ISACA Manila: Turning AI Adoption Into a Governance Conversation

Manila, Philippines -- Artificial intelligence is moving rapidly into Philippine businesses, but the conversation around AI is beginning to change. Instead of asking only what AI can do, technology professionals are increasingly asking who should control it, how risks should be measured and what happens when an AI system makes a mistake.

The ISACA Manila Chapter is helping move that conversation toward governance, cybersecurity, risk and accountability.

Its 2026 calendar includes programs covering AI fundamentals, cloud security, IT risk, information security, data privacy and AI governance. The chapter has also scheduled training on the EU AI Act and the NIST AI Risk Management Framework, linking global regulatory developments with practical organizational risk management.

The NIST-focused program is particularly relevant because the framework gives organizations a structured way to think about AI risk through four functions: Govern, Map, Measure and Manage. It also addresses characteristics of trustworthy AI such as security, transparency, fairness, reliability and accountability.

ISACA Manila's September activities also included sessions specifically focused on AI governance. Its September 16 Lunch & Learn, for example, examined the AI governance gap and securing access before AI scales, followed by courses on AI fundamentals and ISO/IEC 42001 AI management systems.

That direction reflects an important development in the Philippine technology industry.

Many organizations began their AI journeys by experimenting with generative AI tools. Employees started using chatbots to summarize documents, create presentations, analyze information or assist with coding.

The next question is more complicated: What happens when AI becomes part of an organization's actual decision-making process?

Organizations need to consider who can access AI systems, what information employees can enter, how models are evaluated, how decisions are reviewed and how incidents are handled.

Cybersecurity also becomes part of the discussion. ISACA's AI security training materials identify issues such as prompt injection, model poisoning, AI-specific incident response and vulnerabilities throughout the AI lifecycle.

This makes professional communities such as ISACA important to the Philippine ecosystem. They provide a space where technology professionals can translate international frameworks into organizational practices.

The support structure here is different from a developer community. Rather than focusing primarily on building applications, ISACA's role centers on professional education, standards, risk management and certification.

That can influence organizations ranging from financial institutions to enterprises and government agencies because the people attending these programs are often responsible for security, audit, governance and technology decisions.

As AI becomes more deeply embedded in Philippine businesses, technical capability alone will not be enough. Organizations will also need people who understand how to manage AI responsibly.

ISACA Manila's 2026 program reflects that transition: AI is no longer being treated solely as a technology topic. It is increasingly becoming a governance, security, risk and accountability issue.