For the first time since COBIT 2019 was released in late 2018, ISACA is updating its framework for the governance and management of enterprise information and technology. COBIT 7 launches on 19 November 2026, almost exactly thirty years after the first version of COBIT appeared in 1996.
If your organisation already uses COBIT, or you have been meaning to look at it, this is a good moment to understand what is changing. The short answer: COBIT 7 builds directly on COBIT 2019 rather than replacing it, but it changes how the framework is delivered and adds guidance in areas that have moved fast in the last few years, especially artificial intelligence.
COBIT in a nutshell
COBIT helps organisations make sure technology supports their goals, manages risk sensibly and delivers value for money. Its central idea is the difference between governance and management. Governance, led by the board, evaluates options, sets direction and monitors results. Management plans, builds, runs and monitors the work that follows that direction.
COBIT 2019 organised this into 40 governance and management objectives, supported by design factors that help tailor a governance system to each organisation. If you are new to the framework, our plain-English guide to COBIT covers the basics.
What changes in COBIT 7
Based on what ISACA and its accredited training partners have published ahead of launch, five changes stand out.
A digital-first framework
COBIT has traditionally been consumed as a set of PDF books. COBIT 7 moves onto a digital platform, with search across the framework, mobile access and mappings to other standards available as you browse. The core publications are being refreshed alongside it: the introduction and methodology, the governance and management objectives, the design guide and the implementation guide.
In practice this should make COBIT easier to use day to day. Instead of searching through several hundred pages, teams can go straight to an objective, see how it relates to other frameworks and pull out what they need.
Stronger guidance on AI
Many organisations are adopting AI faster than their governance can keep up. COBIT 7 responds with more AI examples, AI-related risk scenarios and guidance on enabling AI delivery safely. It also connects with ISACA’s Digital Trust Ecosystem Framework, so organisations can treat AI as part of their wider approach to trust, rather than as a separate problem.
Two new design factors
Design factors are the conditions that shape how a governance system should look, such as strategy, risk profile and size. COBIT 7 adds two: the health of the organisation itself, and its information and data strategy. Both reflect lessons from recent years. A governance design that ignores how stretched or stable the organisation is, or how it uses data, will struggle in practice.
Assessments at three levels
COBIT 7 introduces a more practical approach to assessment, with three levels aimed at different audiences: the board, the executive team, and the people who run IT governance day to day, such as CIOs, IT auditors and governance teams. Toolkits support each level. This makes it easier to start with a light, board-level view and go deeper only where it matters.
More practical implementation guidance
The design workflow has been simplified to three steps, activities are described for each capability level, and organisational structures are shown by role rather than by task. Together these should make the step from reading COBIT to applying it shorter.
What stays the same
COBIT 7 is an evolution, not a reinvention. The governance and management distinction, the idea of a tailored governance system built from several components, and the use of goals, objectives and capability levels all carry forward from COBIT 2019.
That matters if you have already invested in COBIT. Your existing governance design, process assessments and roadmaps remain useful. The sensible approach is to refresh them against COBIT 7, particularly the new design factors and AI guidance, rather than start again.
Certificates and key dates
- 19 November 2026: COBIT 7 and the new COBIT 7 Foundation certificate launch. The Foundation certificate replaces COBIT 2019 Foundation.
- 30 June 2027: last day to buy a COBIT 2019 Foundation or Design & Implementation exam.
- 31 December 2027: last day to sit a COBIT 2019 exam, with no extensions. COBIT 2019 itself sunsets on the same date.
- 2027: a COBIT 7 Design & Implementation certificate is planned, with the date to be confirmed.
If you already hold a COBIT 2019 certificate, you keep it. ISACA had originally announced a launch date in October 2026 and later moved it, so it is worth checking ISACA’s website for the latest details before booking an exam.
What to do now
There is no need to pause governance work while COBIT 7 beds in. A few practical steps will help you make the most of it:
- Take stock of what you have. Gather your current governance design, assessments and improvement roadmap, even if they are informal.
- Revisit your design factors. Pay particular attention to organisational health and your information and data strategy, and check whether they change your priorities.
- Look honestly at AI. List where AI is already being used, including tools people have adopted on their own, and check who owns the risks.
- Start with a light assessment. A board-level view is often enough to show where deeper work is needed.
- Plan training sensibly. People who need a certificate soon can still take COBIT 2019 Foundation until the end of 2027. Everyone else may prefer to go straight to COBIT 7.
Above all, keep COBIT proportionate. As we wrote in our article on using COBIT without adding bureaucracy, the aim is better decisions, not more paperwork. COBIT 7’s digital tools and tiered assessments should make that easier, not harder.
Want to see what COBIT 7 means for your organisation?
We help organisations review their IT governance using COBIT, at a scale that fits. Book a free scoping call to talk it through.
