AI governance: where do visibility and ownership break down?

TL;DR: AI governance fails when organisations stop at policy, because usable oversight depends on discovering the full AI and data footprint, assigning documented ownership, and operationalising controls across data-centric and system-centric risk, according to Kovrr's report. The governance gap is structural, not procedural: without shared accountability and continuous inventory, AI risk remains invisible until it becomes hard to defend.

Editorial analysis by NHI Mgmt Group, based on content published by Kovrr: “How to Build a Durable AI Governance Programme: A 3-Pillar Framework”.

By the numbers:

• Only 36% of organisations have visibility into where their data is processed, trained, or inferred.
• 57% of employees have used AI tools for work without informing their manager.

Key questions

Q: What fails when AI governance stops at policy and audit documentation?

A: Policy-only governance can prove that a model was assessed, but it cannot prevent unsafe behaviour once the model is live.

Q: Why does AI risk increase when ownership is shared but undocumented?

A: Shared ownership without documented mandates creates gaps, duplicates, and confusion about who is responsible for approvals, quality, and oversight.

Q: What are the signs that AI governance is not operational yet?

A: Common signs include unclear ownership, undocumented access paths, missing logs for tool use, and no defined offboarding process for AI permissions.

Practitioner guidance

• Implement a live AI inventory Track sanctioned, shadow, and blocked AI systems in one registry, and update it as tools are adopted, embedded, or retired.
• Document ownership and decision rights Assign named business and technical owners for each AI system, then record who approves data use, model use, and exceptions.
• Separate data and system control reviews Review data lineage, authorisation, and classification separately from model behaviour, policy adherence, and monitoring thresholds.

Bottom line: AI governance breaks down when policy exists without discovery, ownership, and continuous control.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →