Before any strategic direction can be set for AI initiatives,assessing the current AI capabilities and infrastructureis essential. This foundational step provides a baseline of where the organization currently stands, what assets or skills it possesses, and what gaps may exist.
Subsequent actions, such as developing use cases, forming teams, or crafting policies, rely heavily on this understanding. Without a proper assessment, strategic decisions may be misaligned with the organization's actual readiness or capabilities.
Reference:
CGEIT Review Manual: Domain 2 - IT Resources and Strategic Alignment: "Assessment of current-state capabilities is a prerequisite for any IT strategic development effort." COBIT 2019 Design Guide: "Define and analyze the current state before building the target state roadmap."

One of the challenges of IT governance is to balance the competing demands of maintaining the existing IT systems and services (steady state) and investing in new technologies and capabilities (modernization and enhancements) that can support the business objectives and strategies1. A common strategy to invest in modern technology is to create a new investment category for innovation that becomes a new way for tracking investment decisions2. This category can be used to allocate funds for exploring and experimenting with emerging technologies that have the potential to create value for the enterprise, such as artificial intelligence, blockchain, internet of things, mobility, and drones3. By creating a separate category for innovation, the IT steering committee can ensure that the enterprise does not fall behind in adopting new technologies, and that the IT portfolio is aligned with the changing business needs and opportunities4. References :=
* The CFO and IT: Technology investment strategies | Deloitte Insights
* Global Technology Governance Report 2021 | World Economic Forum
* What is IT Governance and Why Your Organization Needs It Today
* How CIOs Can Get IT Governance Right in an Agile World | ICF

Developing an IT risk management framework begins with aligning it to the enterprise risk management (ERM) framework. This ensures consistency across all organizational risk domains and supports the integration of IT risk into the broader enterprise risk strategy. The ERM provides a foundation for identifying, assessing, and managing IT risks in a way that aligns with the organization's overall objectives. Promoting a culture of risk awareness, while critical, is a subsequent step once the framework is defined. References:
COBIT 2019 Risk Management Process, CGEIT Exam Manual.