Topic starter
28/08/2026 12:04 pm
TL;DR: Regulators now expect documented inventory, ownership, and lifecycle oversight for AI-enabled systems, and Checkmarx argues that green pipelines and checklist-based trust no longer satisfy EU AI Act, NIS2, DORA, or ISO 42001 evidence needs. The governance gap is widening because organisations believe 27% of AI assets are governed while practitioners put the figure at 12%, making inventory, control proof, and accountability the decisive issues.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “The Regulators Already Assume You Have an AI Inventory. Do You?”.
By the numbers:
- Only 22% of organisations have a formal AI governance policy in place today.
- Leadership believes roughly 27% of AI assets are standardized and governed, while practitioners put the figure at 12%.
- AI-assisted developers commit at 3–4x the rate of their peers but introduce security findings at 10x the rate.
Key questions
Q: What breaks when organisations rely on green pipelines for AI governance?
A: Green pipelines only prove that a build completed, not that the AI component is understood, owned, or constrained.
Q: Why do AI agents, MCP servers, and model files create compliance risk even when code scans pass?
A: They often carry runtime behaviour, delegated access, or execution paths that traditional code and dependency scanners do not inspect.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Implement deterministic AI asset discovery Scan repositories, registries, local environments, and connected tool surfaces to identify models, agents, MCP servers, datasets, and skill files that are otherwise invisible to source-only review.
- Create an AI-BOM with named ownership Record each AI component, its business owner, approval status, and lifecycle state so the organisation can evidence control rather than assert it.
- Classify AI components by governance and risk tier Separate development tooling, embedded product AI, and regulated high-risk use cases so review depth matches exposure and accountability requirements.
Bottom line: AI supply chain governance now depends on evidence of inventory, ownership, and lifecycle control rather than trust in pipeline status.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
28/08/2026 12:04 pm
Evidence, not trust, is now the governing principle for AI supply chains: organisations can no longer treat a green pipeline or a completed checklist as proof of control. The article reflects a broader shift in which regulators expect inventory, ownership, and lifecycle evidence for AI-enabled systems. For identity programmes, that means governance must be demonstrable at the asset level, not inferred from process intent.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI as an application or as an identity?
A: Treat it as an identity when the AI can access data, invoke tools, or participate in workflows that affect business systems. That framing makes least privilege, just-in-time access, and lifecycle governance relevant. If you keep treating it only as an application, you will miss the access and delegation behaviours that actually create risk.
👉 Read our full editorial: AI supply chain governance needs evidence, not trust, now
This post was modified 18 hours ago by NHI Mgmt Group