Closing The AI Governance Gap Is Urgent: Your Usage Data Is The Bridge
Arti Raman is the founder and CEO of Portal26. She is an expert on managing and mitigating risk for enterprise GenAI and data.
gettyAlthough it may be an exaggeration to say AI governance has become of biblical importance, when was the last time the leader of one of the world’s major religions felt the need to comment on the subject?
I am, of course, talking about the pope’s recent warning about where AI is heading and the need for humans to remain in control. It’s a vital debate, but there’s no doubt that AI governance is becoming much harder. Indeed, many organizations are already reaching the limits of their ability to ensure AI aligns with internal and external requirements.
Rapidly growing model complexity and the greater autonomy being given to agents are significantly adding to the governance challenge. News from the AI frontier that OpenAI has scrapped the “rollout of a new model over safety concerns” should inform the thinking of every organizational leader.
But, for the average enterprise and their governance teams, what’s really at stake, and where should they focus their efforts?
On a fundamental level, AI governance depends on having a reliable understanding of how AI is being used across an organization. On paper, this sounds like a relatively straightforward objective. A leader should be able to ask, “Where and how are we using these systems?” and get a reliable answer.
A big part of the challenge—and this is going to become a much bigger problem in the short to medium term—is that few organizations have a single, reliable view of all the ways AI is being used. Implementation has outpaced governance, and to an extent, that was inevitable given the unprecedented pace of the AI bandwagon.
Each AI interaction leaves a record that can show how a system was used and what followed. At enterprise scale, this can mean millions of records are being generated every day. This information may be held across different platforms, making it difficult to develop a current enterprise-wide view.
The way many organizations approach this now is for governance teams to rely on periodic reporting and manual investigation to answer questions about AI use. But this isn’t anything like the speed of AI, and the resulting picture can already be well out of date by the time it reaches a governance committee. For example, a new requirement may trigger a lengthy gap assessment, even where the relevant usage data already exists.
What’s left is a worrying governance blind spot that’s increasingly incompatible with the regulations organizations must now observe.
Governance teams need access to AI usage data when important questions arise. For example, does this new regulatory requirement affect the AI tools currently being used by any of our teams? Which agents are accessing which datasets, and what are they doing with them? Are any AI systems currently operating outside our internal policy? You get the idea.
The goal should be to turn existing records into current, evidence-based answers so leaders can quickly identify whether a new requirement affects an existing use case. Only then is it practical to assess governance gaps, particularly as regulations change. And herein lies a really important point: Even though we’ve seen a lot of AI laws and regulations come into existence already, there’s much more coming over the horizon, and organizations need to be adaptable.
Achieving this level of adaptability requires organizations to overcome a significant practical problem. The information they need is rarely collected in a form suitable for governance because AI records are usually generated as raw operational data rather than as a fully baked resource.
Almost inevitably, a large organization will be using a range of AI services, each producing its own records but in a different format. Agent activity makes this even harder because a single task may involve several steps before an outcome is produced.
This creates a potential translation problem in turning a very large volume of technical activity into answers that address regulatory requirements and broader business concerns. These answers also need to be traceable, allowing a governance team to understand which systems or activity underpin them.
Ultimately, organizations now need to think differently about the role of AI usage data in governance. These records are an operational resource, but they can also provide the evidence needed to answer governance questions as they arise. That requires the ability to interrogate activity across different AI services and relate it directly to the requirements an organization needs to meet.
Given the pace of change, this could become an increasingly important distinction. Governance can’t work as intended if the information needed to make decisions is always several steps behind the technology it’s meant to control. But unfortunately, we’re likely to see many more headlines about AI governance failures before best practices are fully embedded in enterprise culture.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
