What ISACA Europe 2026 Told Us About the Future of AI Governance

At this year’s Information Systems Audit and Control Association (ISACA) Europe Conference 2026, one theme stood out above all others: organisations are accelerating their adoption of AI, but governance is struggling to keep pace.

The conversation has already moved beyond whether AI should be adopted. The focus is now on how organisations can deploy AI responsibly, securely and in a way that delivers sustainable business value.

Several themes emerged repeatedly throughout the conference, all of which have important implications for leaders navigating transformation and technology change.

Much of the discussion centred on the emergence of agentic AI, systems capable of making decisions, taking actions and interacting with business applications with limited human intervention.

While the opportunities are significant, so too are the governance challenges.

As organisations start entrusting AI with increasingly important activities, accountability, oversight and control become critical. Governance can no longer be treated as a compliance exercise that follows implementation. It must evolve alongside the technology itself.

The organisations that succeed will not necessarily be those that adopt AI fastest. They will be those that create trust and confidence in how it is used.

One of the strongest messages from the conference was the growing importance of identity and access management.

Historically, access controls were designed around people. Increasingly, organisations must also manage how AI agents access systems, applications and corporate data.

Questions that were once relatively straightforward are becoming more complex:

• What systems should an AI agent be able to access?
• What data can it use?
• What actions can it perform?
• How are its decisions monitored?
• Who remains accountable for the outcome?

Principles such as least privilege, role-based access control and segregation of duties are becoming even more important in an AI-enabled organisation.

As AI gains access to critical business systems, identity management moves from being a technical consideration to a strategic business control.

Another consistent theme was the need to shift security, privacy, resilience and compliance discussions further left in the transformation lifecycle.

Too often these considerations are reviewed near the end of a programme, after major design decisions have already been made.

The result is often one of three outcomes: delay, additional cost or acceptance of avoidable risk.

The conference reinforced a simple but important principle: risk should not be assessed after transformation decisions have been made. It should help shape them from the start.

When organisations involve risk stakeholders early, they make better decisions, reduce rework and create solutions that are more resilient and sustainable.

Beyond the technical discussions, there was a clear consensus that successful AI adoption is ultimately a business challenge rather than a technology challenge.

The organisations achieving the greatest benefits are not focused solely on deploying tools. They are focused on solving business problems, managing risk and delivering measurable outcomes.

Technology enables transformation. It should never become the transformation.

This distinction will become increasingly important as AI capabilities continue to mature and become more widely available.

The discussions at ISACA Europe 2026 strongly resonated with the work we do at Leading Resolutions.

Whether supporting organisations with AI readiness, core systems transformation or wider business change, the same principles consistently apply:

• Establish governance early.
• Understand and manage risk from the outset.
• Build security, privacy and resilience into decision-making.
• Focus on business outcomes rather than technology deployment.
• Create the conditions to realise long-term value.

My biggest takeaway from ISACA Europe 2026 is that organisations need more than help implementing technology.

They need help preparing for it.

The real challenge is not adopting AI. It is ensuring organisations have the governance, controls, operating models and leadership needed to manage risk, build trust and realise sustainable value from it.

Those that get this right will be far better positioned not only to benefit from AI today, but to adapt confidently to whatever comes next.

Nauman Khan is a Principal Consultant at Leading Resolutions, specialising in business analysis, technology-enabled change, identity and access management, cyber security and risk-led transformation.

Across his career, Nauman has delivered business and technology change in banking, building societies, insurance, retail and the public sector. His experience includes identity and access management, privileged access management, multifactor authentication, fraud and transaction monitoring, digital customer journeys, regulatory change and operating-model improvement. He has worked with organisations including Bupa, Yorkshire Building Society, Lloyds Banking Group, Coventry Building Society, Compare the Market, Vanquis Bank, HSBC, Deutsche Bank, NatWest Group and the Department for Education, helping teams translate complex requirements and risks into practical, sustainable change.