AI Governance & Risk  ·  Research Theme  ·  2026

AI Governance and Risk: Why Point-in-Time Policy Cannot Govern a System That Changes Every Day

What meaningful oversight actually requires when AI use spreads faster than policy can track it, and why shadow AI has become the defining visibility problem of 2026.

Read Article
Executive Summary
Most AI governance frameworks describe a system as it was approved. Very few describe the system as it is actually being used.

AI governance has matured considerably in a short period. Most organisations of any size now have some form of AI policy, an approval process for new use cases, and a nominal owner for AI risk. On paper, governance exists.

In practice, the systems that policy describes and the systems people actually use have quietly diverged. New AI features arrive embedded inside everyday software without a formal approval step. Employees use AI tools that were never inventoried. Vendors update models behind an existing integration without triggering any review. The approved picture and the real picture drift apart, usually without anyone deciding that they should.

This report is about that gap, and about what it actually takes to close it. It examines why static, point-in-time governance documents cannot keep pace with continuously changing AI systems, why shadow AI has become such a persistent and under-measured risk, what meaningful human oversight requires as distinct from symbolic sign-off, and how organisations are building governance that tracks real usage rather than approved usage.

None of this argues for slower AI adoption or heavier bureaucracy. The organisations managing this well are not the ones with the thickest policy documents. They are the ones that have built continuous visibility into what is actually running, backed by oversight that is proportionate, evidenced and genuinely capable of intervening when something goes wrong.

That distinction, between governance that describes intent and governance that tracks reality, is the central theme of this report.

01 · Why Point-in-Time Policy Fails a System That Never Stops Changing
A governance framework approved at a single point in time describes the AI estate as it was, not as it is. The gap between the two widens every day it is left unmeasured.

Traditional governance instruments, a policy document, a use case register, a risk assessment signed off at deployment, are built around the assumption that the thing being governed is relatively stable once approved. That assumption held reasonably well for conventional software, where a change request typically triggers a review before it goes live.

AI systems do not behave this way. A model can be updated by its provider without the organisation initiating anything. The data feeding a system changes continuously. Usage patterns shift as people find new ways to apply a tool that was approved for one purpose and quietly gets used for another. None of this requires anyone to break a rule; it happens as an ordinary consequence of how these systems are used and maintained.

The result is that a governance record approved twelve months, or even twelve weeks, ago may no longer describe what is actually running. The organisation is not necessarily out of compliance with its own policy in any single obvious way. It has simply lost an accurate, current picture of its own AI estate, one incremental change at a time.

This is why an increasing number of organisations are treating AI governance as a continuous monitoring discipline rather than a one-off approval gate. The policy still matters, but it needs to be paired with a live mechanism for detecting when reality has drifted from what was approved, rather than relying on the next scheduled review to catch it.

Waiting for the next audit cycle to notice this drift is, in practice, waiting to find out how large the gap has become rather than managing it as it forms.

02 · Shadow AI: The Gap Between Actual Use and Approved Use
Shadow AI is rarely the result of employees deliberately breaking the rules. It is usually the predictable consequence of AI capability arriving faster than governance processes can register it.

Shadow AI describes AI tools and features in active use inside an organisation that have not gone through a formal approval, risk assessment or inventory process. It includes browser extensions and personal accounts used for work tasks, but increasingly it also includes AI features embedded directly inside software the organisation already licenses, switched on by default in a routine vendor update.

This second category is the more difficult one, precisely because nobody has to do anything wrong for it to happen. A collaboration tool, a customer platform or an analytics product can quietly ship a new AI feature that starts processing organisational data the moment it is enabled, without any deliberate decision inside the organisation to adopt a new AI capability at all.

The scale of this gap matters because governance, risk management and compliance all depend on an accurate inventory of what is actually in use. A risk assessment built against an incomplete inventory is not wrong so much as it is answering a narrower question than the one leadership thinks it is answering.

Closing this gap is primarily a visibility problem before it is a policy problem. Organisations need mechanisms, technical discovery tools, procurement controls, structured self-reporting, that surface AI use as it actually happens, rather than relying solely on employees or business units to proactively declare tools that were never formally introduced as an 'AI project' in the first place.

Treating shadow AI purely as a disciplinary or awareness issue misses the structural cause. The more durable fix is continuous discovery: knowing what is running, updating the inventory as new tools and features appear, and building the policy response around an accurate and current picture rather than a static one.

03 · What Meaningful Human Oversight Actually Requires
A named human reviewer is not the same thing as meaningful oversight. The difference lies in whether that person has the time, information and authority to actually change the outcome.

Human oversight is one of the most widely stated requirements in AI governance frameworks and regulatory guidance, and one of the most inconsistently implemented in practice. Many organisations can point to a role labelled as the human reviewer or approver for a given AI-supported decision. Fewer can demonstrate that this person has a realistic opportunity to catch and correct a problem.

Symbolic oversight has a recognisable pattern: a reviewer presented with a high volume of AI-generated outputs, limited time per case, an interface that nudges toward acceptance, and no meaningful consequence for approving without close scrutiny. The role exists on the organisation chart and in the governance documentation. It does very little in practice to change what actually happens.

