Notifications
Clear all
Topic starter
21/08/2026 4:55 pm
TL;DR: AI governance must extend beyond policy statements into lifecycle controls for transparency, accountability, fairness, security, safety, robustness, explainability, and data governance, especially as AI begins affecting rights, privacy, and regulated decisions, according to BigID. The practical issue is that governance only works when model behaviour, training data, and accountability structures are all controlled end to end.
NHIMG editorial — based on content published by BigID: AI governance principles and the foundations of responsible AI
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should organisations implement AI governance examples in production systems?
A: Start by converting policy into named controls, owners, and evidence sources.
Q: Why do electronic signatures need identity and access controls, not just cryptography?
A: Cryptography confirms that a signature can be verified, but it does not by itself prove the right person signed it or that the signer was properly authorised.
Q: What do organisations get wrong about explainable AI in security operations?
A: They often treat explainability as a presentation layer instead of a control requirement.
Practitioner guidance
- Define lifecycle control owners Assign a named owner for design, data sourcing, training, validation, deployment, monitoring, and retirement so accountability is traceable at every stage.
- Harden AI data access boundaries Classify training data, prompt stores, and model outputs, then apply least privilege and audit logging to each pathway that can influence model behaviour.
- Require explainability evidence Capture decision traces, input lineage, and override logic so audits and incident reviews can reconstruct why the model produced a result.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- Practical examples of how to structure transparency, accountability, and explainability across an AI programme.
- The article's framing of ethical AI versus responsible AI, including how the two concepts diverge in practice.
- Specific discussion of AI governance risks such as bias, privacy exposure, model drift, and misuse.
- The source's recommendations for implementing governance with data discovery, classification, and policy enforcement.
👉 Read BigID's overview of AI governance principles and responsible AI controls →
AI governance principles: where do current controls still fall short?
Explore further
21/08/2026 5:12 pm
AI governance fails when it stops at policy and never reaches control enforcement. The article frames governance as a set of principles, but principles only matter when they are translated into lifecycle checks, access controls, logging, and accountability. For security and identity teams, this is the same failure pattern seen in weak IAM programmes where policy exists but access is not actually constrained. The practical conclusion is simple: governance must be measurable or it is not governance.
A question worth separating out:
Q: How do organisations know whether AI governance is actually working?
A: AI governance is working when teams can prove that data access, identity permissions, and runtime controls line up with policy in practice. A useful test is whether the organisation can answer who accessed what, through which identity, and whether any out-of-policy movement was blocked or detected in time.
👉 Read our full editorial: AI governance principles expose the gap between policy and control
