Topic starter
11/07/2026 8:37 pm
TL;DR: AI adoption is moving faster than traditional governance can absorb, and OneTrust argues that deterministic risk models miss AI’s probabilistic behaviour, drift, leakage, and provenance issues. The practical shift is toward continuous, telemetry-driven governance that treats AI risk as data risk and makes lineage a control, not just a record.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “What CDOs Must Do When Risk Frameworks Fall Short for AI”.
Key questions
Q: How should organisations govern AI systems that can change scope at runtime?
A: They should treat runtime behaviour as part of the compliance boundary.
Q: Why do legacy risk frameworks fail to capture AI risk properly?
A: They were built for systems that behave predictably enough to assess once and review later.
Q: What do security teams get wrong about AI governance reviews?
A: They often treat every use case as if it needs the same level of scrutiny.
Practitioner guidance
- Define AI governance as a continuous control process Replace annual or project-based AI reviews with ongoing monitoring for drift, leakage, bias, and abnormal prompt behaviour across development and runtime.
- Make lineage and provenance mandatory control inputs Require traceable source, transformation, and ownership metadata for training and operational data so model outcomes can be explained and investigated.
- Assign joint accountability across data and security teams Create a shared governance workflow that makes data, security, legal, compliance, and engineering sign off on model changes and control exceptions together.
Bottom line: AI governance is exposing a mismatch between probabilistic model behaviour and legacy risk frameworks built for deterministic systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:07 pm
AI governance debt is now a board-level operating risk: organisations are shipping AI faster than their governance structures can absorb, which means review-based models are accumulating risk debt. The issue is not only lack of policy, but mismatch between deterministic control design and probabilistic system behaviour. For identity, security, and data leaders, the practical conclusion is that AI governance must be designed as an operating model, not a document set.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between traditional DLP and AI-specific data governance?
A: Traditional DLP focuses on known transfer channels, while AI-specific governance has to cover prompts, agents, and integration layers that can move information indirectly. In practice, AI governance is broader because it must account for both the content being handled and the identities or secrets enabling the workflow.
👉 Read our full editorial: AI governance is exposing the limits of legacy risk frameworks