Artificial intelligence systems are no longer limited to making recommendations: they increasingly act with greater autonomy, prioritizing incidents, activating processes or making operational decisions without direct human intervention. This evolution and the question of who takes responsibility for these decisions was the focus of ISACA Europe Conference 2026, recently held in Munich.
Over three days, more than 50 international experts participated in more than 40 sessions before nearly 500 attendees from more than 50 countries to analyze how organizations can strengthen oversight, risk management and resilience in an increasingly complex technological and regulatory environment.
The timing of this debate is not coincidental. The EU Artificial Intelligence Regulation (AI Act), NIS2, DORA and the Cyber Resilience Regulation are together shaping a European regulatory framework that redefines governance, operational resilience and digital trust, as AI transforms all areas of business activity. The meeting revealed that the real challenge is no longer adopting AI, but rather establishing limits on its autonomy and guaranteeing the traceability of its actions.
Governance does not begin with adoption, but with authorization
Ben Hanson, AI agent security expert at Zenity, differentiated in his speech between protecting agents and governing their ability to act. As he explained, authorizations must have a limited duration, depend on the context and be revoked during execution. In addition, it is necessary to verify that each step continues to respond to the authorized objective, as well as control the documents and reports that influence the agents’ decisions. Their main conclusion was that it is not enough to stop an agent: if the capabilities delegated to other tools or agents are still active, control must span the entire execution chain.
The session dedicated to AI governance maturity also reflected the need to move from theory to practice. Daniel Manimbo, head of Artificial Intelligence and ISO at Schellman, and Kevin Schawinski, co-founder and CEO of Modulos, distinguished three levels of governance: model, system and organization. Their intervention focused on the system level, that is, the continuous monitoring of behavior during execution, the limitation of autonomous actions and the clear assignment of responsibilities in chains formed by multiple agents. Both defended that standards such as ISO 42001 must be translated into processes that operate continuously, and not remain mere documentation. Furthermore, these processes should build on existing controls rather than duplicating them.
Trust requires proving the origin of the content
In his presentation, Henry Ajder, expert in generative AI and deepfakes and founder of Latent Space Advisory, placed trust at the center of the transformation. According to him, synthetic content not only facilitates deception, but also calls into question the authenticity of real recordings. An organization’s reputation is no longer enough to validate its communications. For this reason, Ajder defended the use of content credentials and mechanisms that allow proving its origin, although he recognized that these tools cannot completely resolve distrust.
Monica Verma, cybersecurity expert and founder of Monica Talks Cyber, also highlighted that governance does not depend solely on processes and controls. In his speech, he linked cyber resilience with leadership and talent development. Their main argument was that security measures usually fail when they are implemented without the people who must subsequently apply them.
The conference highlighted the importance of human knowledge, leadership and responsibility in building trust in AI
The conference concluded with the intervention of Sarah Furness, leadership expert, former squadron leader of the British Royal Air Force and former combat helicopter pilot. Furness recommended understanding fear as a source of useful information, practicing deliberate decision-making and learning from mistakes, rather than expecting perfect responses to uncertainty.
Beyond technology and regulatory frameworks, the conference highlighted the importance of human knowledge, leadership and responsibility in building trust in AI.
As Chris Dimitriadis, Chief Global Strategy Officer at ISACA, explains: “Delegating a task to an AI agent does not mean delegating responsibility. Before granting autonomy to an agent, an organization must know what it can do, what information it can access, and who can intervene if it deviates from its objective. Control must be maintained throughout the entire execution chain. Frameworks such as the CMMI AI Maturity Model (CMMI AIM) can help organizations assess their AI maturity, strengthen risk management, and promote sustainable innovation. “It is equally important to have professionals with the right competencies in AI auditing, cybersecurity, risk and governance to ensure that AI delivers value in a responsible manner.”
The main question raised during the conference remains relevant far beyond Munich: how can organizations reconcile the increasing autonomy of AI agents with clear attribution of responsibilities, effective governance and the competencies necessary to maintain control? This is a challenge that will continue to shape the European digital trust agenda as organizations adapt to the EU AI Regulation, NIS2 and DORA.
