How CISOs Can Drive Effective AI Governance

AI governance must be a living system that guides daily use, not a rigid set of restrictions, says The Hacker News in its exploration of CISOs steering AI in enterprise settings. Since ChatGPT arrived in November 2022, many CISOs published strict policies, but real-world governance requires a forward, ground-level view of how AI is used, where it sits in SaaS, and how staff interact with it.

Practical mechanisms such as an AI Bill of Materials (AIBOM), model registries, and cross-functional AI committees help translate governance into actionable, shared responsibility rather than a security silo, according to SANS Institute. Policies should align with the organisation’s speed and risk tolerance, evolving with leadership changes and embedded AI features to avoid shadow AI vulnerabilities and bans that never fully take effect.

The article also highlights three core components to scale safe adoption, and notes that SANS CDI 2025 in Washington, DC will cover building business-driven security programmes that embed governance into culture. note: This article was contributed by Frank Kim, SANS Institute Fellow.