Topic starter
18/08/2026 2:22 pm
TL;DR: AI governance fails when organisations cannot inventory AI systems, map the data they access, and assign accountable owners across the lifecycle, according to BigID. NHIMG’s view is that governance now depends on continuous visibility into AI usage, data exposure, and access paths, not policy documents alone.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “AI Governance Best Practices: How to Build Trusted, Secure, and Compliant AI”.
Key questions
Q: What breaks when organisations cannot inventory their AI credentials?
A: Rotation, recertification, and offboarding all break down when the inventory is incomplete.
Q: Why is visibility important in AI governance?
A: Visibility is crucial in AI governance as it enables organizations to monitor agent activity and hold them accountable for their actions.
Q: How should security teams handle high-impact AI systems differently from low-risk tools?
A: High-impact AI systems should receive stricter documentation, testing, human review, logging, and continuous monitoring than internal productivity tools.
Practitioner guidance
- Build a living AI inventory Track every model, copilot, agent, and third-party AI service with business owner, data access scope, and risk tier.
- Map data pathways into AI systems Identify which sensitive, regulated, and business-critical datasets feed training, retrieval, or inference for each AI use case.
- Tier governance by use case risk Apply stronger review, logging, human oversight, and change control to AI systems that influence regulated or high-impact decisions.
Bottom line: AI governance fails first as a visibility problem when organisations cannot see the systems, data, and owners involved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:13 pm
Visibility is now the first control in AI governance. The article correctly places inventory ahead of policy because organisations cannot govern systems they cannot name, classify, or assign to an owner. That is especially true once copilots, agents, and third-party services span multiple business units and cloud environments. The practical conclusion is simple: governance programmes should treat discovery as an operational control, not a documentation exercise.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should be accountable for enterprise AI governance?
A: Accountability should sit with a named owner for each AI system, supported by a cross-functional governance structure that includes security, legal, IT, and business leadership. The committee can coordinate decisions, but each AI use case still needs a clear operational owner for approvals and oversight.
👉 Read our full editorial: AI governance depends on visibility across models, data, and access