Topic starter
25/10/2026 11:08 am
TL;DR: Only 5% of organisations say they have a mature AI governance program, and the gap is widening as shadow AI, sensitive-data exposure and weak ownership make policy decisions inconsistent, according to Safe Security. Governance is now a control system, not a document, and the real test is whether teams can govern AI use with current inventory, ownership and risk signals.
Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “Governing AI at Gartner UK: Only 5% Say They’re Ready. Here’s Where to Start.”.
By the numbers:
- Only 5% of organizations say they have a mature AI governance program.
Key questions
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem.
Q: What breaks when an AI inventory is only updated manually?
A: Manual inventories drift almost immediately in fast-moving AI estates.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define ownership for every AI integration Assign a named owner for each AI use case, including who approves the integration, who monitors it, and who is accountable when the data or behaviour changes.
- Build a living AI inventory Track every AI asset that touches critical systems or sensitive data, and update the inventory as soon as discovery changes the known estate.
- Document sensitive-data access decisions Record whether users with PII or PHI access are blocked, restricted to approved systems, or governed by additional controls such as an enterprise browser.
Bottom line: The article frames AI governance as an operational control problem, with inventory, ownership and data-handling decisions doing the real work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →