There is a common assumption that AI governance is primarily a policy problem. Organizations need acceptable use policies, governance committees, risk frameworks, and compliance controls to manage AI safely.
However, before organizations can govern AI, they first need to know where AI exists. Every major technology shift started with an inventory problem. SaaS, cloud, and mobile all required organizations to establish visibility before they could implement effective governance.
Michael Covington believes that AI is following the same pattern, but the challenge is harder because AI exists across applications, models, embedded capabilities, and agentic systems. Most organizations can see only part of that landscape…
The instinct among leadership teams has been to move fast on policy. Having documented policies on AI implementation and usage is great, however, it fails to address the main problem associated with the technology: too many organizations simply don’t know what AI is running, right now, across the organization.
Corporate guidelines tend to focus on the obvious AI tools like ChatGPT or Claude, but beyond that, it all becomes a bit fuzzy, especially as AI becomes more integrated into productivity tools and other applications. Ultimately, organizations can’t rely on AI governance frameworks for a landscape they can’t fully see.
The same problem we have seen before
The issue is that we are already trying to address the problem of AI policy, before addressing the need for visibility.
The challenge I see when talking with customers is that very few are confident in being able to explain what is actually running on employee devices, inside the software they have licensed for years, or through the agentic tools that developers have quietly wired into everyday workflows. As a result, organizations have a growing gap between what is approved under the AI policy and what is operating, which leaves exposure sitting unmanaged.
In fact, Jamf’s research bears this out, with 72.9% of organizations already deploying AI, yet 81.7% saying that they are exposed to AI risk. Adoption has outrun governance almost everywhere.
The risk will only get worse as organizations add more AI tools to their systems or gain new features through existing products. You only have to look through previous technology revolutions to see the exact same pattern happening again.
Organizations rushed to roll out SaaS and cloud environments only to find out that they needed to be managed. So, we then started putting in governance and realised we needed visibility before it could become effective. It is a lesson that organizations are still paying for a decade later, and the same will apply to AI (if not worse).
A problem for the entire business, not just security
Of course, the automatic assumption is that AI risk and policy are the CISO’s problem. And while that is certainly true, because ungoverned AI is an unmanaged attack surface, it is everyone else’s problem too.
Just look at a potential future incident where a developer using an AI coding model wiped an entire production database, tearing through files it had no business touching. It was not a complex nation-state attack, but rather a coding agent with more reach than anyone realised, doing exactly what agents do when nothing constrains them. That is the exposure boards are signing off on when they approve an AI governance framework without visibility to back it up.
Now imagine what damage could have been done if it were an AI tool in your accounting software or sales function. Organizations must know which agents are active across the fleet, what they are connected to, and what they are allowed to touch.
Visibility is the missing control
None of this is a new discipline for leadership to learn. Boards already expect accurate inventories of hardware, software, and cloud services, because those inventories are what cyber security, compliance, budgeting, and lifecycle planning actually rest on. AI needs to be brought into that same expectation, not treated as a separate problem requiring its own committee and its own spreadsheet.
That distinction matters more than it sounds. A spreadsheet of approved AI tools looks like governance, but it is still an assumption dressed up as a control. Real evidence comes from connecting the data organizations already have.
Asset management, application inventories, endpoint records, and software lifecycle processes each hold part of the picture. The value is in stitching them together, so that leadership is working from what is actually deployed rather than what was signed off 18 months ago.
It also cannot be a one-time exercise. AI capability now arrives inside routine software updates, not major procurement decisions, so an application with no AI functionality six months ago may well have it today, without anyone in the business having approved anything new. A periodic review will always be chasing a moving target; only continuous visibility keeps pace with it. Get that right, and governance stops being a bottleneck and starts being useful. Technology leaders can actually assess where AI is creating value.
A well-written AI governance framework is the best way to get all of this defined and organized and, to have that, you need visibility. The good news is that most enterprises already have the muscle for this; they just have not pointed it at AI yet.
Once that visibility exists, everything downstream gets easier to defend in the boardroom. Security teams can show exactly what is exposed and why. Compliance can map governance to actual usage rather than best guesses. And the CFO can finally see AI as a managed, measurable part of the technology estate rather than an open-ended liability.
The author
Michael Covington is VP of Strategy at Jamf
