Topic starter
18/08/2026 2:48 pm
TL;DR: Responsible AI is increasingly a business requirement, but most organisations still lack the enforcement layer needed to govern AI agents continuously across data, access, and decision chains, according to BigID. The gap is not policy language but operational control: data visibility, identity governance, and real-time observability must work together for AI governance to hold.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “What Is Responsible AI, and Why Most Organizations Are Missing the Infrastructure to Do It”.
Key questions
Q: How should organisations evaluate AI agents that act across multiple systems?
A: They should evaluate the full trajectory, not just the final response.
Q: Why do responsible AI programmes fail in production?
A: They usually fail because controls stop at documentation.
Q: What are the signs that AI agent governance is too weak for production use?
A: Weak governance usually shows up as poor visibility into what agents can access, incomplete audit trails, and inconsistent oversight across security, legal, compliance, and operations teams.
Practitioner guidance
- Implement runtime data discovery and classification Continuously identify sensitive data across cloud, on-premises and hybrid environments so AI systems only operate on data that has been catalogued and governed.
- Apply least-privilege access to AI agents Treat AI agents as governed non-human actors and constrain their entitlements to the minimum data and actions required for each task.
- Require end-to-end lineage for AI decisions Record which data sources informed each model or agent decision so teams can reconstruct what happened, when it happened and why.
Bottom line: Responsible AI fails when it is treated as policy text instead of runtime enforcement across data, access and decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:30 pm
Responsible AI has become a runtime governance problem, not a policy problem. The article’s central insight is that policy language cannot enforce itself when AI systems act continuously across enterprise data and workflows. That is especially true for agentic AI, where actions occur faster than review cycles and governance committees can respond. For practitioners, the implication is clear: responsible AI must be implemented as control infrastructure, not policy theatre.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should responsible AI be managed by AI teams or IAM teams?
A: It has to be shared. AI teams define how systems behave, while IAM and data governance teams control what those systems can access and how that access is logged. When AI agents become operational actors, identity governance becomes part of responsible AI, not a separate concern.
👉 Read our full editorial: Responsible AI now depends on data control planes, not policies