Topic starter
11/11/2026 6:00 pm
TL;DR: AI governance fails when approved-tool lists diverge from what devices and browsers actually use, Lansweeper reports. Practitioners need inventory that reflects live connections, or policy enforcement and audit evidence will be built on incomplete data.
Editorial analysis by NHI Mgmt Group, based on content published by Lansweeper: “Your AI Governance Is Built on Guesses”.
By the numbers:
- 69% of organisations suspect or have evidence that employees are using prohibited public GenAI tools.
- Lansweeper says its AI usage tracking captures external AI services over a 14-day window tied to individual assets.
Key questions
Q: Why do approved AI policies fail in practice?
A: Approved AI policies fail when they are written as static rules but not enforced against real model use, data flow and tool access.
Q: What is the difference between AI inventory and AI usage tracking?
A: AI inventory is the catalogue of AI systems, models, agents and related services in use, with owners, purposes and risk context.
Q: How can organisations detect and contain shadow AI agent access?
A: Organisations should correlate network activity, system logs, and endpoint evidence to find access that never appeared in identity telemetry.
Practitioner guidance
- Define AI inventory as a runtime control Require your AI inventory to reflect observed usage, not just approved tools, and include browser activity, endpoint software, and unmanaged connections in scope.
- Separate approval from detection workflows Maintain one register for sanctioned tools and a second operational view for discovered AI services so gaps are visible instead of hidden inside a single approved list.
- Retain evidence for audit and incident response Keep time-bound records of which devices connected to which AI services, how often they connected, and what data paths were involved so auditors can verify governance claims.
Bottom line: AI governance fails when discovery is limited to approved assets and cannot see the tools people actually use.
Glossary terms: Shadow AI, AI Usage Tracking, AI Inventory, Network Discovery
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
AI governance debt is now an inventory problem before it is a policy problem. Organisations can write acceptable-use rules and still remain blind to the tools employees actually run. When the inventory is incomplete, the control framework is managing intention rather than reality, and that gap widens as AI becomes embedded in browsers, endpoints, and developer workflows.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do if they discover shadow AI in the business?
A: Teams should first identify who owns the tool, what data it touches, and which identities it uses. Then they should either bring it under policy and lifecycle control or remove access to enterprise data until governance is in place. Discovery without containment simply confirms the scale of the gap.
👉 Read our full editorial: AI governance fails when discovery misses shadow AI tools