Topic starter
16/04/2026 7:55 pm
TL;DR: Enterprise AI is spreading faster than governance can inventory, classify and control, according to Delinea. Governance now has to prove visibility and lifecycle ownership across AI systems, shadow AI and AI agents.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Responsible governance in the age of enterprise AI”.
Key questions
Q: Should organisations prioritise AI inventory discovery or policy writing first?
A: Inventory discovery should come first because you cannot govern what you cannot see.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Q: What breaks when AI governance is limited to policy documents and dashboards?
A: What breaks is enforcement.
Practitioner guidance
- Map every AI entry point Inventory employee-used tools, embedded AI features, vendor-added AI functions and AI agents so governance starts from what actually exists, not what policy assumes exists.
- Assign lifecycle ownership Name a business and security owner for each AI system or agent who is responsible for approval, monitoring, audit evidence and retirement decisions.
- Classify AI use by risk Create a risk classification model that distinguishes low-impact experimentation from systems that influence customer interaction, operations or decision-making.
Bottom line: Enterprise AI is being adopted faster than most governance programmes can inventory, classify and control.
Glossary terms: AI Governance, Shadow AI, AI Lifecycle, Runtime AI Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:40 am
Enterprise AI governance is becoming an identity governance problem, not just a model-risk problem. The article shows that AI now sits inside workflows, products and decision paths, which means governance has to track who or what can act, approve and expose data. That is familiar territory for IAM and IGA teams, but the subject is now AI systems and agents rather than only people. The practical conclusion is that AI governance needs the same ownership discipline applied to every other high-impact identity surface.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Why do AI agents and shadow AI complicate governance in enterprise environments?
A: AI agents complicate governance because they can access data through multiple connectors, often outside managed approval paths. Shadow AI adds another blind spot when employees use tools on personal or unregistered accounts. That combination makes it hard to know what data is exposed, who approved access, and whether controls are actually operating as intended.
👉 Read our full editorial: AI governance must move from policy to operational control
This post was modified 1 day ago by NHI Mgmt Group