Topic starter
11/07/2026 8:49 pm
TL;DR: Governance is lagging AI adoption across enterprises, with OneTrust’s 2025 AI-Ready Governance Report finding that 90% of advanced adopters and 63% of experimental adopters say AI exposed the limits of manual processes, while more than two-thirds of technology leaders say governance trails project speed. That gap makes continuous, programmatic control the baseline for AI-ready operations.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “What Will It Take to Be AI-ready in 2026?”.
By the numbers:
- 90% of advanced adopters say AI exposed the limits of siloed or manual processes.
- 63% of organizations still experimenting with AI report the same strain from siloed or manual processes.
Key questions
Q: What breaks when AI governance stays manual while AI runs at machine speed?
A: Manual governance breaks when review, approval, and escalation happen too slowly to influence the decision.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Define runtime governance checkpoints Embed policy decisions into AI workflows so approvals, data boundaries, and risk gates execute before the system acts, not after review cycles close.
- Classify every AI use case by control level Map each model, agent, or embedded feature to the data it touches, the decisions it can make, and the policy boundaries that should apply.
- Track third-party AI intake Create a review path for supplier-provided AI features, including data flow mapping, ownership, and approval requirements before deployment into business workflows.
Bottom line: AI governance becomes ineffective once AI decisions outpace manual review, because the organisation loses the ability to stop, explain, or evidence key actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:15 pm
AI governance debt is becoming a real security liability: when governance remains manual while AI execution becomes automated, the organisation accumulates decisions it can no longer consistently see, approve, or evidence. That gap is not administrative inefficiency, it is a control failure that affects data use, accountability, and risk acceptance. For identity teams, the lesson is that authorization and policy enforcement must move closer to runtime. The practitioner conclusion is to treat governance latency as a security issue, not just an operational inconvenience.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
A question worth separating out:
Q: Who should own AI governance when business teams are adopting it quickly?
A: Ownership should sit with the business function using AI, supported by IAM, security, and risk teams. That model keeps accountability tied to the actual use case instead of allowing governance to drift into a shared-no-one model.
👉 Read our full editorial: AI governance must become infrastructure to keep pace with automation