Are COBIT & ITIL Enough? Why AI Governance Matters

Organizations that already use COBIT and ITIL can still have gaps in AI governance. COBIT provides a framework for the governance and management of enterprise information and technology, while ITIL helps organizations manage digital products and services. Both remain relevant when organizations adopt Artificial Intelligence, but AI introduces additional governance requirements related to data, models, risk, accountability, transparency, human oversight, and the AI lifecycle. ISACA published specific guidance on using COBIT for AI system governance in 2025, while PeopleCert now offers ITIL AI Governance Version 5.

Why Does Conventional IT Governance Need to Expand for AI?

Conventional IT governance primarily focuses on technology management, risk, controls, security, change, services, and compliance. These areas remain important for AI, but AI introduces additional governance objects such as datasets, models, prompts, outputs, model providers, AI agents, and changes in system behavior. The NIST AI Risk Management Framework specifically addresses the need to manage AI risks throughout design, development, use, and evaluation, including risks related to trustworthiness.

Organizations therefore need to extend their existing controls. Change management remains necessary, but changes to AI models or configurations should also be assessed for their potential impact on performance and risk. Vendor management remains equally important, but AI vendors need to be evaluated in areas such as data processing, security, privacy, model governance, and their ability to provide information required for assurance.

COBIT 2019 for AI Governance: Why COBIT Still Matters

COBIT 2019 for AI governance is not an approach that conflicts with AI Governance. ISACA explains that COBIT can support AI governance through strategic alignment, resource management, risk management, accountability, transparency, compliance, and lifecycle management. Its application can cover stages including design and development, deployment, operations, and monitoring.

COBIT can therefore serve as an enterprise governance foundation for AI. The challenge is translating governance objectives into controls that address the specific characteristics of AI. Organizations still need mechanisms for AI risk assessment, AI inventory, model oversight, data governance, monitoring, and human oversight.

ITIL 4 vs. AI Governance: They Address Different Areas

ITIL 4 vs. AI Governance should not be viewed as a choice between two competing frameworks. ITIL focuses on products and services, while AI Governance addresses the use of AI with specific attention to risk, accountability, and the AI lifecycle. When AI becomes part of customer service, internal applications, automation, or enterprise platforms, ITIL remains relevant for practices such as incident management, change management, service level management, and continual improvement.

The limitations of ITIL 4 for AI are that service management alone does not automatically address every requirement of AI risk management. Organizations still need to define how models are evaluated, how AI-related data is governed, how AI outputs are verified, and how decisions involving AI are supervised. The latest development in ITIL reflects this need through ITIL AI Governance Version 5, which addresses oversight, accountability, risk management, and trust in the application of AI across products, services, and organizational workflows.

AI Governance Frameworks: NIST AI RMF and ISO/IEC 42001

An AI Governance framework can complement an organization's existing enterprise governance structure. The NIST AI Risk Management Framework provides an approach to managing AI risks through four core functions: Govern, Map, Measure, and Manage. NIST has also published the Generative AI Profile to help organizations address risks that are more specific to Generative AI.

Meanwhile, ISO/IEC 42001 establishes requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). The standard can be applied by organizations that develop, provide, or use AI-based products or services.

AI Governance Enterprise Requires AI Inventory and Risk Assessment

AI Governance Enterprise requires visibility into how AI is being used across the organization. Companies need to know which AI systems are being used, who owns them, what data they process, which vendors or models they rely on, and which business processes they affect. Without an AI inventory, organizations have limited visibility into their actual technology exposure and AI-related risks.

Risk assessment can then be used to determine the appropriate level of controls. An AI system used to summarize internal documents does not have the same consequences as one used for recruitment screening, credit scoring, fraud detection, or other decisions that directly affect individuals. The level of governance should therefore correspond to the level of risk.

AI Corporate Policy and AI Acceptable Use Policy

An AI corporate policy should define permitted AI use, the types of data that may be processed, approved tools, user responsibilities, approval processes, and incident reporting requirements. An AI acceptable use policy can serve as one of the instruments for establishing these requirements.

The policy should be connected to data classification, information security, privacy, vendor management, and incident response. A simple rule such as “do not enter confidential information into public AI tools” is not sufficient if the organization does not provide employees with a clear and secure process for using AI.

The Dangers of Shadow AI and Shadow AI Risks in Organizations

The dangers of Shadow AI emerge when employees use AI tools without going through the organization's governance processes. Examples include uploading internal documents to public chatbots, using unapproved AI coding assistants, or connecting company data to third-party AI services without assessment.

Shadow AI risks in organizations include data exposure, privacy risks, intellectual property risks, vendor risks, inaccurate outputs, and limited visibility into how AI is being used. The solution is not simply to prohibit AI. Organizations need approved AI tools, an AI inventory, an acceptable use policy, and mechanisms for registering and assessing AI use cases.

Enterprise AI Data Security and LLM Data Privacy

Enterprise AI data security needs to cover the entire data flow, including prompts, uploaded documents, retrieval systems, training data, knowledge bases, APIs, logs, and telemetry. Application-level access controls alone are insufficient when enterprise data is processed across multiple AI components and third-party services.

The same principle applies to LLM data privacy (large language models). Organizations need to understand what data is sent to a model, how that data is processed, how retention is handled, who can access it, and how the vendor manages the data. These evaluations should be integrated into data governance, privacy, and third-party risk management.

Black-Box AI Security and AI Algorithm Auditing

Black-box AI security becomes more challenging when organizations use third-party models without full access to the model, training data, or the provider's internal processes. This makes vendor assessment and assurance particularly important. Organizations should obtain relevant evidence regarding security, privacy, model governance, testing, documentation, monitoring, and incident management.

AI algorithm auditing does not necessarily mean examining the model's source code. An AI audit can cover governance structures, ownership, data, risk assessment, model documentation, testing, performance monitoring, security, privacy, and compliance. ISACA has identified COBIT as one of the foundations that can support AI governance and management throughout the AI lifecycle.

Integrating COBIT and ISO 42001

Integrating COBIT and ISO 42001 allows organizations to retain their existing enterprise governance structure while adding an AI-specific management system. COBIT can be applied at the enterprise governance and information and technology management level, while ISO/IEC 42001 provides an AIMS structure for systematically managing AI-related risks and opportunities.

ITIL can continue to operate at the service management layer when AI becomes part of a digital product or service. NIST AI RMF can further strengthen the organization's risk management approach. With this structure, AI Governance can be integrated into existing governance processes instead of being established as a completely separate system.

AI Governance Implementation Strategy

An AI Governance implementation strategy can begin with an AI inventory, risk classification, ownership assignment, policy development, and control-gap assessment. The organization can then determine requirements for assessment, approval, testing, monitoring, documentation, vendor management, and incident response based on the risk level of each AI use case.

For organizations that already use COBIT and ITIL, a practical starting point is an AI Governance gap assessment. The organization can map existing controls, identify missing AI-specific controls, and integrate them into its existing governance, risk, security, service management, and compliance processes.

AI Governance, ISO 42001 Training, and Capability Development

Effective AI Governance requires cross-functional expertise. Your teams need the right knowledge to connect AI governance practices with existing IT governance, service management, data governance, security, and compliance requirements. You can strengthen this capability through Strategic Data & AI Governance for Enterprises at Inixindo.

The program is designed to help organizations connect AI Governance practices with COBIT, ITIL, and relevant security and compliance standards. Developing these capabilities can help organizations establish AI governance that is structured, measurable, and aligned with business requirements.

Learn more about the Strategic Data & AI Governance for Enterprises program at Inixindo.