risk, privacy and governance teams each see different parts of AI exposure. Because the technology affects all those areas, treating its risks only as a technical matter leaves gaps. Siloed work, he said, can leave organizations more exposed as threats grow more complex.

AI also puts confidence in digital information under pressure. ISACA’s poll found that 58% of European professionals believed AI had made digital information significantly harder to authenticate, while 71% said AI-enabled phishing was harder to identify. Prusch said organizations should be transparent about where and how AI is used, including across supplier and partner networks.

Prusch framed trust as something organizations earn through clear policies, defined accountability and transparency. ISACA provides frameworks such as COBIT and CMMI AIM, and it works with policymakers. The organization contributed to the UK’s Software Security Code of Practice, while the UK Government mapped its Cyber Governance Code to COBIT.

That focus on named responsibility also appears in other CEO leadership strategies, where executives connect organizational practices to business priorities. And the debate over technology rules extends beyond AI, as shown by proposed stablecoin rules and the role of regulation in building trust.

ISACA says it will continue offering practical insight as technology and policy develop. For businesses adopting AI, Prusch’s near-term test is whether responsibility is named, controls can be used, incidents can be explained and staff know how to work within the rules.