COSO Roadmap for Effective Internal Control Over GenAI

This document is a guide detailing the COSO roadmap titled 'Achieving Effective Internal Control Over Generative AI (GenAI)', released on February 23, 2026. It aims to assist entities in applying the 2013 COSO framework specifically to the context of Generative AI. The roadmap outlines tailored considerations and a capability-based approach, providing GenAI-specific practices for each of the 17 principles in the COSO 2013 Internal Control – Integrated Framework. It organizes GenAI use into eight distinct capabilities, presenting illustrative focus areas and examples across the five COSO components. The document clarifies how the roadmap fits within existing internal control frameworks and regulatory expectations, distinguishing it from formal control frameworks. It also emphasizes the importance of understanding all AI capabilities in use and evaluating risks and controls end-to-end, ensuring that control design aligns with the nature of identified risks. Overall, the roadmap serves as a practical guide for implementing effective internal controls in the context of Generative AI.