TL;DR: Agencies trying to govern AI use cases can use the NIST AI Risk Management Framework as a practical starting point, according to Collibra’s article, with Govern, Map, Measure and Manage presented as a continuous cycle for trustworthy deployment. The bigger message is that AI governance is only durable when data governance, lineage, and review cadence are treated as part of the same control model.
At a glance
What this is: This article frames the NIST AI Risk Management Framework as a practical entry point for AI governance and argues that data governance, lineage and ongoing review must sit inside the same operating model.
Why it matters: For IAM, IGA and governance teams, the key implication is that AI governance cannot be isolated from data controls, review cadence or accountability for changing use cases.
Context
AI governance is the discipline of deciding how AI use cases are approved, monitored and retired so that risk stays inside policy. Collibra’s article argues that organisations often know they need governance, but not where to begin, which is why the NIST AI Risk Management Framework matters as an operating starting point rather than a theoretical standard.
The governance gap is not limited to model assessment. The article ties AI risk management to data governance, lineage and recurring review, which means the control model has to extend from the data feeding AI through to the decisions made on its outputs.
Key questions
Q: How should organisations align AI governance with both the EU AI Act and NIST AI RMF?
A: Organisations should treat the EU AI Act as the mandatory compliance baseline and the NIST AI RMF as the operational framework that turns governance into repeatable controls. The practical move is to map AI use cases, assess risk, assign ownership, document safeguards, and maintain evidence for audits. That combination helps teams satisfy regulatory obligations while building a defensible AI governance programme.
Q: Why is data lineage so important for AI governance?
A: Because AI outputs inherit risk from the data that feeds them. If teams cannot trace inputs, ownership, and changes over time, they cannot reliably explain model behaviour or defend decisions. Lineage gives governance teams the evidence needed to spot drift, judge trustworthiness, and know when a use case has moved outside its approved boundary.
Q: What breaks when AI governance is only a one-time review?
A: A one-time review breaks as soon as the agent gains a new tool, a new dataset, or a new workflow. Governance that is frozen at approval time cannot keep up with runtime drift, which means the real access path and the approved access path quickly diverge.
Q: How do AI RMF reviews differ from traditional access or recertification processes?
A: AI RMF reviews look at the use case, its data and its impact, not only who has access. Traditional review cycles often focus on entitlements, while AI governance also needs output quality, lineage, risk conditions and policy alignment. The difference is that AI control must follow the lifecycle of the decision, not just the identity of the user.
Technical breakdown
How the NIST AI RMF organises AI governance into four functions
The NIST AI Risk Management Framework structures AI governance around Govern, Map, Measure and Manage. Govern establishes accountability and a culture of risk management, Map adds context around use cases and stakeholders, Measure turns assumptions into evidence, and Manage converts findings into action. The useful point is not the labels themselves but the operating sequence: risk is not handled once at approval time, it is revisited as the use case, data and business context change. That makes the framework a governance workflow, not a static checklist.
Practical implication: Practitioners should treat AI governance as an operating cycle with named ownership, review cadence and documented escalation paths.
Why lineage and data governance are part of AI risk management
AI governance starts with the data that feeds the model, because model outputs cannot be more trustworthy than the input controls that shape them. Lineage makes that dependency visible by showing where data came from, how it changed and which use case consumed it. Without that context, teams may assess the model while missing the upstream conditions that create bias, stale outputs or policy violations. In practice, this is where AI governance becomes a continuation of data governance rather than a separate discipline.
Practical implication: Practitioners should connect AI use cases to lineage and data-quality controls before approving broad deployment.
Why scheduled reviews matter after AI use cases go live
The article’s strongest operational point is that AI risk does not stop when a model is deployed. Data changes, business usage changes and legal requirements change, so a one-time approval leaves the organisation blind to drift. Scheduled reviews create a recurring checkpoint for outputs, risks and compliance obligations, which is especially important when agencies are using both internally developed and third-party AI use cases. That review discipline is what turns governance from a document into a control.
Practical implication: Practitioners should define recurring AI use-case reviews that reassess outputs, inputs and policy alignment after deployment.
NHI Mgmt Group analysis
AI governance fails when it is treated as a model-only problem. Collibra’s article is right to start with the NIST AI Risk Management Framework, but the deeper lesson is that AI risk is governed across the full use-case chain, not inside the model boundary. Lineage, data quality and review cadence determine whether governance is real or merely documented. Practitioners should align AI oversight to the data and decision flow, not to model approval alone.