Meaningful oversight requires a different set of conditions. The reviewer needs enough time and information to actually evaluate the output, not simply confirm that one was produced. They need genuine authority to override, escalate or halt the process, not just to record a note. And the volume of cases routed to them needs to be realistic for the level of scrutiny the role is meant to provide.

It also requires the organisation to be honest about which decisions genuinely need a human in a position to intervene before an action is taken, versus which need a human able to review and correct after the fact, versus which can be left to run with monitoring alone. Applying the same nominal oversight model uniformly across very different risk levels tends to produce oversight that is too heavy where it is not needed and too thin where it matters most.

The practical test for any human oversight arrangement is simple to state and uncomfortable to apply honestly: if the reviewer disagreed with the AI's output right now, could they actually stop it, and would anyone notice if they never did. Where the answer is no, the oversight is symbolic, regardless of what the governance document says.

Oversight in Practice

Three tests distinguish meaningful human oversight from a symbolic sign-off step.

Each of these is something a governance function can check directly, without waiting for an incident to reveal the answer.

Time and Information
Can the reviewer actually evaluate the output?

Or are they presented with a volume of cases and a level of detail that only allows them to confirm one was produced.

Authority to Act
Can the reviewer change the outcome, not just record a note?

Genuine oversight requires the power to override, escalate or halt the process, exercised in practice and not only on paper.

Visibility of Use
Does the reviewer see what is actually running?

Oversight built on an incomplete inventory of AI in use, including shadow AI and embedded features, is oversight of a partial picture.

Where any one of these tests fails, the organisation has a documented oversight role rather than a functioning one, and it is worth finding that out before a regulator, auditor or incident does.

04 · From Static Risk Registers to Continuous Risk Visibility
A risk register updated at quarterly intervals is describing a moving target with a snapshot. AI risk needs to be tracked closer to how the systems themselves actually change.

Conventional risk registers are typically reviewed on a fixed cycle, quarterly, sometimes annually, with risk ratings adjusted at each review point. For risks that genuinely change slowly, this cadence is proportionate. For AI systems, where model behaviour, data inputs and usage patterns can shift meaningfully within weeks, a quarterly snapshot can be badly out of date for a significant part of the period it is meant to cover.

Continuous risk visibility does not mean abandoning structured risk registers. It means feeding them with more current information: automated monitoring of model performance and drift, ongoing tracking of what AI capability is actually deployed and where, and defined triggers that prompt an out-of-cycle risk review rather than waiting for the next scheduled one.

This shift also changes who is involved in risk management day to day. Rather than risk being primarily the concern of a periodic committee, monitoring signals need to reach the people who can act on them quickly, the system owner, the technical team, the accountable business leader, as close to real time as the underlying risk actually changes.

Building this kind of visibility is a genuine investment, in tooling, in defined ownership, and in the discipline of actually acting on signals rather than logging them. It is also increasingly what regulators, auditors and boards expect to see when they ask how an organisation actually knows what its AI systems are doing, rather than what it approved them to do.

The organisations furthest ahead on this are generally not the ones with the most detailed static risk documentation. They are the ones that can answer, with reasonable confidence and short notice, what their AI systems are doing right now.

05 · Accountability: Who Answers When an AI System Gets It Wrong
Diffuse accountability is one of the most common failure modes in AI governance. If everyone is somewhat responsible, no one is answerable when it actually matters.

When an AI-supported decision causes harm, whether that is a poor customer outcome, a flawed internal decision or a compliance failure, the question of who is accountable is frequently harder to answer than it should be. Responsibility is often spread across the team that built the model, the vendor that supplied it, the business function that used it, and a governance function that approved it at some earlier point.

This diffusion is rarely deliberate. It emerges naturally from how AI initiatives are typically delivered, with different teams owning different parts of the lifecycle and no single point where end-to-end accountability for the outcome sits with one identifiable person or role.

Clear accountability requires naming, in advance rather than after an incident, who is answerable for the outcomes of a given AI-supported process. Not who built it, and not who approved it at launch, but who is responsible for its ongoing performance and who has the authority to change or stop it.

This naming exercise is uncomfortable, which is precisely why organisations often avoid doing it properly until an incident forces the question. It requires business leaders to accept accountability for a system whose internal workings they may not fully control, and it requires governance functions to accept that their role is to enable and check that accountability, not to hold it themselves.

Organisations that get this right tend to treat accountability for AI outcomes the same way they treat accountability for any other significant operational or financial risk: named, documented, and tested before it is needed, rather than worked out for the first time during an incident review.

06 · Governance Technology: Monitoring, Logging and Evidence at Scale
Manual governance processes cannot keep pace with an AI estate that changes daily. Increasingly, the evidence regulators and boards expect has to be generated automatically.

As the number of AI systems in use grows, manual governance processes, spreadsheet-based inventories, periodic manual reviews, ad hoc incident logs, struggle to keep pace. What was manageable for a handful of use cases becomes unworkable once an organisation has dozens or hundreds of AI-supported processes running simultaneously.

