Enterprise AI Governance: Why Approving an AI Tool Is Not the Same as Controlling AI Use
AI adoption inside companies is moving faster than the controls designed to govern it.
Many organizations believe they have an AI strategy because they have approved an enterprise assistant, published an acceptable-use policy, or blocked a handful of public chatbots. Those steps matter, but they do not answer the operational question that determines whether AI is actually under control:
Can the company see who is using AI, what data is reaching it, and what the AI is allowed to do?
That distinction matters as AI moves from standalone chatbots into browser extensions, SaaS products, developer tools, APIs and autonomous agents.
NIST’s Generative AI Profile (AI 600-1) treats AI risk as a lifecycle problem that must be governed, mapped, measured and managed across design, deployment and use. The enterprise question is therefore no longer simply “Which model did we approve?” but “What AI interactions are happening across the business?”
“Approving an AI tool is not the same as controlling AI use.”
Dmitry Kalenyuk
AI Security Engineering Lead, CodeIT
The adoption problem is becoming an identity problem
The latest data shows progress, but not control.
Netskope’s Cloud and Threat Report 2026 found that the share of GenAI users using personal AI apps fell from 78% to 47%, while use of organization-managed accounts rose from 25% to 62%. But the share of users switching between personal and enterprise accounts more than doubled, from 4% to 9%.
That overlap is the important part. A company can provide an approved AI tool and still have employees move between managed and unmanaged environments depending on convenience, features or workflow. Approval reduces one source of risk; it does not automatically eliminate shadow AI.
A later Netskope AI Report (July 2026) cuts the same population differently: 56% of AI users used only organization-managed applications, 30% used only personal applications, and 14% used both. In other words, 44% still used personal AI in at least some capacity, even after managed adoption expanded.
Akamai’s 2026 research, built on LayerX data, points the same way: 47.11% of enterprise AI conversations in its analysis took place through personal identities rather than corporate-managed accounts.
These numbers should not be read as measuring exactly the same thing. Netskope reports the share of users, Akamai the share of conversations, and the two Netskope reports use different definitions. But all of them point to the same visibility problem.
Evidence note. Telemetry-based vendor studies are directional evidence, not a census of all enterprises. Netskope and Akamai analyze their own customer environments, and Akamai’s report uses LayerX data. This is why the vendor findings in this article are paired with NIST and OWASP guidance.
Three gaps explain why enterprise AI governance breaks down
A simple diagnostic. AI control fails in three layers: identity gap → data gap → action gap. Approving a tool may close part of the application gap while leaving all three operational gaps open.
1. The identity gap
Employees may use personal AI accounts, connect third-party AI apps through OAuth, or install AI browser extensions outside normal procurement. Even where the application itself is approved, the identity used to access it may not be managed. This is why “we bought an enterprise AI license” is not the same as “we control AI use.”
2. The data gap
AI becomes useful when employees give it context: documents, emails, code, customer information, contracts, spreadsheets and internal knowledge. If the organization cannot determine the sensitivity of that information before it enters an AI workflow, it is relying on employee judgment at the exact moment when speed and convenience are the strongest incentives.
The question is therefore not only whether an AI service is safe. It is whether a particular piece of data is appropriate for that service, account and use case.
3. The action gap
Agents raise the stakes because they can do more than generate text. They can call APIs, search storage, read email, modify workflows, write code and trigger business actions.
OWASP’s Top 10 for Agentic Applications formalizes risks such as agent goal hijacking, tool misuse, identity and privilege abuse, and memory poisoning. Once AI can act, access control has to cover both what the agent can read and what it can execute. For internal assistants and agents that are built in-house, an LLM security audit tests exactly this: retrieval permissions, tool scopes and integration access.
IBM’s 2026 Cost of a Data Breach research reinforces the point. More than 20% of organizations reported a breach targeting AI models or applications; among organizations affected by AI-related breaches, 92% lacked proper AI access controls.
IBM’s 2025 report also found that breaches at organizations with high levels of shadow AI cost an average of $670,000 more.
Bad scenario: AI everywhere, control nowhere
Imagine a 1,000-person company that has approved one enterprise AI assistant.
A sales employee uses a personal chatbot to analyze part of a CRM export because it gives a better answer. A recruiter authorizes a CV summarizer through OAuth. A developer installs an AI coding extension with broad access to the IDE. A manager connects an assistant to cloud storage. Another team experiments with an agent that can read email and update project-management tasks.
Security monitors the official AI platform. Almost everything else happens outside that view.
