AI governance and ethics need operating models, not principles

At a glance

What this is: This is a Collibra blog post arguing that AI governance and ethics only work when they are embedded as an operating model across intake, development, deployment and monitoring.

Why it matters: It matters because IAM, NHI and AI governance teams increasingly need auditable decision workflows, not policy language, to prove accountability, oversight and control.

Context

AI governance and ethics is the operating layer that decides whether an AI use case is reviewed, approved, monitored and explained over time. The problem is not a shortage of principles, but the gap between stated commitment and the workflow that actually governs AI decisions.

In practice, that gap shows up when organisations cannot say who reviews use cases, which risks trigger escalation, how high-stakes systems are approved, or what evidence proves monitoring is happening. For AI programmes, that is the difference between a board-ready promise and a defensible control environment.

Key questions

Q: What breaks when AI governance is designed only for model outputs?

A: Governance breaks when it assumes the AI system only produces text or recommendations for humans to review. Agentic systems can take actions, use tools, and affect live environments directly, so policies built for output review miss the moment where risk becomes operational. The control problem shifts from content oversight to runtime authority, delegation, and action containment.

Q: When should organisations prioritise AI ethics review in the lifecycle?

A: Prioritise ethics review at ideation and again before deployment, not only after a model is live. Early review is where you can still change the use case, data choices and risk tier. Once the workflow depends on the output, reversal becomes expensive and the governance leverage drops sharply.

Q: What signals show that an AI governance programme is not working?

A: Warning signs include disconnected models built by different teams, repeated disputes over data ownership, inconsistent approvals and outputs that cannot be explained to stakeholders. If the organisation cannot trace which data supported a decision or who approved the model, governance is already failing at the operating level.

Q: Should organisations treat embedded AI and homegrown AI the same way?

A: No. Embedded AI often inherits risk from SaaS defaults, while homegrown AI introduces custom retrieval paths and local accountability gaps. Both need governance, but the control points differ. Teams should standardise the review model while still tracking the specific identity and data path for each class.

Technical breakdown

Why principles fail without an AI operating model

AI ethics written as a policy statement does not control anything by itself. An operating model is the set of intake steps, review paths, approvals, evidence records and monitoring hooks that make the policy real. Without that structure, governance becomes a narrative exercise, often disconnected from the data, models, workflows and owners that determine actual behaviour. The article’s core point is that responsible AI only becomes enforceable when those decisions are built into the lifecycle, not added after deployment.

Practical implication: map AI policy to a live intake and approval workflow before you expand use cases.

How lifecycle governance changes risk management

Ethics review is most effective at ideation, development and ongoing operation, because those are the points where scope, data choices and monitoring expectations can still change. Once a model is embedded in production workflows, the business cost of reversal rises sharply and ethical review becomes an exception-handling exercise. That is why lifecycle governance matters: it links risk classification, human review, data lineage and monitoring into one traceable chain rather than treating launch as the end of control.

Practical implication: place ethical review gates before build decisions and keep them active after release.

What connected evidence means for AI accountability

Accountability workflows only work when the organisation can connect a use case to its data sources, policy obligations, model artefacts and named reviewers. That traceability is what turns a governance claim into evidence. In this model, automated routing is useful, but only if every review leaves a record of who approved what, on what basis, and with which follow-up monitoring obligations. Without that record, organisations cannot prove that governance actually happened.

Practical implication: require lineage and decision records for every high-risk AI use case.

NHI Mgmt Group analysis

AI governance and ethics only matter when they are operationalised as a control system. A principles-only programme creates the appearance of oversight without the mechanism to enforce it. The article is right to frame governance as the operating model, because regulators and boards do not assess intent, they assess evidence.

Lifecycle timing is the decisive control point for responsible AI. Ethics review after deployment is structurally weaker because data, workflow dependence and business pressure are already in place. That means the real governance question is not whether review exists, but whether it happens early enough to change the use case before sunk cost hardens.

Traceability is the named concept that separates AI governance theatre from accountable practice. If a team cannot connect a use case to its data, policy, model artefacts and reviewers, it cannot prove that oversight occurred. The practitioner takeaway is that accountability without lineage is not accountability at all.

Shadow AI turns AI governance into an identity and access problem as much as a policy problem. Unreviewed AI inside vendor products or unsanctioned workflows creates unseen decision surfaces and unclear ownership. The field should treat discovery, ownership and review routing as core governance controls, not administrative extras.

AI governance is converging with compliance because evidence has become the product of governance. The strongest programmes are the ones that can show what was approved, by whom, on what basis and with what monitoring afterward. Practitioners should expect governance platforms to be judged by their ability to produce auditable records, not just policy templates.

From our research library:

• 13% of organisations suffered breaches of their AI models, according to IBM's Cost of a Data Breach 2025 report.
• Read next: Agentic AI Identity Risk Board Briefing

What this signals

Traceability is becoming the practical test of AI governance maturity. Teams that cannot connect a use case to its data, policy, model artefacts and reviewers will struggle to prove oversight when the business or regulator asks for evidence. The programme question is no longer whether governance exists, but whether it can survive an audit trail.

Shadow AI widens the governance perimeter beyond models your team explicitly approved. Embedded AI in vendor platforms and unsanctioned business tools creates decision surfaces that bypass normal intake and review. Practitioners should expect inventory work to become a standing control, not a one-time discovery exercise.

For practitioners

• Define an AI intake workflow Require every new AI use case to capture purpose, data sources, affected populations, owners and risk tier before build work starts.
• Tie review gates to lifecycle stages Place ethics, legal, privacy and security review checkpoints at ideation, development and pre-deployment, then keep them active in production.
• Build a complete AI inventory Include first-party models, embedded vendor AI, externally hosted agents and any shadow AI discovered in business teams.
• Make traceability mandatory Link each approved use case to its datasets, policies, model artefacts and named reviewers so decisions can be evidenced later.
• Operationalise continuous monitoring Track drift, fairness, policy adherence and incident handling after launch so governance remains active when business usage changes.

Key takeaways

• AI governance fails when ethics remains a statement of intent instead of a live operating model with intake, review and evidence.
• The article’s central warning is that post-deployment ethics checks arrive too late, after data, workflow dependence and business pressure have hardened.
• Practitioners need an inventory, lifecycle checkpoints and continuous monitoring if they want responsible AI to be defensible in practice.

Key terms

• AI Operating Model: The structured set of roles, workflows, approvals, evidence records and monitoring steps that turns AI policy into enforceable practice. In mature programmes, the operating model is what connects governance intent to the actual use case lifecycle, so decisions can be reviewed, audited and improved over time.
• Responsible AI: Responsible AI is a governance approach that requires transparency, accountability, privacy protection, and human oversight when AI influences decisions. In authentication workflows, it means organisations must be able to explain how AI affects access outcomes and who can review or override those outcomes.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.