Topic starter
20/08/2026 5:37 pm
TL;DR: AI governance is shifting from deterministic rule enforcement to judgment-based GRC as non-deterministic systems make old policy models less reliable, according to ActiveFence. The practical implication is that AI oversight now depends on red teaming, human review, and clearer accountability, especially where AI behaves like a tool with its own runtime decisions.
Editorial analysis by NHI Mgmt Group, based on content published by ActiveFence: “Curiouser Soundbites: What D&D Taught Us About AI Governance”.
Key questions
Q: How should organisations govern AI systems that do not return the same result twice?
A: Organisations should govern non-deterministic AI with outcome thresholds, human review points, and exception handling instead of assuming one fixed response.
Q: Why does AI governance become a GRC issue instead of just a policy issue?
A: Because policies assume predictable behaviour, while non-deterministic AI can produce different outputs in the same operating context.
Q: What do teams get wrong about AI red teaming coverage?
A: Teams often overfocus on prompt-level failures and miss the wider attack surface.
Practitioner guidance
- Define decision thresholds for AI outputs Set explicit thresholds for when AI output can be accepted, when it needs review, and when it must be rejected.
- Build red teaming into governance cadence Schedule human and automated red team exercises as part of governance review, not only as pre-release testing.
- Assign clear ownership for AI exceptions Name the role that approves exceptions, records rationale, and signs off on high-risk AI decisions.
Bottom line: Non-deterministic AI makes static rulebooks insufficient, because the same prompt or input can produce different and operationally meaningful outcomes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:22 pm
AI governance debt is now a real programme risk: organisations can accumulate policies faster than they can operationalise judgement. When AI behaviour is non-deterministic, a control library alone does not tell teams when a result is acceptable, when it is not, or who should decide. The governance burden shifts from documenting rules to making repeatable decisions under uncertainty. Practitioners should treat this as a maturity gap, not a documentation gap.
A few things that frame the scale:
- A Harris Poll survey of more than 300 technology decision-makers found that 86% expect agentic AI to deliver positive ROI, yet fewer than half had AI governance policies in place.
A question worth separating out:
Q: Who should own exceptions when AI output is ambiguous or inconsistent?
A: A clearly named business or governance owner should own exceptions, not an unnamed committee or the model team by default. The owner needs authority to approve, reject, and document edge cases, because ambiguous AI outcomes only become manageable when accountability is attached to the decision.
👉 Read our full editorial: AI governance is becoming a GRC problem, not just a rules problem