Notifications
Clear all
Topic starter
02/08/2026 11:23 am
TL;DR: Building AI governance in-house typically costs $800K to $1.2M annually and can take 12 to 18 months before audit-ready evidence exists, according to Openlayer. The real decision is not just cost, but whether your programme can produce model inventories, monitoring, evaluation records, and runtime enforcement before regulatory deadlines close the gap.
NHIMG editorial — based on content published by Openlayer: Build vs. Buy AI Governance: How to Decide (July 2026)
By the numbers:
- Building AI governance in-house typically costs $800K to $1.2M annually and takes 12 to 18 months before producing audit-ready documentation.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: What breaks when AI governance exists on paper but not in enforcement?
A: Policy-only governance fails when teams cannot technically restrict access, log decisions, or revoke permissions in the systems AI actually uses.
Q: Why do AI governance programmes need lineage and audit evidence as much as monitoring?
A: Monitoring shows what a model is doing now, but lineage and audit evidence show why it was allowed to run in the first place.
Q: What do security teams get wrong about secure-by-design AI governance?
A: They often treat secure-by-design as a policy label instead of an enforceable operating model.
Practitioner guidance
- Define the governance boundary before buying or building Separate documentation, monitoring, and runtime enforcement into distinct requirements so teams can see whether the chosen approach actually blocks unsafe outputs at the API boundary.
- Require lineage for every production model Capture model version, training data provenance, deployment approval, and evaluation evidence in one record so auditors can trace each decision back to an approved artefact.
- Test enforcement, not just evaluation Validate that unsafe outputs are blocked in production conditions, not merely scored in pre-deployment tests, because a pass/fail report without blocking still leaves exposure.
What's in the full article
Openlayer's full research covers the operational detail this post intentionally leaves for the source:
- Implementation cost breakdowns for internal build programmes, including staffing, tooling, and legal review assumptions.
- Vendor evaluation criteria for deciding whether a governance platform actually enforces policy at runtime or only documents it.
- The article's fuller decision matrix for regulated organisations, including where hybrid build-buy models fit best.
- The practical trade-offs around data privacy, integration depth, and compliance gap coverage that are only summarised here.
👉 Read Openlayer's analysis of build versus buy AI governance →
AI governance build vs buy: are your controls ready for audit?
Explore further
02/08/2026 12:41 pm
Policy documentation without runtime enforcement is not AI governance. The article correctly separates controls that look compliant on paper from controls that actually stop unsafe behaviour. That distinction matters because auditors and security teams increasingly care about evidence at the point of decision, not just after the fact. In identity terms, this is the same mistake made when access reviews exist but privileges remain standing. Practitioners should treat enforcement as the real control boundary.
A question worth separating out:
Q: How should organisations decide whether to build or buy AI governance controls?
A: Choose build when the organisation needs deep custom instrumentation, strict data residency, and has dedicated engineering capacity to own the system long term. Choose buy when audit deadlines are close, governance coverage is needed quickly, or enforcement must be delivered faster than an internal team can build it. Hybrid approaches often work best for large enterprises.
👉 Read our full editorial: Build vs buy AI governance: where execution risk now sits
