Your gen AI governance framework is already behind. Here’s how to fix it.

Intro

Somewhere in your policy library is a document approved in 2023 or 2024. It lists the approved tools, tells staff not to paste confidential data into public chatbots, names a review board, and requires a person to check anything AI produces before it leaves the building. It was sensible. For its moment, it was even ahead.

The moment moved. The AI your people use most is no longer a destination they visit. It is a feature that arrived inside the email client, the CRM, the service desk and the code editor, often switched on by the vendor. Some of it no longer stops at drafting: it books, files, updates, sends and calls other systems. And the model behind a feature can be upgraded, swapped or retired on the vendor's schedule, which is rarely yours.

A framework built on an approved-tool list and a human reviewer assumes three things that are no longer reliably true: that you know where AI is running, that a person sees the output before it matters, and that the system you approved is the one still running. None of this makes the original framework wrong. It makes it incomplete, which in governance is the more expensive word.

Your AI policy was written for a tool. The AI now arrives as a feature, acts as an agent and changes as a service.

Executive summary

The gap shows up in breach data before it shows up in board packs. IBM's 2025 Cost of a Data Breach report found that 13 percent of organizations had a breach involving AI models or applications, and 97 percent of those lacked proper AI access controls. Among breached organizations, 63 percent had no AI governance policy or were still writing one, and organizations with high levels of shadow AI paid about 670,000 dollars more per breach. A policy that lives on the intranet but not in the access controls is a statement of intent.

Use has also outrun the approved list. A UK survey published this month found that 48 percent of managers and executives know or suspect staff use AI tools that have not been approved, and as many said managers have limited visibility into how those tools are used. Nobody approved that behavior, and nobody is reviewing its output.

Then come the rules. The EU AI Act's AI literacy duty has applied since February 2025 and its obligations for general-purpose models since August 2025, while EU lawmakers negotiate a proposed delay to its high-risk obligations. In the United States, Illinois began regulating AI in employment decisions on January 1, 2026. A framework that cannot show where AI is used, who approved it and what it touches will struggle to answer any of them.

Fixing this does not mean starting over. It means moving governance out of documents and into the places AI actually runs: the inventory, the contract, the identity system, the test suite and the change calendar.

Core areas to watch

1. 1

   The AI moved into software you already own

   FocusGartner · Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5% in 2025 · August 26, 2025

   Summary Gartner expects 40 percent of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. That changes the governance problem. When AI was a separate product, an approved-tool list could hold the line at procurement. When it arrives as a feature inside platforms already licensed, often enabled in a routine release, the procurement gate never opens. The question stops being "which AI tools have we approved?" and becomes "which of our systems now contain AI, what data can it reach, and who decided to turn it on?"

   Key takeaways

   • Inventory AI by capability and data access across your existing software, not only the products bought as AI.
   • Add AI terms to renewals: notice before AI features are enabled, what your data is used for, and notice when the underlying model changes.
   • Give each enabled AI feature an accountable owner, as each system of record already has.

   The approved-tool list is now most of your software estate.

2. 2

   People brought their own, and banning it did not work

   FocusMicrosoft · Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work · May 8, 2024

   Summary Microsoft and LinkedIn's 2024 Work Trend Index found that 75 percent of knowledge workers used generative AI at work and that 78 percent of those users brought their own tools. Leaders, meanwhile, worried about measuring the gains and about lacking a plan. Two years on, the pattern has not reversed. Prohibition without a sanctioned alternative moves use out of sight rather than out of the organization, the worst of both outcomes: the risk stays and the visibility leaves.

   Key takeaways

   • Provide a sanctioned path that is genuinely easier than the workaround: approved tools, clear data rules and a fast way to request a new one.
   • Say which data may go into which kind of tool in words staff can apply at the keyboard, not in a policy appendix.
   • Measure unapproved use through network and expense signals, and treat it as demand to serve, not only behavior to stop.

   A ban without an alternative does not stop AI use. It stops you seeing it.

3. 3

   From answers to actions

   FocusOWASP · OWASP Top 10 for LLM Applications 2025 · November 17, 2024

   Summary OWASP's 2025 list keeps prompt injection at the top and expands "excessive agency", an AI system given more functions, permissions or autonomy than its task needs, because agentic designs give models more room to act. Most 2023 frameworks rely on a person reviewing output before it matters. That control assumes the AI produces text for a person. When it calls tools, updates records, sends messages or triggers payments, there may be nothing to review until after the action. Instructions hidden in an email or a web page can steer it, and its permissions decide how far the damage reaches.

   Key takeaways

   • Give each AI feature and agent its own identity, with the least privilege its task requires and credentials that expire.
   • Put human approval at the point of consequence (sending, paying, deleting, changing access), not at the point of drafting.
   • Log every action an AI system takes, with the instruction and data behind it, and keep a tested way to switch it off.

   Human review was a control for drafts. Agents need controls for actions.

4. 4

   The model you approved may not be the one running

   FocusNIST · Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile · July 26, 2024

   Summary NIST's generative AI profile treats governance as a life cycle rather than an approval: it calls for ongoing monitoring, periodic review and documented change management as systems, and the contexts they serve, change. That matters because vendors update, replace and retire models on their own schedules, and a feature tested at procurement can behave differently a quarter later. A one-time approval certifies a version that may no longer exist. The fix comes from software engineering: treat a model change as a release, with a test that must pass before it reaches users.

   Key takeaways

   • Keep an evaluation set for each material use: real examples, expected answers and known failures, owned by the business.
   • Require notice of model changes in contracts, and rerun the evaluation before a new model reaches production work.
   • Review high-impact uses on a schedule, and whenever the data, the users or the decision they support changes.

   Approval is a date. Assurance is a schedule.

Boardroom implications

Boards do not need to read prompts. They need evidence that governance reaches the places where AI now operates. Five questions test whether the framework has kept up:

1. Inventory. Can we list every system where AI is switched on, what data it can reach and who owns it, including features our vendors enabled?
2. Authority. Which AI systems can take actions rather than make suggestions, and what is the most consequential thing each one may do without a person?
3. Change. How do we learn that a vendor changed the model behind a feature we rely on, and what test runs before that change reaches customers or staff?
4. Exposure. If an AI feature leaked data or made a wrong decision today, could we reconstruct what it did, and what would we have to disclose, and to whom?
5. Adoption. Do staff have an approved way to use AI that is easier than the workaround, and do they know which data may go where?

Case study spotlight

The wrap-up

Gen AI governance fell behind for a good reason: it was written for the AI that existed, and the AI kept shipping. The organizations catching up are not writing longer policies. They are wiring the policy into the places where AI decisions actually happen: the system inventory, the vendor contract, the identity platform, the release process and the training people actually take.

A framework is current when it can answer three questions on an ordinary Tuesday: where AI is running, what it is allowed to do, and what changed since last time. If yours cannot, it is not wrong. It is simply describing an organization you no longer are.

Call to action

1. Inventory. List every system with AI switched on, including features your vendors enabled, with its owner and the data it can reach.
2. Contract. Add notice of AI enablement, data use and model changes to every renewal from this quarter on.
3. Constrain. Give AI features and agents their own identities, least privilege, and approval at the point of consequence.
4. Test. Build an evaluation set for each material use, and rerun it before any model change reaches production.
5. Teach. Replace the "don't paste confidential data" memo with role-based guidance on what data may go where, and a sanctioned tool that is easier than the workaround.

Governance is current when it can say where AI runs, what it may do, and what changed since last time.