AI governance gaps widen as adoption outpaces controls

At a glance

What this is: This is an enterprise AI governance and risk resilience report that argues governance is lagging adoption, with access control, policy, and regulatory gaps already visible.

Why it matters: It matters because IAM, GRC, and AI security teams need visibility, accountability, and control mapping before AI use cases expand into regulated or high-impact workflows.

By the numbers:

• 97% of organisations that experienced an AI-related security event lacked proper access controls, according to Kovrr.
• 63% of the 600 companies surveyed said they had no AI governance policies whatsoever, according to Kovrr.

Context

AI governance is the control layer that determines how organisations approve, monitor, and restrict AI use across the lifecycle. In this report, the core problem is not AI capability itself but the gap between deployment speed and the visibility, accountability, and access controls needed to govern it.

That gap matters because AI systems increasingly sit inside workflows that touch sensitive data, decision-making, and customer-facing processes. Where organisations cannot inventory AI use, define policy, and tie controls to risk type, they also struggle to apply IAM, data protection, and regulatory obligations consistently.

Key questions

Q: What should organisations do when AI adoption outpaces governance?

A: Slow the rollout of new use cases until the identity model is clear, the permissions are bounded, and the lifecycle process is in place. Security leaders should fund AI only where it supports existing cybersecurity objectives and where access can be monitored, rotated, and removed on time.

Q: Why do AI-related incidents often expose access-control weaknesses?

A: Because many AI failures are not model-only problems. They occur when systems can reach data, tools, or workflows that were never tightly scoped for the use case. If access is broad or unreviewed, AI can amplify the impact of an ordinary entitlement mistake into a privacy, compliance, or operational event.

Q: What are the signs that AI governance controls are not keeping pace with adoption?

A: Common warning signs include unclear ownership for AI use cases, inconsistent approval processes, limited visibility into where sensitive data enters models, and weak evidence for audits or assessments. Teams also struggle when privacy, security, and legal review happen late or manually, because that usually means governance is reactive rather than embedded in the AI delivery process.

Q: What should boards expect from quantified AI risk reporting?

A: Boards should expect AI risk to be expressed in business terms such as loss exposure, disruption, and control maturity rather than only technical findings. Quantification helps leaders prioritise funding, set risk appetite, and explain why certain AI use cases require tighter oversight than others.

Technical breakdown

Why AI governance breaks when adoption accelerates

AI governance fails when organisations treat AI as a feature rollout rather than a managed system. GenAI can be embedded in public applications, internal copilots, and automation flows faster than traditional control processes can classify risk, assign ownership, and define approval paths. The result is fragmented oversight, where business teams deploy models or tools before security, privacy, and compliance teams have mapped data access, usage scope, and review obligations. That creates a control gap not because the AI is inherently uncontrollable, but because governance decisions arrive after operational use has already begun.

Practical implication: Map AI use cases to named owners, approval gates, and review cycles before deployment expands beyond pilot scope.

How access control and data governance intersect in AI risk

AI risk is not only a model problem. The article makes clear that many failures arise when systems ingest sensitive or poorly governed data, or when access to AI tools is too broad for the data they can reach. That puts identity and entitlement control at the centre of AI governance, especially for workflows that expose internal knowledge, personal data, or operational records. In practice, AI governance has to cover who can invoke a model, what data it can reach, and whether those permissions are reviewable at the right lifecycle point.

Practical implication: Tie AI approvals to data-classification and entitlement rules so access scope matches the sensitivity of the workflow.

Why AI risk quantification changes board-level decision making

Quantification turns AI risk from an abstract governance concern into a business decision with modeled loss, control maturity, and prioritisation consequences. That matters because many organisations can describe AI risks qualitatively but cannot compare them against other enterprise exposures or investment choices. When risk is expressed in operational and financial terms, leaders can set appetite, assign funding, and demonstrate accountability to regulators and stakeholders. This does not eliminate uncertainty, but it makes the trade-offs visible enough for governance to function as a planning discipline rather than a compliance afterthought.

Practical implication: Use quantified AI scenarios to rank controls, justify investment, and support board reporting on residual exposure.

Threat narrative

Attacker objective: The likely objective is to exploit weak AI governance and access controls to manipulate outputs, reach sensitive data, or trigger downstream business and compliance harm.

