Topic starter
27/06/2026 1:29 pm
TL;DR: Manual, inconsistent governance checks do not scale as AI portfolios grow, according to Collibra, and Gartner predicts that by 2027, 60% of organisations will fail to realise expected AI value because governance frameworks are fragmented. The deeper issue is that governance models built for periodic review break when policy enforcement must run continuously.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “Control Tower: OOTB controls to govern AI by exception”.
By the numbers:
- Gartner predicts that by 2027, 60% of organizations will fail to realize the expected value of their AI use cases because governance frameworks are fragmented.
Key questions
Q: How should security teams govern AI agents without creating a manual review bottleneck?
A: Use policy, automation, and class-based controls so agents are provisioned through deployment pipelines, not ticket queues.
Q: Why do manual governance checks fail as AI portfolios grow?
A: Manual checks fail because they cannot keep pace with the number of assets, versions, data sources, and policy obligations that appear as AI use expands.
Q: How should security teams implement exception-based governance for AI systems?
A: Start by encoding each recurring governance requirement as a control with a clear failure condition, a run schedule, and an assigned owner.
Practitioner guidance
- Define exception thresholds for AI governance controls Set explicit failure conditions for model status, training data quality, ownership and policy compliance so automated controls know exactly when to alert.
- Anchor controls in governed metadata Use lineage, ownership and asset relationships as the source of truth for every governance check, rather than duplicating logic in separate spreadsheets or tickets.
- Replace manual review queues with scheduled checks Move recurring validations onto a run schedule so teams investigate only the assets that fall out of policy, instead of rechecking everything by hand.
Bottom line: Manual AI governance breaks down when review cycles cannot keep pace with the growth and change rate of AI portfolios.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:51 pm
Continuous AI governance exposes the weakness of periodic review models: manual controls were designed for environments where policy violations could be checked after the fact, on a human schedule. That assumption breaks when AI assets, models and training data change continuously. The implication is that governance quality now depends on issuance-time and runtime enforcement, not on intermittent certification cycles.
A question worth separating out:
Q: How do organisations know whether AI governance is actually working?
A: AI governance is working when teams can prove that data access, identity permissions, and runtime controls line up with policy in practice. A useful test is whether the organisation can answer who accessed what, through which identity, and whether any out-of-policy movement was blocked or detected in time.
👉 Read our full editorial: AI governance by exception exposes the limits of manual controls