COBIT Is No Longer Just About IT Risk — Now It's About Governing AI Too

COBIT — the framework behind our flagship IT audit — has spent close to two decades associated with a fairly predictable set of topics: risk control, compliance, data governance. In 2026, that picture is widening: guides to the framework increasingly reference its applicability to auditing AI/ML systems and governing cloud platforms — areas where decisions get made faster than formal policy usually can keep up.

The logic makes sense: COBIT's domains (EDM, APO, BAI, DSS, MEA) were never built around a specific technology to begin with — they're built around the question of who's accountable and how you verify it. That's exactly what's missing at most companies that started using AI tools over the past year without a single unified policy.

For our clients, that means one thing: a COBIT audit isn't a paperwork exercise — it's a way to spot blind spots before they become expensive. You can track the framework's current state on ISACA's own site, the organization that maintains it.