When Risks Can Think: Managing Risk and Compliance in the AI Era
Source: YouTube · ISACA HQ · published Sep 18, 2026 · 26:07
BLUF: As AI adoption accelerates, organizations face novel risks like model drift and autonomous agent behavior, requiring a shift from static compliance to integrated, real-time risk governance that balances speed with security. 2:30
Key Takeaways:
• Dynamic Risk Landscape: Traditional static risk assessments are insufficient for AI, which introduces variables that change independently based on data inputs and autonomous decision-making capabilities. 2:30
• New Threat Vectors: AI adoption amplifies existing cyber risks through "non-human identities" (AI agents) that may exploit misconfigurations without human awareness, necessitating enhanced visibility and monitoring. 5:48
• Visibility Gaps: "Shadow AI" and unvetted third-party tools create significant blind spots; organizations must enforce strict intake processes to assess data quality and regulatory compliance before deployment. 6:40
• Collaboration Over Silos: Fragmented risk registers lead to fragmented decisions. GRC, IT security, and privacy teams must collaborate in a single platform to ensure consistent policy enforcement and data sharing. 10:22
• Maturity Evolution: Effective AI risk programs evolve from a compliance-first mindset to a business-empowerment model, where risk management directly supports strategic ROI and executive decision-making. 22:20
Closing Statement:
To succeed in the AI era, risk management must transition from a retrospective checkbox exercise to a proactive, integrated partner that enables secure innovation. By embedding governance into the development lifecycle and fostering cross-functional collaboration, organizations can mitigate novel risks while maximizing business value.
Sources:
- 2:30 Discussion on the shift from static risk assessments to dynamic risks in AI.
- 5:48 Explanation of non-human identities and autonomous agents as new threat vectors.
- 6:40 Overview of shadow AI and the need for strict intake and approval processes.
- 10:22 Analysis of siloed GRC teams and the dangers of fragmented risk visibility.
- 22:20 Description of the maturity model moving from compliance to business strategy integration.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
This episode of the Isaka podcast is brought to you by One Trust. As organizations move faster with AI, risk [music] is getting harder to see, govern, and scale. New challenges like model drift, hallucinations, [music] model security, and expanded data use are raising the stakes for security, compliance, [music] and business leaders alike. One trust helps organizations take a more integrated approach to risk and compliance. With OneTrust [music] Risk Solutions, teams can better assess AI and technology risk across [music] the IT ecosystem, improve visibility across stakeholders, translate emerging risk into [music] enforcable controls, and support innovation with greater confidence. If you're looking to modernize risk management without slowing [music] the business down, OneTrust can help …