Latest Features
Trending Topics
Trending
This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.
This Cybersecurity Awareness Month, Sam Peters, Chief Product Officer at IO, discusses why businesses need to put clear guardrails around AI use
The arrival of more autonomous AI agents is advancing the governance conversation across businesses of all sizes and industries. As AI becomes part of everyday work, compliance decisions are happening further away from the security team and closer to the people trying to get the work done.
Decisions about which tools to use, what information to put into them and which suppliers or systems to connect are increasingly being made as part of everyday work. And this makes good governance much more important. The risk is already visible, with employees using generative AI without permission or guidance in many organisations.
However, the answer is not to slow AI use, or to expect every employee to become an AI risk specialist. It’s to put enough structure around its use that responsible decisions become the easiest decisions to make.
So, what does good governance look like in practice, and how can organisations ensure it reflects how employees are actually using increasingly autonomous AI?
An employee choosing an AI tool, uploading a customer document into a prompt, or connecting a new service to an existing system is making a compliance decision without thinking of it as one. People adopt tools because they solve a problem. If an employee discovers that a tool can save them hours by summarising a large volume of documents or automating a repetitive task, the appeal is obvious, and security can easily come second.
The same is happening at an organisational level. When AI adoption outpaces the processes needed to govern it, businesses can find themselves having to introduce controls after the technology has already become embedded in everyday work.
So, what is the answer? While organisations cannot expect every employee to identify every security, privacy or compliance risk as it emerges, they do need to put clear guardrails in place around AI use. People make better decisions when the organisation has already given them clear boundaries, accountability and support.
Technical controls can restrict what an agent is able to do, but human judgement is always required to determine what it should be allowed to do in their particular environment, based on organisational data, systems, risk profile and regulatory obligations.
The first step is visibility. Organisations need to understand where AI is being used, what it is being used for and what information those systems can access. Without that, it is difficult to assess risk or know whether existing controls are doing their job.
If employees are using public AI tools to summarise documents, analyse information or support decisions, then these uses form part of the organisation’s AI risk, whether they have been formally approved or not.
From there, organisations can set clear boundaries about what is and is not acceptable. Employees should know which types of data can and cannot be entered into AI models. For example, intellectual property, customer data and financial data should never be entered into free, public versions of large language models.
But a policy on its own is not enough. Employees also need useful alternatives. If the approved route is difficult to use, slow to access or does not solve the problem they are trying to solve, people are more likely to find their way around it. Providing approved tools and making the process for requesting a new one straightforward can help make responsible use the easiest option.
Agentic AI requires organisations to be much more deliberate about the authority they give to them. An AI agent should only have the level of access required for its task, rather than everything it could possibly reach. Access and authority should be proportionate to the task and risk.
There also needs to be clear ownership. Every AI use case should have someone who understands why the system is being used, what it can access and what could happen if it goes wrong. This doesn’t mean that one person has to own every aspect of AI risk. Security, privacy, legal, compliance, IT and the business teams using AI will have different responsibilities. A cross-functional approach can bring those perspectives together and make sure that risks are considered from the outset.
The same thinking should apply when an AI system changes. A new business use case or supplier might alter the level of risk, so governance shouldn’t end once an agent has been approved. Permissions and controls need to remain visible and reviewed regularly. Just as importantly, employees need a straightforward way to escalate concerns when something does not look right.
AI risk is often closely connected to existing information security and data protection risks, so these boundaries should not sit in isolation from the organisation’s wider security and privacy controls. Taking a centralised approach to compliance allows organisations to map risk across each of these areas and address common risks accordingly. This avoids creating an additional governance process that sits separately from everything else.
As AI systems become more capable of accessing data and taking actions across business processes, the AI governance framework also needs to evolve. Along with business use cases, supplier changes and regulation, AI capabilities will evolve, so organisations need a way to review whether their controls are still appropriate. This is where a management system approach is valuable.
ISO 42001 provides a structured way to establish AI policies, define responsibilities, assess AI-related risks and impacts, and improve how AI is governed. Used alongside existing information security and privacy frameworks, such as ISO 27001 and ISO 27701, it can help organisations bring AI into the governance structures they already have, building overall business resilience.
The more autonomous AI becomes, the more important these foundations become.
The organisations that get AI governance right will be those that make secure behaviour the easiest behaviour, embedding accountability, controls and oversight into everyday AI use rather than relying on employees to navigate an increasingly complex risk landscape on their own.
Good governance shouldn’t stand in the way of AI adoption. It should give organisations the confidence to adopt it responsibly, knowing where the risks sit and how they will be managed as the technology evolves. Governance is the foundation that allows organisations to move forward with AI safely without losing control.