Govern is the control plane, not the paperwork layer. The article places Govern at the centre of the framework for a reason: ownership and culture determine whether risk management is cross-functional or trapped in a narrow technical team. That matters for IAM and governance leaders because AI use cases cut across business, data and security functions. The practical conclusion is that accountability has to be explicit before the use case expands.
Scheduled review cadence is now part of AI control design. The article correctly notes that risks change as data and requirements change, which means static approval does not survive operational reality. This is especially relevant where AI outputs affect regulated decisions or public-sector services. Teams need governance that assumes drift, not one that assumes stability after go-live.
Data governance and AI governance are the same discipline at different layers. The article’s strongest concept is that AI does not start with a framework, it starts with data. That creates a useful named concept for practitioners: governance-by-lineage. It means the organisation can only govern AI use cases if it can trace, review and justify the data feeding them. The implication is that AI governance programmes should inherit data controls rather than re-create them in isolation.
AI RMF adoption will push governance closer to operating teams. When the framework is used well, it moves decision-making out of one-off approvals and into recurring operational reviews. That changes how identity and governance programmes are run because stewardship, review and remediation become continuous responsibilities. Practitioners should expect AI governance to look less like an annual assessment and more like an ongoing control function.
From our research library:
- 76% of organisations cite shadow AI as a definite or probable problem, up from 61% in 2025, according to HiddenLayer's 2026 AI Threat Landscape Report.
- Read next: Agentic AI Identity Risk Board Briefing
What this signals
Governance-by-lineage: AI governance is only durable when every use case can be traced back to its inputs, owners and approval path. That makes data governance and AI governance a single programme with different control layers, not parallel workstreams.
Teams that want trustworthy AI should assume that approval alone is insufficient. Once a use case is live, recurring review cadence becomes the mechanism that catches data drift, policy drift and changes in legal exposure before they harden into operational risk.
For practitioners
- Align AI governance to data lineage Map each AI use case to the data sources, transformations and owners that influence its outputs so approval decisions reflect the real control surface.
- Adopt scheduled AI use-case reviews Set a recurring review cadence for outputs, legal requirements and risk conditions so deployment does not become a one-time governance event.
- Document Govern, Map, Measure and Manage ownership Assign explicit accountable owners for each RMF function so cross-functional decision-making does not collapse into a technical-only workflow.
- Treat third-party AI use cases as governed inventory Track external AI use cases in the same control register as internal ones, including review status, risk notes and remediation plans.
Key takeaways
- AI governance breaks down when it is separated from the data and review processes that shape model behaviour.
- The NIST AI RMF is most useful as a continuous operating model, not as a one-off assessment checklist.
- Practitioners should tie AI use cases to lineage, ownership and scheduled review before scaling deployment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article centres on starting AI risk management with Govern, Map, Measure and Manage. |
| MAP — AI Context and Risk Mapping | The article stresses context, stakeholders and lineage as prerequisites for AI governance. | |
| MEASURE — AI Risk Measurement | The article emphasises continuous assessment after deployment as data and conditions change. | |
| Recommendation — Use GOVERN to assign owners, decision rights and recurring oversight for each AI use case. Apply MAP to document use-case context, inputs, dependencies and downstream impacts before approval. Use MEASURE to reassess outputs, controls and risk indicators on a recurring schedule. | ||
| NIST CSF 2.0 | GV.OV-01 — Oversight of Risk Management Strategy | AI governance here is an enterprise oversight problem, not only a technical one. |
| Recommendation — Use GV.OV-01 to review whether AI risk oversight is operating as a cross-functional programme. | ||
Key terms
- AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
- NIST AI Risk Management Framework: A voluntary framework for organizing AI risk governance around clear outcomes rather than fixed compliance steps. It helps enterprises define accountability, map AI context, measure risk, and manage treatment, but it does not itself provide enforcement or certification.
- Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
- Reporting Cadence: Reporting cadence is the scheduled rhythm of status communication across technical, project, and executive stakeholders. In a microsegmentation programme, it keeps decisions, escalations, and ownership visible, which reduces surprise, supports coordination, and helps the deployment stay aligned with business objectives.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org