Ninety-six percent of CISOs are now responsible for AI governance and risk management, according to Splunk’s 2026 CISO Report. Most did not ask for it. AI arrived in the enterprise the same way shadow IT always has: through side doors, embedded features, and individual employees moving faster than any procurement cycle. The difference is that AI does not just store data or run workflows. Increasingly it takes actions. And once an organisation is running AI that books meetings, sends emails, queries databases, and executes transactions, the question of who governs it becomes a security question by default. The answer, in 2026, is the CISO. This piece is a perspective on what that shift actually demands: not just new tools, but a genuinely different knowledge base, a different relationship with the board, and a willingness to let go of some of the technical identity that many security leaders built their careers on.

The Mandate Nobody Voted For

There was no industry committee that decided CISOs should own AI governance. There was no regulatory requirement that arrived with a clean handover. What happened was more mundane and more consequential: business units started adopting AI tools faster than legal, compliance, or IT could review them, and the risks that emerged, shadow tool adoption, data exfiltration through prompts, agentic systems taking actions without oversight, turned out to be security problems. Compliance teams could write the policies. Only security had the operational muscle to enforce them in production.

Seventy-five percent of CISOs have already discovered unsanctioned generative AI tools running in their environments, according to a 2026 CISO AI Risk Report based on a survey of 235 senior security leaders across large enterprises in the US and UK. Another 16 percent said they were not sure, which in practice means the same thing. The tools did not arrive through a procurement process. Someone connected a copilot in a SaaS tool, an engineering team tested an agent, a business unit installed an assistant without waiting for approval. None of those individual decisions felt significant. Collectively they created AI systems acting on behalf of employees, without the governance structures that apply to human access.

The 2026 DTEX/Ponemon Insider Threat Report quantified the cost of that gap: 92 percent of organisations report that generative AI has changed how employees share information, but only 13 percent have integrated AI into their security strategy. Shadow AI is now the top driver of negligent insider incidents, at an average annual cost of $19.5 million per organisation.

The CISO AI governance role now requires owning both the technical enforcement layer and the cross-functional accountability structure. That is a different job than it was two years ago. (Source: CloudEagle AI Governance Trends Report, June 2026)

What the Knowledge Gap Actually Looks Like

The SANS/GIAC 2026 Cybersecurity Workforce Research Report, which surveyed 947 security leaders globally, found that 60 percent of CISOs now cite the cybersecurity skills gap as their primary workforce concern, overtaking headcount shortfalls for the first time. The report identifies AI as the primary driver: rapid enterprise AI deployment has exposed gaps in what existing security teams know how to secure. Baseline AI security literacy is now described as a floor-level expectation for any security team, covering what models can be manipulated into doing and what the pipeline attack surface looks like.

CSO Online’s January 2026 analysis of CISO skills describes the knowledge gap at the individual level. The mistake security leaders make is assuming they already know enough about AI to make informed decisions when the field is evolving too quickly for static knowledge to suffice. The gap is not between CISOs who know AI and those who do not. It is between CISOs whose AI knowledge is current and those whose AI knowledge stopped updating when the hype cycle peaked in 2023.

What does updated knowledge actually require? The Airia analysis of CISO AI governance responsibilities describes three layers. The first is visibility: a complete, continuously updated inventory of every AI tool, model, agent, and integration running across the environment. Not a quarterly audit. Not an annual review. A live picture, because AI deployments change weekly as vendors add capabilities, employees discover new tools, and business units adopt new solutions. The second is enforcement at the agent execution layer, not just the prompt or output layer. The first generation of enterprise AI security tools addressed what the AI said. The more urgent problem in 2026 is what the AI does. The third is continuous compliance infrastructure: the ability to demonstrate, on demand, that the AI programme operates within a defined policy framework with documented evidence of controls. Most organisations are still generating this documentation manually.

The Board Conversation Nobody Is Having Well

Eighty-five percent of CISOs cite low cybersecurity fluency among non-technical executives as an obstacle to collaboration, according to Splunk’s 2026 CISO Report. That number has not changed meaningfully in years. What has changed is the cost of the gap. When the board does not understand AI risk, the CISO faces pressure from two directions simultaneously: some board members are mandating AI adoption as a strategic priority, others are slowing everything down with governance and compliance processes, and the CISO is caught between them without a common language that works for either conversation.

Darren Argyle, co-founder of Cyber Resilience and former group chief information security risk officer at Standard Chartered Bank, described the required shift to CSO Online in January 2026: ‘In 2026, the CISO who thrives will look much more like a business value and resilience executive than a technical gatekeeper.’ The ability to translate complex risk into financial, operational, and reputational terms is not a soft skill. It is the primary instrument through which a CISO obtains funding, shapes adoption decisions, and maintains relevance at the table where those decisions are made.

The AI governance resource hub published by Dr. Erdal Ozkaya proposes five questions every board should be asking its CISO. The first: what AI systems are in use across the enterprise, and who approved them? The honest answer in most enterprises today is ‘we do not fully know.’ The second: what is the exposure if an AI system makes a materially wrong decision? The third: how are we complying with applicable regulations? The fourth: how would we know if our AI was being manipulated, and how fast could we respond? The fifth: what is the incident response plan when an AI-driven decision causes customer harm? These are not technology questions. They are governance questions, and the CISO who cannot answer them fluently in board language is not equipped for the role as it now exists.

