AI governance gaps: what should security and GRC teams do now?

TL;DR: AI adoption is advancing faster than governance, with 97% of organisations that experienced an AI-related security event lacking proper access controls and 63% saying they had no AI governance policies, according to Kovrr. The operating assumption that AI can be scaled first and governed later is already failing.

Editorial analysis by NHI Mgmt Group, based on content published by Kovrr: “The Enterprise Guide to AI Governance and Risk Resilience”.

By the numbers:

• 97% of organisations that experienced an AI-related security event lacked proper access controls, according to Kovrr.
• 63% of the 600 companies surveyed said they had no AI governance policies whatsoever, according to Kovrr.

Key questions

Q: What should organisations do when AI adoption outpaces governance?

A: Slow the rollout of new use cases until the identity model is clear, the permissions are bounded, and the lifecycle process is in place.

Q: Why do AI-related incidents often expose access-control weaknesses?

A: Because many AI failures are not model-only problems.

Q: What are the signs that AI governance controls are not keeping pace with adoption?

A: Common warning signs include unclear ownership for AI use cases, inconsistent approval processes, limited visibility into where sensitive data enters models, and weak evidence for audits or assessments.

Practitioner guidance

• Build an AI inventory and ownership model Record every AI system, copilot, model, and agent in scope, then assign a business owner, technical owner, and review cadence for each one.
• Bind AI access to entitlement governance Limit which users, service accounts, and automation paths can invoke AI tools, and align permissions with data sensitivity and role boundaries.
• Classify AI use cases by risk type Separate cybersecurity, privacy, operational, bias, and regulatory risks so controls are targeted instead of generic across every use case.

Bottom line: AI risk grows fastest when deployment outruns inventory, ownership, and access controls.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →