Topic starter
16/04/2026 7:55 pm
TL;DR: Enterprise AI adoption is outpacing governance maturity, with Delinea arguing that visibility, accountability, and training must extend across AI systems, shadow AI, and AI agents. The deeper issue is that organisations are trying to govern a fast-moving identity layer with controls designed for slower, centrally managed programmes.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Responsible governance in the age of enterprise AI”.
Key questions
Q: What breaks when AI governance is limited to policy documents and dashboards?
A: What breaks is enforcement.
Q: Should organisations prioritise AI inventory discovery or policy writing first?
A: Inventory discovery should come first because you cannot govern what you cannot see.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Practitioner guidance
- Map every AI entry point Inventory employee-used tools, embedded AI features, vendor-added AI functions and AI agents so governance starts from what actually exists, not what policy assumes exists.
- Assign lifecycle ownership Name a business and security owner for each AI system or agent who is responsible for approval, monitoring, audit evidence and retirement decisions.
- Classify AI use by risk Create a risk classification model that distinguishes low-impact experimentation from systems that influence customer interaction, operations or decision-making.
Bottom line: Enterprise AI is being adopted faster than most governance programmes can inventory, classify and control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:40 am
Enterprise AI governance is becoming an identity governance problem, not just a model-risk problem. The article shows that AI now sits inside workflows, products and decision paths, which means governance has to track who or what can act, approve and expose data. That is familiar territory for IAM and IGA teams, but the subject is now AI systems and agents rather than only people. The practical conclusion is that AI governance needs the same ownership discipline applied to every other high-impact identity surface.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Why do AI agents and shadow AI complicate governance in enterprise environments?
A: AI agents complicate governance because they can access data through multiple connectors, often outside managed approval paths. Shadow AI adds another blind spot when employees use tools on personal or unregistered accounts. That combination makes it hard to know what data is exposed, who approved access, and whether controls are actually operating as intended.
👉 Read our full editorial: Responsible enterprise AI governance is lagging behind adoption