Topic starter
24/06/2026 7:19 pm
TL;DR: AI trust is eroding as shadow AI appears in more than 90% of organisations, deepfake files rise from about 500,000 in 2023 to over 8 million in 2025, and only 40% of consumers trust AI as an information source, according to DigiCert and Business Insider. Trust now has to be proven through identity, integrity, and auditability, not assumed.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “The degradation of trust in the age of AI”.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do AI models need integrity controls in addition to access control?
A: Access control only answers who can reach the model.
Q: What should organisations do about content authenticity as AI-generated material grows?
A: Organisations should treat content authenticity as a governed identity problem.
Practitioner guidance
- Inventory all AI agents and shadow AI use Create and maintain a live register of approved and unapproved AI tools, with named business owners, data access scope, and system touchpoints.
- Bind agent actions to accountable identities Require cryptographic identity, scoped authorization, and complete audit logging for every agent that can access systems or make decisions.
- Validate model provenance and integrity Track model source, training lineage, deployment location, and integrity checks so that downstream decisions do not rely on an unverified model.
Bottom line: The core risk is not AI adoption itself but the collapse of assumptions about identity, integrity, and authenticity across the AI stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:32 am
AI trust is now a governance problem across three identity layers, not one. The article is right to separate agents, models, and content because each breaks a different assumption in the trust chain. Identity tells you who or what acted, integrity tells you whether the decision source was altered, and provenance tells you whether the content can be believed. Practitioners should stop treating these as isolated controls and start governing them as one trust surface.
A question worth separating out:
Q: How should teams govern shadow AI in existing IAM programmes?
A: They should treat shadow AI as an identity and access issue, not a standalone AI issue. That means discovery, ownership, entitlement review, and offboarding need to cover approved and unapproved AI use together. If the programme cannot connect usage to identities, it cannot govern the actual control path.
👉 Read our full editorial: AI trust is breaking across agents, models, and content