Topic starter
11/07/2026 8:37 pm
TL;DR: Legacy risk frameworks miss AI's probabilistic behaviour, drift, leakage and provenance issues according to OneTrust. AI governance needs continuous telemetry, lineage and shared accountability to catch risk as systems change.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “What CDOs Must Do When Risk Frameworks Fall Short for AI”.
Key questions
Q: Why do legacy risk frameworks fail to capture AI risk properly?
A: They were built for systems that behave predictably enough to assess once and review later.
Q: What do security teams get wrong about AI governance reviews?
A: They often treat every use case as if it needs the same level of scrutiny.
Q: How should organisations govern AI systems that can change scope at runtime?
A: They should treat runtime behaviour as part of the compliance boundary.
Practitioner guidance
- Define AI governance as a continuous control process Replace annual or project-based AI reviews with ongoing monitoring for drift, leakage, bias, and abnormal prompt behaviour across development and runtime.
- Make lineage and provenance mandatory control inputs Require traceable source, transformation, and ownership metadata for training and operational data so model outcomes can be explained and investigated.
- Assign joint accountability across data and security teams Create a shared governance workflow that makes data, security, legal, compliance, and engineering sign off on model changes and control exceptions together.
Bottom line: AI governance is exposing a mismatch between probabilistic model behaviour and legacy risk frameworks built for deterministic systems.
Glossary terms: AI Governance, Model Drift, Data Lineage, Telemetry-driven governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 hour ago by NHI Mgmt Group
11/07/2026 9:07 pm
AI governance debt is now a board-level operating risk: organisations are shipping AI faster than their governance structures can absorb, which means review-based models are accumulating risk debt. The issue is not only lack of policy, but mismatch between deterministic control design and probabilistic system behaviour. For identity, security, and data leaders, the practical conclusion is that AI governance must be designed as an operating model, not a document set.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between traditional DLP and AI-specific data governance?
A: Traditional DLP focuses on known transfer channels, while AI-specific governance has to cover prompts, agents, and integration layers that can move information indirectly. In practice, AI governance is broader because it must account for both the content being handled and the identities or secrets enabling the workflow.
👉 Read our full editorial: AI governance is exposing the limits of legacy risk frameworks