AI governance: are your controls actually enforceable?

TL;DR: The Tromsø municipality case, where 673 pages of chat logs exposed unverified AI-generated report content, shows why inventory and policy are not enough without operational governance and real-time control according to Saidot. The governance gap is not AI adoption itself, but the absence of enforced oversight, auditability, and lifecycle trigger points that make accountability real.

Editorial analysis by NHI Mgmt Group, based on content published by Saidot: “Beyond compliance: Building trust through AI governance and control”.

By the numbers:

• 673 pages of chat logs from Tromsø municipality became public in 2025 and exposed unverified AI-generated report content.
• The EU AI Act entered into force on 1 August, 2024, with governance rules for general-purpose AI models becoming applicable on 2 August, 2025.

Key questions

Q: What breaks when AI governance exists on paper but not in enforcement?

A: Policy-only governance fails when teams cannot technically restrict access, log decisions, or revoke permissions in the systems AI actually uses.

Q: Why do organisations need trigger-based governance for AI systems?

A: AI systems change after retraining, model updates, tool additions, and data changes, so a one-time approval quickly becomes stale.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.

Practitioner guidance

• Implement a governed AI inventory Track models, agents, tools, datasets, and third-party dependencies in one inventory so every AI use case has an owner, a risk rating, and a control status.
• Enforce human review checkpoints Block AI-generated outputs from progressing into reports, customer communications, or regulated workflows until a qualified reviewer explicitly approves them.
• Tie governance to change events Reassess AI systems when models are retrained, APIs change, plug-ins are added, or new data sources are introduced, because each change can alter risk.

Bottom line: The central risk is not that organisations use AI, but that they allow AI output to enter records and workflows without enforceable human oversight.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →