Notifications
Clear all
Topic starter
10/07/2026 9:23 pm
TL;DR: As AI systems change continuously while risk programs still rely on periodic reviews, organisations are seeing a widening gap between perceived and actual risk, according to OneTrust. Static governance, siloed ownership, and disconnected signals leave security, GRC, and third-party risk teams unable to manage AI exposures in real time.
NHIMG editorial — based on content published by OneTrust: Why Fragmented Risk Programs Fail in the Age of AI
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should organisations govern AI systems that change after deployment?
A: Treat governance as a continuous operating process rather than a periodic review.
Q: Why do fragmented risk programs fail for AI governance?
A: They split model oversight, access control, privacy review, and vendor risk across different teams that do not share one live view of exposure.
Q: What do organisations get wrong about adding more AI controls?
A: They often assume more approvals and documentation will close the governance gap, when the real issue is slow feedback.
Practitioner guidance
- Map AI-connected access paths Inventory every service account, API key, token, and delegated permission used by AI systems, then assign a clear owner for each access path across its full lifecycle.
- Replace periodic reviews with continuous signals Tie control validation to model updates, data changes, and deployment events so governance reflects live behaviour rather than quarterly snapshots.
- Create a shared AI risk operating model Bring security, privacy, GRC, engineering, and third-party risk onto one workflow for approvals, exceptions, evidence, and remediation tracking.
What's in the full article
OneTrust's full blog covers the operational detail this post intentionally leaves for the source:
- The article's full explanation of how fragmented AI ownership shows up across security, privacy, compliance, and engineering workflows.
- Practical examples of why periodic reviews go stale in AI environments and how continuous monitoring changes the control model.
- OneTrust's discussion of where AI governance should sit inside a broader risk operating model for live systems.
- The source article's framing of what integrated monitoring means for risk, trust, and accountability in production AI.
👉 Read OneTrust's analysis of why fragmented AI risk programs fail →
AI governance fragmentation: what it means for security teams?
Explore further
10/07/2026 9:46 pm
AI governance debt is the right concept for this problem. The article describes a growing gap between how organisations think risk is managed and how AI systems actually change in production. That gap is not just a tooling issue. It is what happens when monitoring, ownership, and access governance lag behind model behaviour. For practitioners, the conclusion is that governance must be continuous, not episodic.
A question worth separating out:
Q: Which frameworks help teams operationalise AI risk governance?
A: The NIST AI Risk Management Framework is the clearest reference point because it emphasises govern, map, measure, and manage as ongoing functions. Teams should use it to connect policy, evidence, and monitoring rather than treating AI governance as a one-time compliance checkpoint.
👉 Read our full editorial: Fragmented AI risk programs fail because systems change faster
