Notifications
Clear all
Topic starter
06/06/2026 11:31 am
TL;DR: AI governance is becoming a board-level risk because 88% of organisations now use AI in at least one business function, yet many still have no clear ownership or enforcement path, according to WitnessAI. The governance model is breaking where adoption, visibility, and accountability no longer line up, so AI risk management must move from policy drafting to runtime control.
NHIMG editorial — based on content published by WitnessAI: AI governance challenges are now the defining risk category for enterprises scaling AI
By the numbers:
- 88% of organizations report regular use of AI in at least one business function.
- 78% of employees admit to using AI tools that their employer has not approved.
- 98% of organizations have a relationship with at least one third-party vendor that experienced a breach in the last two years.
Questions worth separating out
A: Organisations should create one enforced AI governance path with explicit decision rights, not a loose committee structure.
Q: Why do legacy security tools struggle to control AI-related data exposure?
A: Legacy tools were built for files, patterns, and known application flows, while AI risk often lives in prompts, responses, and session context.
Q: What breaks when AI agents are treated like normal human users in governance programmes?
A: Human-centric governance assumes access is stable enough to review later and that authorisation is tied to a person’s session and behaviour.
Practitioner guidance
- Assign one accountable AI governance owner Create a decision-making path that lets one named function approve, block, or escalate AI use cases.
- Map AI controls to conversational risk, not file risk Review whether your current DLP, CASB, and endpoint stack can inspect prompts, responses, and multi-turn context.
- Discover shadow AI across all user surfaces Build discovery that covers browser tools, native desktop apps, IDEs, embedded copilots, and model access that bypasses browser-only monitoring.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- A practical breakdown of the three-module Observe, Control, and Protect model and how it maps to enterprise deployment stages.
- Specific examples of how intent-based detection differs from keyword-based DLP when users paste sensitive material into AI tools.
- Discovery and enforcement details for shadow AI across browser apps, IDEs, and desktop tools that endpoint-only monitoring misses.
- Agent and MCP server discovery guidance for teams beginning to inventory autonomous and semi-autonomous AI usage.
👉 Read WitnessAI's guide to the six enterprise AI governance challenges →
AI governance gaps and what they mean for enterprise security teams?
Explore further
06/06/2026 12:22 pm
AI governance is now an identity governance problem, not just a policy problem. When enterprises cannot say who owns enforcement, they also cannot say who is accountable for access, data movement, or policy exceptions. That is the same structural failure IAM teams already see when governance exists only in documents and committees. The practical conclusion is that AI governance must be managed like an identity programme with enforceable ownership, not a loose compliance overlay.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity governance fails when inventory is incomplete.
A question worth separating out:
Q: How do security teams reduce shadow AI risk without blocking all AI adoption?
A: Start by discovering what is actually in use across browser tools, desktop apps, IDEs, and embedded copilots. Then classify usage by risk and intent, and apply policy choices such as allow, warn, block, or route to approved models. Visibility first, enforcement second, so governance follows real behaviour.
👉 Read our full editorial: AI governance challenges expose the gap between adoption and control