1. Entry occurs when AI is introduced into enterprise workflows faster than governance processes can classify or constrain its use.
2. Escalation follows when poorly controlled access and unreviewed data sources allow the AI system to influence sensitive decisions or surface restricted information.
3. Impact is business, regulatory, and reputational harm, including control failure, compliance exposure, and loss of trust in AI-enabled processes.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI governance debt is now an enterprise risk class: organisations are accumulating control gaps whenever AI deployment outruns inventory, ownership, and review processes. That is not a maturity issue in the abstract. It is a governance debt problem that compounds as more systems, data sources, and decision paths become AI-mediated, and practitioners should treat it as an operational risk to be managed, not a future compliance exercise.

Identity controls are part of AI governance, not a separate concern: AI systems that can invoke tools, read data, or automate decisions need entitlement boundaries just like any other privileged workflow. The article’s evidence shows that access control failures are already central to AI-related incidents, which means IAM, PAM, and NHI governance all become relevant where models, agents, or copilots can act on enterprise data. Practitioners should align AI oversight with access governance rather than bolting it on afterwards.

Quantification is the bridge between technical AI controls and executive accountability: boards do not manage model prompts, but they do manage risk appetite, loss tolerance, and capital allocation. A quantified view of AI exposure allows security and GRC teams to speak in operational and financial terms, which is what moves AI governance out of theory and into funding decisions. Practitioners should use quantified exposure to define which AI controls are mandatory, which are conditional, and which are not yet acceptable.

AI lifecycle visibility is the named control gap this report keeps surfacing: organisations cannot govern what they cannot see across model intake, training data, deployment, and change management. That gap shows up in policy absence, access-control weakness, and inconsistent regulatory readiness. The practical consequence is that AI governance must start with lifecycle inventory and ownership, because every downstream control depends on knowing where AI exists and who is accountable for it.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Governance Guide

What this signals

AI lifecycle visibility: most organisations are still trying to govern AI after it has already spread across business workflows, which is why inventory and ownership now matter more than abstract policy statements. The programme question is not whether AI exists, but whether every instance has an accountable owner, a review point, and a control boundary before it touches sensitive data.

NHI, IAM, and AI governance are converging around the same practical issue: who or what is allowed to act on enterprise data. If AI agents, copilots, or automation layers can initiate actions or reach protected information, access governance must move upstream to issuance, approval, and revocation, not just audit.

Quantified exposure is what turns AI governance into an executive decision rather than a security memo. Once leaders can compare AI risk scenarios with other enterprise losses, they can justify tighter controls, slower rollout in higher-risk use cases, and more explicit acceptance criteria for deployment.

For practitioners

• Build an AI inventory and ownership model Record every AI system, copilot, model, and agent in scope, then assign a business owner, technical owner, and review cadence for each one.
• Bind AI access to entitlement governance Limit which users, service accounts, and automation paths can invoke AI tools, and align permissions with data sensitivity and role boundaries.
• Classify AI use cases by risk type Separate cybersecurity, privacy, operational, bias, and regulatory risks so controls are targeted instead of generic across every use case.
• Quantify AI scenarios for leadership review Translate high-impact AI failures into loss, disruption, and compliance consequences so boards can compare them against other enterprise risks.

Key takeaways

• AI risk grows fastest when deployment outruns inventory, ownership, and access controls.
• The report’s figures show that governance gaps are already common enough to create predictable exposure.
• Practitioners should treat AI lifecycle visibility and entitlement control as the starting point for resilient AI governance.

Key terms

• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• AI Risk Assessment: AI Risk Assessment is the structured process of identifying, analyzing, and prioritizing risks created by using artificial intelligence systems. It examines model behavior, data quality, security exposure, privacy impact, bias, misuse, and operational failure. In practice, it maps AI-specific threats to controls, owners, and residual risk decisions.
• AI Lifecycle: The AI lifecycle is the end-to-end path from problem framing to retirement. It covers the decisions that shape a system’s purpose, data, behaviour, deployment, oversight, and decommissioning. In practice, it is the governance map that shows where risk enters and where accountability must stay active.
• Access Controls: Access controls are the rules that limit who can see or use data and systems. They may use roles, attributes, authentication strength, and policy checks to reduce exposure. In DLP programmes, access controls help ensure sensitive content is only available to approved users and processes.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners building controlled access in complex environments. It helps security and identity teams connect governance decisions to operational identity risk.