Topic starter
10/07/2026 9:23 pm
TL;DR: As AI systems change continuously while risk programs still rely on periodic reviews, organisations are seeing a widening gap between perceived and actual risk, according to OneTrust. Static governance, siloed ownership, and disconnected signals leave security, GRC, and third-party risk teams unable to manage AI exposures in real time.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Why Fragmented Risk Programs Fail in the Age of AI”.
Key questions
Q: What fails when AI risk programs rely on periodic reviews?
A: Periodic reviews fail because AI systems can change materially between checkpoints, especially when models, data, and prompts evolve after deployment.
Q: Why does fragmented AI infrastructure create security risk?
A: Fragmented AI infrastructure creates risk because each provider handoff can split responsibility for credentials, permissions, and logging.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define a shared AI risk operating model Assign clear ownership across security, privacy, compliance, data, and third-party risk so that one team is accountable for live AI risk decisions rather than only its own slice of the programme.
- Inventory where AI exists and who can change it Build a current inventory of models, systems, integrations, and service identities, then tie each to the team that can deploy, tune, or approve changes.
- Shift controls from periodic review to lifecycle monitoring Use continuous monitoring for model updates, data changes, and deployment events so assessments reflect current system state instead of stale snapshots.
Bottom line: AI risk programs fail when they assume models behave like static systems, because the control model and the system state move on different timelines.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:46 pm
AI governance fragmentation is now a control failure, not just an organisational inconvenience. The article describes a world where security, privacy, compliance, and third-party risk each see only part of the AI lifecycle. That is a governance architecture problem because the system changes faster than the oversight model. The practitioner conclusion is that AI governance must be treated as a connected control plane, not a set of isolated reviews.
A few things that frame the scale:
- Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
A question worth separating out:
Q: Should organisations prioritise continuous monitoring over more review gates for AI?
A: Yes, when the systems involved update faster than formal approval cycles can track. More review gates can slow delivery without improving risk visibility if they are not connected to live system state. The better approach is to place controls at the points where models, data, and access actually change.
👉 Read our full editorial: Fragmented AI risk programs fail because systems change faster