AI creates sustainability risk because training and running models consumes electricity, water, and specialised hardware. Those demands can offset some environmental gains if workloads are inefficient or concentrated in resource constrained regions. The issue is not AI itself, but whether organisations measure and manage its footprint with the same discipline they apply to other infrastructure.
Why This Matters for Security Teams
AI sustainability risk is not just an environmental issue. It is an operational and governance issue because compute demand, storage growth, and model refresh cycles all translate into real infrastructure costs and resource strain. Security teams are increasingly involved because the same controls that reduce waste also improve resilience: tighter asset inventory, better access control, stronger change management, and clearer accountability for workloads. That is why NIST’s Cybersecurity Framework 2.0 is relevant here, even though the topic is sustainability.
The mistake many organisations make is treating AI efficiency as a model-tuning exercise only. In practice, the footprint is often driven by duplicated pipelines, uncontrolled experimentation, unnecessary re-training, and data retention that outlives its business value. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now shows how quickly unmanaged machine activity becomes a governance problem, and that pattern applies to AI systems as well. In practice, many security teams encounter sustainability waste only after cloud spend spikes and platform owners begin asking why “green AI” projects are consuming more resources than they save.
How It Works in Practice
Reducing AI sustainability risk starts with treating AI workloads as governed assets, not experimental exceptions. Current guidance suggests measuring the full lifecycle footprint: training, fine-tuning, retrieval, inference, logging, retention, and model retirement. That means security, platform, and sustainability teams need a shared view of where compute is consumed and which workloads are business-critical.
At the control level, organisations should pair inventory with policy enforcement. Use the NIST SP 800-53 Rev. 5 Security and Privacy Controls to anchor asset management, configuration management, and system monitoring. Then apply that discipline to AI systems by defining when models may run, what data they may access, and how long outputs and logs are retained. NHIMG’s Top 10 NHI Issues is useful here because the same control failures that expose non-human identities often appear in AI pipelines: over-permissioned service accounts, scattered secrets, and duplicated tooling.
- Set workload-level baselines for energy, storage, and data movement.
- Require approval for large retraining jobs and uncontrolled experimentation.
- Minimise log retention and duplicate artifact storage.
- Track model version sprawl and decommission unused deployments.
- Align AI procurement with lifecycle impact, not just model accuracy.
Where organisations mature quickly, they link sustainability metrics to secure architecture decisions, such as regional placement, quota enforcement, and least-privilege service access. These controls tend to break down when AI teams can spin up new environments faster than governance can inventory them, because hidden workloads make footprint measurement incomplete.
Common Variations and Edge Cases
Tighter sustainability controls often increase operational overhead, requiring organisations to balance emissions reduction against delivery speed and innovation capacity. That tradeoff is especially visible in regulated environments, where auditability matters as much as efficiency.
Best practice is evolving for shared and multi-tenant AI platforms. In some cases, the most sustainable option is not the smallest model, but the one that avoids repeated reprocessing or excessive human review. In others, model caching and retrieval-augmented patterns reduce waste more effectively than frequent fine-tuning. There is no universal standard for this yet, so teams should measure actual workload behaviour rather than assume that a “smaller” model is always greener.
NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks is a useful reminder that machine-driven systems tend to accumulate hidden dependencies over time. For AI, those dependencies can include redundant embeddings, long-lived artifacts, and shadow pipelines that persist after the business case changes. Organisations that ignore this usually discover the sustainability cost only after usage patterns have already become entrenched.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC | AI sustainability depends on clear governance and operational context for workloads. |
| NIST AI RMF | GOVERN | Sustainability risk is a governance concern tied to responsible AI lifecycle management. |
| NIST SP 800-53 Rev 5 | CM-2 | Configuration baselines reduce unnecessary AI sprawl, duplication, and waste. |
| OWASP Non-Human Identity Top 10 | NHI-08 | AI pipelines often inherit non-human identity sprawl that increases hidden operational cost. |
| CSA MAESTRO | GOV-01 | Agentic and automated AI operations need governance over lifecycle and resource usage. |
Assign accountability for AI lifecycle impacts and require measurement of resource use alongside performance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