No employee has to be malicious. Each person is simply choosing the fastest way to get work done. But the company now has several uncontrolled paths involving sensitive data, personal identities, third-party permissions and agent actions. When something goes wrong, reconstructing who shared what, and what the AI did next, may be difficult or impossible.
Not sure which of these paths exist in your company?
Enterprise AI governance best practices: govern the interaction, not just the tool
The goal should not be to block AI. It should be to make the managed path easier, safer and more useful than the unmanaged one.
A practical enterprise AI governance framework can start with six controls:
1. Discover. Build an inventory from more than procurement records. Review OAuth grants to third-party applications in Google Workspace or Microsoft Entra ID. Inventory browser extensions through Chrome Enterprise, MDM or endpoint-security tooling. Review identity-provider sign-in and application-consent logs for AI services. Include AI functionality embedded inside existing SaaS products, not just standalone chatbots. For detection methods and their blind spots, see how to detect shadow AI.
2. Use managed identity. Require SSO for approved AI services where possible. Restrict high-risk OAuth scopes, review consent grants, enforce MFA and conditional access, and avoid shared credentials for agents. A corporate AI account creates an identity that can be governed and audited.
3. Classify the data. Define which categories of information may be used with which AI services. Public marketing copy and regulated customer data should not follow the same policy. Apply DLP or content controls to prompts, uploads and copy/paste flows where the business risk justifies it.
4. Enforce policy at the interaction layer. Static allowlists are not enough when the same application can be used through both personal and corporate accounts. Controls should consider user identity, account type, data sensitivity and action context.
5. Apply least privilege to agents. Give agents only the tools, data sources and scopes required for the task. Use short-lived or scoped credentials where possible. Require human approval for high-impact actions such as sending external email, changing production systems, modifying permissions or executing financial transactions.
6. Monitor and review. Centralize logs for AI applications and agent tool calls where technically and legally appropriate. Review new permissions, unusual data flows and changes in agent behavior. AI governance is not a one-time procurement decision; it is an operating process.
Governance and adoption are not opposites
The Cloud Security Alliance and Google Cloud found, in their 2025 State of AI Security and Governance report, that organizations with formal AI governance were twice as likely to adopt agentic AI and three times as likely to train employees on AI security tools.
That is an association, not proof of causation. More mature or better-funded companies may simply be more likely to invest in both governance and advanced AI. The careful conclusion is that stronger governance is associated with more advanced AI adoption, not that one automatically creates the other.
The failure side of the picture is consistent with this. Studies of enterprise AI failure repeatedly name inadequate risk controls and data governance gaps among the reasons projects stall. Companies that are still shaping their roadmap can build these controls in from the start, and an AI readiness assessment is the point where data ownership, security review capacity and escalation paths get settled before anything reaches production.
The bigger lesson is practical: companies do not regain control by approving one model or writing one policy. They regain it by closing three gaps continuously:
- Know the identity using AI.
- Know the data reaching AI.
- Know the actions AI can take.
Then enforce those boundaries at the point where the interaction happens.
In an enterprise, the most dangerous AI is not necessarily the model with the worst security. It is the AI workflow the company does not know exists.
FAQ
Enterprise AI governance is the set of policies, controls and processes that determine who can use AI, which data may reach it, and what AI systems are allowed to do. It covers AI identity management, data classification, policy enforcement, agent permissions and ongoing monitoring, not only the choice of approved models.
No. An approved tool closes only part of the application gap. Employees can still reach it through personal accounts, connect other AI apps through OAuth, or move data to unmanaged tools. Control requires visibility into the identity, the data and the actions involved in each AI interaction.
A practical framework covers six controls: AI discovery beyond procurement records, managed identity, data classification, policy enforcement at the interaction layer, least privilege for agents, and continuous monitoring and review.
Give each agent only the tools, data sources and scopes its task requires, use short-lived or scoped credentials, avoid shared credentials, log tool calls, and require human approval for high-impact actions such as sending external email, changing production systems or modifying permissions.
The available evidence suggests not. A Cloud Security Alliance and Google Cloud survey found organizations with formal governance were twice as likely to adopt agentic AI. That is an association rather than proof of causation, but it does not support the idea that governance and adoption are opposites.
Need to See Which AI Your Company Actually Controls?
CodeIT’s Secure AI Usage Audit maps which AI is used across your organization, through which identities, with what data, and which actions it can take, then shows where current controls go blind.
Request a Secure AI Usage Audit →
Building or running your own AI systems? See the LLM security audit. Still planning your AI program? Start with an AI readiness assessment.