Notifications
Clear all
Topic starter
21/08/2026 4:42 pm
TL;DR: The first useful step in AI transformation is an executive meeting to establish what is already running, what has failed before, and where control is either too tight or too loose, according to C1.ai. The real governance problem is not model selection but shadow AI, unclear attribution, and program charters that do not reflect operational reality.
NHIMG editorial — based on content published by C1.ai: The Most Important AI Meeting You'll Have This Quarter Costs Nothing
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should organisations start governing AI agents and shadow automation?
A: Start with inventory, ownership, and traceability before you discuss architecture or use cases.
Q: Why do AI programmes often fail between innovation and control?
A: They fail when governance is either too heavy for delivery teams or too weak to constrain reuse.
Q: What do security teams get wrong about Shadow AI?
A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem.
Practitioner guidance
- Run an executive identity inventory meeting Bring CIO, CISO, CTO, and business leaders into one session to list known agents, service accounts, and delegated workflows, then record where ownership is unclear.
- Document past programme failures in the charter Write down the failed AI, automation, or CoE initiatives that should not be repeated, and make that history part of the governing document.
- Set explicit control boundaries for reuse Define where approval is mandatory, where reuse is allowed, and where teams can proceed without routing around governance.
What's in the full article
C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact ADAPT meeting structure and executive roles used to frame the programme.
- The five-rung maturity ladder and how the self-assessment is expected to work.
- The specific kill criteria language used to decide when the methodology should be dissolved or restructured.
- The author’s full explanation of the balance between too much control and too little control.
👉 Read C1.ai's analysis of the ADAPT phase and AI governance starting points →
AI transformation governance: what do leaders need to agree on first?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
21/08/2026 5:03 pm
AI governance begins with identity truth, not model ambition. The article is right to start with an executive meeting because most programmes fail when leaders cannot agree on what is already running. For identity teams, that means the first control is not a policy or a platform, but a shared inventory of human, NHI, and AI-related access paths. If the organisation cannot name the actors, it cannot assign ownership or judge risk.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Our research also shows that 97% of NHIs carry excessive privileges, which helps explain why unchecked reuse becomes a governance problem quickly.
A question worth separating out:
Q: Who should own AI governance when business teams are adopting it quickly?
A: Ownership should sit with the business function using AI, supported by IAM, security, and risk teams. That model keeps accountability tied to the actual use case instead of allowing governance to drift into a shared-no-one model.
👉 Read our full editorial: AI transformation starts with one honest meeting, not a build plan
