Enterprise AI adoption: where privacy and governance controls break down

TL;DR: 88% of businesses now use AI in at least one function, yet enterprise adoption is being slowed by privacy, governance, data quality and access-control gaps across LLMs, agents and RAG pipelines, according to Protecto. The real challenge is shifting control from model experimentation to governed data access, because AI systems expand the blast radius of every unmanaged dataset and connector.

Editorial analysis by NHI Mgmt Group, based on content published by Protecto: “Top Enterprise AI Adoption Challenges”.

By the numbers:

• 88% of businesses use AI in at least one business function.
• Poor data quality can result in organizations incurring average losses of $12.9 million every year.

Key questions

Q: What breaks when AI systems can access data without context-aware controls?

A: What breaks is the governance model.

Q: When should organisations prioritise AI identity governance over new AI deployments?

A: They should prioritise it before broad deployment, because the first wave of AI usage often creates the largest blind spots.

Q: What are the signs that an AI project has become shadow AI?

A: The main signs are orphaned agents, unmanaged MCP connections, and AI logic appearing in branches or services without a clear owner or approved governance path.

Practitioner guidance

• Define AI data classification rules Specify which data types can enter prompts, vector stores and model training, then apply masking or blocking before ingestion rather than after output review.
• Register every AI use case and connector Build a central inventory of copilots, LLMs, agents, RAG pipelines and third-party integrations so ownership, approval status and data access are visible.
• Scope agent access by task and context Require runtime decisions to consider business purpose, data sensitivity and workflow step, so an agent does not inherit broad standing access.

Bottom line: Enterprise AI adoption is constrained less by model capability than by weak control over data, connectors and runtime access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →