Information Systems Audit And Control Association Inc Group

While these examples offer a strong foundation for AI governance, significant gaps remain. The limited coordination between countries has resulted in inconsistent regulations and border enforcement. For example, the EU AI Act emphasizes stringent controls and risk-management practices for high-risk AI systems. Other regions may have more lenient standards or lack comprehensive AI governance altogether. These disparities can create challenges for organizations operating in multiple regions, as they must navigate a complex web of regulations that may conflict or lack interoperability. Inconsistent regulatory approaches can produce uncertainty, complicate compliance efforts, and increase operational costs for businesses that need to tailor their AI governance strategies to meet varying international standards.

COBIT is structured into five key domains (figure 1). These domains include 40 objectives designed to manage IT-related activities, ranging from strategic planning to day-to-day operations and performance monitoring.

Consider a global e-commerce company that is planning to implement an AI-driven customer service system to enhance customer satisfaction and reduce operational costs. The company’s leadership has identified key stakeholder needs for faster response times, higher customer engagement, and more personalized interactions. However, the organization also recognizes the risk associated with AI (such as potential bias in customer interactions), regulatory compliance (especially regarding customer data), and the need for ongoing support to maintain AI system performance.