AI agents are reshaping organisations and raising new questions about accountability, governance and digital trust. The ISACA Europe Conference 2026 highlighted the importance of effective oversight and responsible AI adoption to balance innovation, manage risk and maintain stakeholder confidence.
At the recent ‘ISACA Europe Conference’, held in Munich from October 7th to 9th, 2026, more than 50 international speakers discussed the topics of governance, audit, data protection and Digital Trust in over 40 sessions, according to the organisers. Many of the discussions therefore centred on the question of how companies can control autonomous AI agents – and who bears responsibility when these agents make decisions independently.
The keynote speeches by Henry Ajder, Monica Verma and Sarah Furness had, amongst other things, demonstrated how closely technological innovation, leadership and skills development are interlinked. This conference raised the key question for discussion: “How can the growing autonomy of AI agents be reconciled with the requirements for accountability, governance and the necessary skills?”
The real challenge is no longer the introduction of AI, but rather how to control it
AI systems today are no longer merely making recommendations; instead, as so-called agents, they are acting increasingly autonomously: They can prioritise tickets, initiate processes or make operational decisions without direct human intervention.
The risks and responsibilities fundamentally associated with this therefore were a key focus of the ‘ISACA Europe Conference 2026‘. “Over three days, more than 50 international experts discussed with around 500 participants from over 50 countries, in more than 40 sessions, how organisations can strengthen governance, risk management and resilience in an increasingly complex technological and regulatory environment.”
The timing of this debate is no coincidence: With the EU AI Act, NIS2, DORA and the Cyber Resilience Act, a regulatory framework is currently taking shape across Europe to redefine governance, operational resilience and digital trust. At the same time, Artificial Intelligence (AI) is transforming virtually every area of business. It became clear at this conference that the real challenge today is no longer to introduce AI, but to limit its autonomy and ensure that its decisions are transparent.
Ensuring control over the entire AI execution chain
Ben Hanson, an expert in AI agent security at Zenity, distinguished in his presentation between protecting agents and controlling their scope of action. His approach: Permissions must be time-limited, context-dependent and revocable even whilst the agent is executing.
Furthermore, control mechanisms are needed to continuously verify whether individual steps remain consistent with the originally defined objective. Equally important is the control over documents and knowledge sources on the basis of which agents make decisions.
His key message: It is not enough simply to be able to stop an agent. If tasks are delegated to other systems or agents, control must be ensured throughout the entire execution chain.
Effective oversight through existing mechanisms rather than additional parallel structures
The session on the maturity of AI governance also demonstrated that the focus is shifting from theoretical frameworks towards practical implementation. Daniel Manimbo, ‘Head of Artificial Intelligence and ISO’ at Schellman, and Kevin Schawinski, co-founder and CEO of Modulos, distinguished between three levels of governance:
Model, system and organisation. Their presentation focused on the system level – that is, the continuous monitoring of AI systems’ behaviour during operation, the limitation of autonomous decision-making, and the clear allocation of responsibilities along complex chains of agents.
Their conclusion: Standards such as ISO 42001 should not be limited to documentation, but must be reflected in processes that function effectively in the long term. Ideally, they should build on existing control mechanisms rather than creating additional parallel structures.
Trust in AI is based on proof of origin
In his keynote speech, Henry Ajder, an expert in Generative AI and deepfakes and founder of Latent Space Advisory, focused on the topic of trust.
Synthetic content not only facilitates deception but is also increasingly calling into question the authenticity of genuine recordings.
An organisation’s reputation alone is therefore no longer sufficient to ensure the credibility of its communications. Ajder has spoken out in favour of ‘content credentials’ and verifiable proof of origin, even if these cannot dispel all mistrust.
Moving beyond technology to focus on a Culture of Learning – seeing mistakes as valuable learning opportunities
Monica Verma also made it clear that governance encompasses far more than just processes and control mechanisms. In her keynote speech, the cyber security expert and founder of Monica Talks Cyber linked cyber resilience to leadership and talent development. Her key message was that security measures often fail when the people who are later expected to implement and adhere to them are not sufficiently involved.
The conference was brought to a close by Sarah Furness, a leadership expert, former squadron commander in the Royal Air Force and former attack helicopter pilot. According to ISACA, she recommended not viewing uncertainty as an obstacle, but rather making conscious use of the information it contains. Decision-making can be practised, and mistakes are valuable learning opportunities rather than signs of weakness.
Beyond technological developments and regulatory requirements, the conference highlighted just how important human expertise, leadership skills and a sense of responsibility are for building trust in AI.
Objective: Using AI responsibly and to add value
Chris Dimitriadis, Chief Global Strategy Officer of ISACA, made it clear in his keynote address: “Delegating tasks to an AI agent does not automatically mean delegating responsibility! Before organisations grant an agent autonomy, they must know exactly what it is permitted to do, what information it can access, and who can intervene if it deviates from its objective.”
Control must be in place throughout the entire execution chain. Frameworks such as the ‘CMMI AI Maturity Model’ (CMMI AIM) help organisations to assess their level of maturity in dealing with AI, strengthen risk management and promote innovation in a sustainable manner.
In conclusion, he pointed out: “Equally important are specialists with expertise in AI auditing, cyber security, risk and governance management, so that AI can be used responsibly and in a way that adds value!”
Epilogue: Discussion of Digital Trust remains on the agenda
The central question of this conference therefore remains relevant far beyond Munich: “How can the growing autonomy of AI agents be reconciled with the requirements for accountability, governance and the necessary skills?”
This challenge will continue to shape the European Digital Trust Agenda in the future, whilst companies implement the requirements of the EU AI Act, NIS2 and DORA.
For organisations wishing to better understand and address the cybersecurity risks posed by autonomous AI systems, the ISACA white paper ‘Cybersecurity Recommendations for Securing AI Agents’ [https://www.isaca.org/resources/white-papers/2026/cybersecurity-recommendations-for-securing-ai-agents] is designed to provide practical guidance on the secure control and monitoring of AI agents.
Key findings from the DS editorial team
- The challenges facing companies have clearly shifted – away from the introduction of AI agents and towards their control and containment during day-to-day operations.
- It is essential to clarify who bears responsibility for the consequences of AI agents acting of their own accord – it would be unacceptable for companies to reap the benefits of using them, yet be able to ‘shirk responsibility’ in the event of damage.
- For AI agents to be widely accepted in the market and by society, a clear set of rules is required, and trust should be built through best practices.
- Much like a supply and service chain, the use of AI agents involves what are known as execution chains – meaning that overall responsibility must be assumed for them.
- The increasing autonomy of AI agents must be balanced against requirements regarding accountability, governance and the necessary competences.
Conclusion from the DS editorial team
The ‘ISACA Europe Conference 2026‘ demonstrated that the responsible use of AI agents requires effective controls, clear lines of responsibility and transparent decision-making. Only in this way can organisations realise the potential of autonomous AI and build sustainable Digital Trust.
More information
DATENSICHERHEIT.DE, 26.09.2026
KI-Agenten auf Abwegen: OpenAI-Vorfall mit Australiens Medicare-Datenbank
DATENSICHERHEIT.DE, 21.09.2026
Neue KI-Modelle: Forderung des TÜV-Verbands nach unabhängiger Prüfung
DATENSICHERHEIT.DE, 09.09.2026
KI außer Kontrolle: Shadow Agents setzen Führung unter Druck