78% of CISOs said they are concerned about their own personal liability for security incidents, up from 56% the previous year. That shift is influencing how security leaders approach risk, documentation, and board communication. (Source: Splunk 2026 CISO Report)

The Old Model vs the New Mandate

The piece written by a recovering CISO for Torq in April 2026 is worth reading in full, but its sharpest observation can be stated simply. Previous technology waves in security, from on-premise to cloud, from SaaS to zero trust, each changed how CISOs worked. The AI wave is different in kind, not just degree. AI builds things. It takes actions. It compresses the gap between strategic intent and operational reality that previously required months of planning and armies of skilled staff to close.

Under the old model, a CISO would define a risk reduction strategy and execute it over a two or three-year change programme. Under the emerging model, agentic AI allows a CISO to articulate intent in natural language and have autonomous systems build, deploy, and iterate the operational response in days or hours. What once required large teams with specific skills now requires smaller teams with different skills: the ability to define outcomes, validate AI behaviour, govern machine-speed access, and iterate rapidly against a threat environment that is also using the same tools.

The Renascent Solutions analysis of the changing CISO scope, published in June 2026, identifies a parallel shift in what the role requires at the hiring level. Candidates with demonstrated experience developing and implementing AI governance frameworks are described as exceptionally valuable in 2026. The ability to communicate complex risk in plain language, which used to be noted as a differentiating quality, is now described as a threshold requirement. Candidates who cannot make that translation convincingly will struggle to gain the organisational influence the role requires.

The Regulatory Clock Is Running

The knowledge gap has a deadline. The EU AI Act’s high-risk provisions took effect in August 2026, requiring conformity assessments and documentation, with fines reaching 35 million euros or 7 percent of global turnover for non-compliance. Nineteen US states now have comprehensive privacy laws in effect that impose obligations around data minimisation, purpose limitation, and automated decision-making that AI agents directly implicate. The 2026 Thales Data Threat Report found that rapid change in the AI ecosystem is the single most concerning AI-related risk, cited by 70 percent of respondents, precisely because it is difficult to design durable control frameworks when the regulatory landscape shifts quarterly.

The Sonatype AI governance analysis published in May 2026 identifies the specific obligation for CISOs in regulated industries: the ability to demonstrate, on demand, that the AI programme operates within a defined policy framework with documented evidence of controls. Compliance teams write the policies. CISOs make sure they actually hold in production. That distinction, between having a policy and enforcing it operationally, is where most organisations currently fail. The Kiteworks 2026 analysis found that 63 percent of organisations cannot enforce purpose limitations on their AI systems, and 60 percent cannot terminate a misbehaving agent. Policies exist. Technical controls do not.

What the Shift Demands in Practice

The table below maps the old knowledge requirements against what the role now demands. It is not an exhaustive list and it is not a certification roadmap. It is a calibration tool for security leaders to assess where the most significant gaps are in their current knowledge base.

Domain	What Was Sufficient Before	What the Role Requires Now
AI threat knowledge	Understanding phishing, social engineering, malware at a conceptual level	Understanding AI-generated attack vectors: deepfakes, prompt injection, model poisoning, supply chain attacks on AI pipelines
AI governance	Delegating AI risk to compliance or legal teams	Owning the technical enforcement layer: shadow AI inventory, agent access controls, real-time policy enforcement, regulatory documentation
Identity and access	Managing human user identities through IAM frameworks	Extending IAM to non-human AI identities: agents, models, and automated systems with delegated permissions and autonomous behaviour
Board communication	Translating technical risk into operational language for the IT or risk committee	Translating AI governance risk into financial, reputational, and regulatory terms for board members who are simultaneously being pressured to adopt AI faster
Regulatory fluency	GDPR, HIPAA, ISO 27001, sector-specific requirements	EU AI Act, NIST AI RMF, ISO/IEC 42001, state-level AI laws, and the interaction between AI regulations and existing data protection obligations
Programme velocity	Two to three-year strategic change programmes with phased delivery	Short iterative sprints, outcome-based delivery, continuous reassessment as threat and regulatory environment changes quarterly

Table 1: CISO knowledge requirements before and after the AI governance mandate. Sources: CSO Online (January 2026), Torq (April 2026), Renascent Solutions (June 2026), Airia (June 2026), Sonatype (May 2026), Intezer (December 2025).

The Uncomfortable Question

There is a version of the CISO role that is purely defensive: protect the perimeter, manage incidents, report upward. That version of the role is not adequate for 2026. The Splunk report is direct about what happens when the CISO is excluded from AI adoption decisions: the business will implement AI with or without the CISO’s involvement. The risk of being left out of the conversation is larger than the risk of being in it.

But being in the conversation requires something that does not show up in most CISO job descriptions: the willingness to stop being the detractor and become, as CSO Online describes it, the saner voice in the room. Understanding where AI systems excel and where they fall short. Guiding adoption rather than resisting it. Accepting that AI governance is now core to the role, not adjacent to it, and that the knowledge required to do it well is different from the knowledge that built most security careers.

The uncomfortable question is not whether CISOs need to understand AI. Most would agree they do. The uncomfortable question is whether they are currently updating that understanding at the speed the field is moving, or whether their AI knowledge stopped being current sometime in 2023 and has been coasting on reputation since. The SANS/GIAC report’s framing is precise: the profession’s core competency model is changing faster than the pipeline that feeds it. That is true at the individual level too.