Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: Regulators now expect documented inventory, ownership, and lifecycle oversight for AI-enabled systems, and Checkmarx argues that green pipelines and checklist-based trust no longer satisfy EU AI Act, NIS2, DORA, or ISO 42001 evidence needs. The governance gap is widening because organisations believe 27% of AI assets are governed while practitioners put the figure at 12%, making inventory, control proof, and accountability the decisive issues.
NHIMG editorial — based on content published by Checkmarx: AI supply chain governance and the need for evidence-based oversight
By the numbers:
- Only 22% of organisations have a formal AI governance policy in place today.
- Leadership believes roughly 27% of AI assets are standardized and governed.
Questions worth separating out
Q: What breaks when organisations rely on green pipelines for AI governance?
A: Green pipelines only prove that a build completed, not that the AI component is understood, owned, or constrained.
Q: Why do AI supply chains create identity and access risk?
A: Because AI systems rely on service accounts, API keys, federation paths, and delegated tool permissions.
Q: What do security teams get wrong about AI governance reviews?
A: They often treat every use case as if it needs the same level of scrutiny.
Practitioner guidance
- Build a deterministic AI asset inventory Scan repositories, registries, local model stores, notebooks, and agent frameworks to enumerate models, MCP servers, datasets, and binary artefacts.
- Separate developer-use and product-use controls Write distinct policy paths for AI used by engineers and AI embedded in shipped services.
- Treat MCP servers and agents as scoped access assets Review tool permissions, data access, and delegated actions for every connected agent or server.
What's in the full article
Checkmarx's full analysis covers the operational detail this post intentionally leaves for the source:
- How the AI-BOM is assembled from repositories, registries, notebooks, local directories, and binary model artefacts
- How scanner logic identifies insecure deserialization, dangerous loaders, and runtime code execution paths in model files
- How MCP server scope checks compare declared tool access with actual permissions
- How the article maps inventory evidence to EU AI Act, NIS2, DORA, and ISO 42001 documentation needs
👉 Read Checkmarx's analysis of AI supply chain governance and AI-BOM evidence →
AI governance evidence gaps: what practitioners need to fix now?
Explore further
28/08/2026 12:04 pm
AI governance debt is now a board-level exposure. The article shows that organisations are still relying on trust signals that predate AI supply chains, while regulators are asking for evidence, inventory, and ownership. That mismatch creates governance debt because every new model, agent, or MCP server expands the control surface faster than policy can catch up. Practitioners should treat AI governance as an auditable operating model, not a documentation exercise.
A question worth separating out:
Q: How can organisations prove AI governance to auditors and boards?
A: Organisations prove AI governance by producing evidence that the control operated, not just that a policy existed. That evidence should include inventory records, runtime logs, policy decisions, and escalation handling for both sanctioned and unsanctioned AI use. Framework alignment helps, but auditors and boards usually want demonstrable execution, not framework language alone.
👉 Read our full editorial: AI supply chain governance needs evidence, not trust, now
