Notifications
Clear all
Topic starter
18/08/2026 2:22 pm
TL;DR: AI governance fails when organisations cannot inventory AI systems, map the data they access, and assign accountable owners across the lifecycle, according to BigID. NHIMG’s view is that governance now depends on continuous visibility into AI usage, data exposure, and access paths, not policy documents alone.
NHIMG editorial — based on content published by BigID: AI governance best practices and lifecycle controls
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: How do IAM and data security teams align on AI governance?
A: They should align around the same control objective: explainable access to sensitive data.
Q: What breaks when organisations ban shadow AI instead of governing it?
A: Bans often push AI use into personal accounts, unmanaged devices, and hidden workflows, which removes visibility from security and makes data exposure harder to detect.
Practitioner guidance
- Build a unified AI inventory Track models, copilots, AI agents, third-party services, and embedded AI features in one register, then assign a business owner and review date to each system.
- Classify data before AI can reach it Map sensitive, regulated, and business-critical data sources, then restrict AI access with least-privilege rules, masking, and approved retrieval paths.
- Tier controls by AI risk Apply stronger approval, testing, and human review requirements to AI systems that influence employment, lending, fraud, or other high-impact decisions.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step AI governance workflow for building inventories, assigning ownership, and setting review cadence.
- Examples of governance metrics for inventory coverage, policy adoption, and high-risk AI assessments.
- Framework mapping for NIST AI RMF, EU AI Act, ISO/IEC 42001, and GDPR in one programme.
- Practical guidance on monitoring AI lifecycle changes, access events, and remediation tracking.
👉 Read BigID's AI governance guide on inventory, risk, and lifecycle controls →
AI governance and shadow AI: what visibility gaps change for teams?
Explore further
18/08/2026 3:13 pm
AI governance is becoming an identity problem as much as a data problem. The article rightly centres visibility, but visibility only becomes meaningful when AI systems, users, and data access are tied together in one governance model. That is where IAM, PAM, and NHI controls intersect with AI oversight, especially when agents and copilots operate with delegated access. Practitioners should treat AI identity and access paths as first-class governance objects.
A question worth separating out:
Q: How do regulators view AI systems that influence important decisions?
A: Regulators expect higher levels of accountability, documentation, transparency, and human oversight when AI affects employment, credit, healthcare, or similar high-impact outcomes. Organisations should be able to show why the system exists, what data it uses, how decisions are reviewed, and how risks are monitored over time.
👉 Read our full editorial: AI governance depends on visibility across models, data, and access
