As an organization, ISACA is well-versed in and has a long history of helping its members stay up to date with the latest developments in IT security, governance, and risk.

But the pace of change, particularly in the AI era, can be unrelenting. Indeed, at this year’s ISACA Europe conference held earlier this month in Munich, Germany, there was a clear sense that changes in the technology landscape are putting more pressure on the association’s membership to stay current.

ISACA oversees a range of professional certifications, including CISA and CISM, and attending conference sessions helps attendees earn CPE credits that go towards maintaining these certifications. Sessions covered at this year’s ISACA Europe Conference 2026 covered everything ranging from cross-border data privacy, operational technology and proving security ROI, to supply chain resilience, ransomware prevention and digital sovereignty. While the topics were varied, they shared a common theme. Indeed, across almost all of them, the looming specter of AI was a constant presence.

Professionals in the field are concerned about how this technology will impact their day-to-day responsibilities, and ISACA is having to adapt its own processes in order to support them. As well as speeding up the pace at which it updates its certifications and training, the association has put forward several amendments to its bylaws, including lowering the quorum for member votes, moving its legal home to Washington, DC, and moving to staggered three-year board terms.

Responding to changing member needs

Speaking at the opening session in Munich, ISACA board chair Massimo Migliuolo said the proposals give ISACA “the governance agility to respond faster to the needs of members wherever they are in the world”.

That speed is more in demand than ever. AI is impacting the industry so dramatically that not only is it difficult for professionals to keep their skills current, but it’s also reshaping roles faster than they can be defined. On top of that, it’s resulting in regulatory scrambles as authorities scramble to catch up.

The shift is most evident in how often IT professionals are now feeling the need to update their credentials, according to ISACA CEO Erik Prusch.

“[Previously] you got certified, and maybe five years later or six years later, you might be getting your second certification as you’re escalating through an organization,” he says.

“Now it’s much more current, and everybody’s having to stay not only trained and keep their current certifications up to date, but also bring in new technology.”

AI was inescapable across the conference. Although plenty of sessions on the agenda focused on practical, iterative work – including previews of ISACA’s updated COBIT governance framework, GRC automation, NIS2 and DORA – nearly half of the agenda touched on AI in some capacity, including keynote sessions on the first two days.

As one might expect from an audience of security and risk professionals, the response to AI wasn’t entirely enthusiastic, but fears around losing their jobs to AI have largely waned.

“Even 18 months ago, there was that threat of ‘AI is going to eliminate all roles’,” says Tara Wisniewski, senior vice president of advocacy at ISACA.

“I think we’re all kind of moving away from that, but it is going to significantly change roles.”

AI through a security lens

Instead, practitioners appear to have transitioned to more immediate practical concerns, including how the rollout of these systems is affecting their security, risk, and governance posture. In her keynote, cybersecurity advisor and former CISO Monica Verma took aim at the more apocalyptic predictions about AI, calling that narrative “extremely dangerous”.

“It takes away from the actual real AI and cybersecurity risks that we do have today,” she says.

“[The ones] that are already present, that are already imminent, that you and your organizations need to be thinking about right now. There is no time to waste.”

ISACA is tapping into this need for clarity with three dedicated AI credentials (with a fourth in development), as well as integrating AI aspects into CISA and CISM. Prusch says demand is partly being driven by AI work landing on existing roles, with established professionals increasingly asked to pick up elements of AI management on an ad-hoc basis. An IT audit manager, for example, might become an IT and AI audit manager.

“I think everybody within our domains, their roles have changed to some degree,” he says.

“It just hasn’t been structured or formalized as yet. They’ve just taken on more responsibility, and there’s no other place for them to go.”

However, while ISACA members aren’t worried about the immediate future of their own roles, AI has affected some jobs. In particular, AI has been blamed for a reduction in available junior and entry-level roles, and senior practitioners are concerned that this will exacerbate the industry’s existing pipeline problems. As Migliuolo noted during the event’s opening address, ENISA estimates that more than 300,000 cybersecurity positions are unfilled across the EU.

“What the hell is a 23-year-old [to do]? How are they going to get that experience?” says Wisniewski. “I fear that the gap is going to get a little bit bigger, to be honest… We’ll even see things like, ‘it’s an entry-level position, but three years’ work experience is required’. That’s a mismatch.”

A multi-pronged approach

ISACA is trying to tackle the problem from both ends. Prusch says it now tracks new roles as they emerge, to shrink the lag before training for them exists, and on the policy side, Wisniewski says workforce development is “the drum we beat every day”.

In the UK, the organization has proposed amendments to the Cyber Security and Resilience Bill to clarify its skills requirements, and more broadly it presses policymakers to consider the talent pipeline whenever they regulate, since meeting any new rules requires “a qualified workforce”.

Even the lawmakers are struggling to stay ahead of the changes, Wisniewski adds, explaining that “there are very few policymakers that actually have any technical depth”. The EU’s AI Act is among the most comprehensive AI laws in the world, but the bloc is already discussing revisions because, she says, the technology hasn’t developed the way Brussels expected, and other countries are even further behind in their journey towards AI regulation.

Meanwhile, as governments continue to argue over the best way to design and implement AI safeguards, organizations are already struggling to comply with existing rules.

“European organizations are navigating an increasingly complex regulatory and threat environment,” Migliuolo noted.

“…Through the EU AI Act and NIS2, DORA, CRA and other emerging regulations, I think Europe is setting a very good standard… The challenge in this transition is how we are going to do the implementation.”

That transition is proving slow. Despite the deadlines for NIS2 and DORA compliance having passed well over a year ago, conference delegates were still attending sessions framed around working out how to demonstrate compliance. While large multinationals with deep budgets are ahead of this curve, it’s a different story further down the market, according to Wisniewski.

“It’s still early days, especially for smaller organizations, because that’s where you see stress in the system,” she says, adding that compliance costs can squeeze other budgets.

“When the compliance burden gets too intense, the budget has to come from somewhere… Is it taking away from a training budget?”

With legislation struggling to keep up, Wisniewski believes professional bodies may end up filling part of the gap themselves, acting as de facto regulators by establishing industry-wide standards. That’s one of the reasons ISACA is investing in a more substantial advocacy program, she says; the association also wants a seat at the table in emerging debates, such as whether cybersecurity should become a licensed profession.

None of this is new territory for ISACA, though; helping professionals make sense of unfamiliar technology and shifting rules is what the association was set up to do. The difference now is how little time there is to do it. By the time one change has been absorbed, the next is already on the horizon – such as quantum, which Wisniewski expects to feature alongside AI at next year’s event.

That’s what makes the bylaw vote more significant than its modest contents might suggest. Whether it’s through its training, its advocacy, or the standards it sets, ISACA’s influence depends on keeping pace with the profession it serves. To shoulder those responsibilities, the association needs to be able to move at the same speed as the technology it hopes to help govern.

“This is not your typical kind of acceleration path [for] adoption of new technology,” Prusch says, emphasizing that the industry as a whole has a difficult task ahead of it.

“We’re not talking about two decades ago, when we had maybe 10 years to develop the infrastructure. We are already behind.”

“The reality is,” he says, “we’ve got to do this faster.”