Topic starter
11/06/2026 11:13 pm
TL;DR: A survey of more than 5,000 workers and security professionals finds that 73% of employees are encouraged to use AI while 37% say they do not always follow policy, and 27% have worked on unapproved AI applications, according to 1Password. The real problem is not AI adoption itself but the absence of enforceable access controls and inventory discipline.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “The enterprise AI crisis: Unsanctioned tools and unenforced policies”.
By the numbers:
- 73% of employees are encouraged to use AI for some part of their workloads.
- 37% of employees admit they do not always follow their company’s AI policies.
- 27% of employees have worked on AI-based applications that their employers did not approve.
Key questions
Q: What should IAM teams do when employees keep using unsanctioned AI tools?
A: Provide a sanctioned alternative, then enforce access policy through identity and browser controls rather than relying on awareness campaigns alone.
Q: Why does shadow AI create more risk when organisations try to prohibit it?
A: Prohibition often shifts usage underground, which reduces visibility and weakens logging, data control, and accountability.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Inventory AI tools continuously Build a current inventory of approved and unapproved AI tools, and review it on a recurring cadence so governance teams know what is actually in use.
- Tie AI policy to access decisions Use authentication, device posture, and application controls to block non-compliant AI use at the point of access instead of relying on policy acknowledgements.
- Make sanctioned AI the easiest path Provide a clear approved app hub and guidance so users have a convenient route to sanctioned tools rather than seeking personal accounts or shadow AI.
Bottom line: AI governance breaks when policy says one thing and access controls allow another.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:47 am
AI governance is becoming an access enforcement problem, not a policy publication problem. The report shows that employee approval to use AI does not equal controlled use of AI. When 37% admit they do not always follow policy, the limiting factor is not awareness alone but the absence of controls that can stop non-compliant access in real time. The practitioner conclusion is that governance has to move from policy statements to enforceable access decisions.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise AI inventory discovery or policy writing first?
A: Inventory discovery should come first because you cannot govern what you cannot see. A policy without a reliable picture of which AI tools are in use will miss shadow AI, unmanaged access paths, and the endpoints that need enforcement most.
👉 Read our full editorial: Access-trust gaps in AI governance are widening fast
This post was modified 1 day ago by NHI Mgmt Group