Topic starter
27/06/2026 1:45 pm
TL;DR: The article argues that the EU AI Act and NIST AI RMF are already pushing enforceable expectations for accountability, risk classification, transparency, and documentation, while most organisations still lack visibility into who owns their AI and what data it uses, according to Abnormal AI. The governance gap is now an ownership and assurance problem, not a tooling problem.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Preparing for AI Regulation: What CISOs Can Do Now”.
Key questions
Q: How should organisations govern AI systems that can make consequential decisions?
A: Organisations should govern consequential AI systems with the same discipline used for high-risk identities: defined ownership, least privilege, logging, approval boundaries, and human override.
Q: Why does AI create a governance problem for CISOs even when the technology works?
A: Because the main failure mode is not model performance, it is accountability.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Build a living AI inventory Map every internal model, third-party AI tool, and AI-enabled process that influences decisions.
- Assign accountable outcome owners Name a business owner for each AI system who is responsible for outcomes, not just technical operation.
- Classify AI by business impact Rank systems by whether they affect customers, finances, operations, or safety, then apply deeper review to higher-impact use cases.
Bottom line: AI regulation is pushing governance into the CISO remit, but the real issue is whether the enterprise can prove ownership and accountability for AI in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:12 pm
AI accountability is becoming an ownership problem before it becomes a tooling problem. The article shows that regulation is converging on a simple expectation: if an organisation deploys AI, it must be able to explain who owns it, how it is classified, and what data influences it. That is an identity and governance challenge, not just a security engineering task. CISOs should treat AI as a managed enterprise asset with explicit accountability, not as an ambient capability attached to other systems.
A few things that frame the scale:
- 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How do automation and human accountability differ in AI governance?
A: Automation can monitor, test, and collect evidence at scale, but it cannot decide how much risk the organisation should accept. Human accountability is the control that sets the policy boundary, reviews exceptions, and signs off on the consequence of using AI in production.
👉 Read our full editorial: AI regulation is raising the bar for CISO accountability