This is driving investment in governance technology: platforms that automatically discover AI tools in use, maintain a live inventory, log decisions and their supporting evidence, monitor for performance drift, and generate the kind of audit trail that both internal risk functions and external regulators increasingly expect to see.

The value of this technology is not simply efficiency. It is that it produces continuous, timestamped evidence rather than a reconstructed account assembled after the fact when a regulator, auditor or board asks a question. Being able to show what a system was doing at a specific point in time, and who was accountable for it, is considerably more credible than describing the process that was supposed to be followed.

This does not remove the need for human judgement in governance. It changes what that judgement is applied to: rather than manually compiling basic facts about what is running, governance teams can spend their time interpreting monitoring signals, deciding on proportionate responses and improving the framework itself.

Organisations still relying entirely on manual, periodic governance processes are likely to find the gap between their own record and their actual AI estate widening as usage grows, precisely at the point when regulators and boards are asking more detailed and more frequent questions about exactly this gap.

07 · Third-Party and Embedded AI: Governing What You Did Not Choose
A growing share of enterprise AI exposure now arrives through vendors and embedded software features rather than through a deliberate internal build decision.

A significant, and growing, proportion of an organisation's AI exposure now comes from outside its own development choices: AI features embedded in software procured for an entirely different purpose, AI capability introduced by a vendor as part of a routine platform update, and AI components buried inside the tools and services that make up an organisation's wider technology supply chain.

This creates a governance challenge that does not fit neatly into frameworks designed around internally built or internally commissioned AI systems. The organisation did not design the model, may not have visibility into how it was trained or evaluated, and often only becomes aware that a given feature involves AI at all when someone happens to notice it.

Governing this exposure requires extending existing third-party and vendor risk processes to explicitly ask about AI: what AI capability is embedded in a given product, how the vendor updates or retrains it, what data it processes, and what contractual and technical controls exist if that capability needs to be disabled, adjusted or audited.

It also requires closer coordination between procurement, security and AI governance functions, which have historically operated with limited overlap. AI risk arriving through the vendor channel does not respect the boundary between those functions, and neither should the process for managing it.

Organisations that treat vendor and embedded AI as outside the scope of their AI governance framework, on the basis that they did not build it, are leaving out a substantial and growing share of their actual AI exposure. The framework needs to cover where AI actually runs, not only where the organisation chose to put it.

08 · Building Governance That Keeps Pace With Usage
The organisations managing AI risk well are not relying on thicker policy documents. They are closing the loop between what is approved, what is monitored and what is actually running.

Bringing these threads together, the practical shift required is from governance as a static approval record to governance as a continuous, evidenced process that tracks the AI estate as it actually exists, not as it was described at the point of approval.

That means continuous discovery of AI tools and features in use, including those embedded inside existing software. It means human oversight roles designed with the time, information and authority to genuinely intervene, sized appropriately to the risk level of the decision involved. It means risk visibility that is closer to real time than a quarterly cycle allows.

It means named, tested accountability for the outcomes of AI-supported processes, extended explicitly to cover AI arriving through vendors and embedded features rather than only AI built internally. And increasingly, it means investing in the technology needed to generate that evidence automatically, rather than reconstructing it under pressure when a regulator or board asks.

None of this requires organisations to slow down their use of AI. It requires them to be honest about the difference between the AI estate they have approved and the AI estate they actually have, and to build governance that is designed to detect and close that gap continuously, rather than periodically.

The organisations best placed for what comes next in AI regulation and assurance are not the ones with the most comprehensive policy documents sitting on a shared drive. They are the ones that can demonstrate, with current evidence, that they actually know what their AI systems are doing.

Conclusion
AI governance built for a static system will fall behind a system that changes every day. The fix is continuous visibility, not thicker policy.

The organisations managing AI governance and risk well in 2026 share a common trait: they have accepted that a point-in-time approval, however thorough, describes a moment rather than an ongoing state, and they have built mechanisms to track how far reality has drifted from that moment.

This means closing the shadow AI gap through continuous discovery rather than periodic self-reporting, designing human oversight roles that can genuinely intervene rather than symbolically approve, and extending accountability and vendor risk processes to cover AI that arrives embedded in tools the organisation did not build.

It also means investing in the technology and evidence trail needed to demonstrate, with confidence and on short notice, what the organisation's AI systems are actually doing, rather than reconstructing that picture under pressure when it is asked for.

None of this is about adding friction for its own sake. Proportionate, well-evidenced governance is what allows an organisation to keep expanding its use of AI with confidence, because it can actually see and manage the risk as it grows, rather than discovering the gap between policy and practice at the worst possible moment.

The standard for AI governance is shifting from having a policy to being able to demonstrate, continuously, that the policy and the reality still match. That is a materially higher bar, and it is the one organisations should now be building towards.

Explore Related INTAI Services

Know What Your AI Systems Are Actually Doing

INTAI helps organisations close the gap between approved AI use and actual AI use, with practical governance, oversight design and continuous risk visibility built to keep pace with how AI really changes.

Explore Governance Strategy Talk to Us
Scroll