What happened
ISACA is preparing an AI governance certification and is accepting applications for a beta phase ahead of a launch in early 2027, Infosecurity Magazine reported. It joins a set of AI credentials the body has already pushed out: Advanced in AI Audit, Advanced in AI Security Management and Advanced in AI Risk.
The timing reflects a gap ISACA's own research keeps surfacing. Its 2025 AI Pulse Poll of more than 3,000 digital trust professionals found that 32% said no AI training is provided to any employees. In separate ISACA research, only 32% of digital trust professionals believed their organizations adequately address AI risks such as privacy, bias and security, even as 54% of organizations reported being involved in onboarding or implementing AI solutions, up from 46% in 2024.
Chris Dimitriadis, ISACA's chief global strategy officer, framed the certification as an umbrella over several professions. In remarks at the organization's Europe conference in Munich on October 8, he said the aim is helping people in cyber, audit and risk "control and govern AI rather than having AI on the loose." He also argued that AI training needs to be specialized by discipline and to include soft skills, because the work that remains human is the part requiring context and judgment.
Why this is a GRC story
A 54% adoption rate against 32% confidence in oversight is the finding that matters. Organizations are deploying faster than they are governing. That ratio is the classic setup for a control gap that shows up later as an audit finding, a regulator's question or an incident with no owner.
Training is a control, and it needs evidence. Frameworks already expect documented competence for the people who operate and approve risky systems. When AI moves into a decision path that touches customers, privacy or financial reporting, "we covered it in a lunch and learn" is not an artifact an auditor can test. A named curriculum, completion records and role mapping are.
Certification normalizes the role, and that has a compliance effect. Once AI governance has a credential, expectations form around it: job descriptions, audit scopes and second-line oversight all start assuming someone trained for the job. That shift makes the gap above more visible, not less, which is uncomfortable but useful.
What to watch
Watch whether the new credential gets picked up in regulated hiring and audit requirements. If it does, it becomes evidence of capability that examiners and boards will ask about by name.
For a practitioner, the near-term move costs nothing. Take the AI systems your organization already uses, list who owns each one, and mark which owners have documented training on the risks they are accepting. Where the owner line is blank, that is the gap to escalate, and it is far easier to fix before it appears in someone else's report.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.