AI service sprawl: what it means for governance and control teams

TL;DR: More than 90% of employees are using AI in some capacity, organizations now run 400 to 700 unique AI services, and AI usage has grown 25% to 250% in just three months, according to Singul AI, showing governance is struggling to keep pace. The practical issue is not adoption itself but uncontrolled identity, data, and policy spread across sanctioned and shadow AI.

Editorial analysis by NHI Mgmt Group, based on content published by Singul AI: “The Enterprise AI Surge is Real”.

By the numbers:

• More than 90% of employees are using AI in some capacity.
• Organizations are adding 8 to 50 new AI services per week, averaging 31 per week.
• Nearly 50% of AI services in use are classified as high risk based on the vendor's AI Trust Feed scoring.

Key questions

Q: How should organisations govern AI usage when employees use unapproved tools?

A: Organisations should start with visibility, not enforcement.

Q: Why do AI-accelerated platforms increase identity and access risk?

A: They increase risk because the platform concentrates sensitive data, compute, and decision-making in one place.

Q: What do security teams get wrong about Shadow AI?

A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem.

Practitioner guidance

• Inventory every AI service and embedded AI feature Create a continuously updated inventory of public AI tools, homegrown LLM apps, embedded SaaS AI, and endpoint AI agents, then assign owners and data classifications.
• Enforce approved-path usage for enterprise AI Route employees toward sanctioned AI services with usable onboarding, rather than leaving them to personal subscriptions or shadow AI workarounds.
• Review AI permissions at the point of use Check what data each AI service can access, what accounts it uses, and whether the permissions still match the approved business need.

Bottom line: Enterprise AI is now a governance and access problem because adoption is spreading faster than onboarding, classification, and approval processes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →