AI Regulations Active: Businesses Lack Visibility for Compliance

For years, AI regulation was a topic for abstract discussion for enterprise leaders. However, that era is over. The regulatory framework for AI has become active and enforceable worldwide, with more laws rapidly coming into effect Source.

Notably, the EU AI Act has already partially taken effect, and its enforcement deadlines are rapidly approaching. Additionally, the Network and Information Systems 2 (NIS2) directive has expanded cybersecurity obligations that may apply to systems using AI. The United States is also seeing sector-specific requirements and local regulations emerge.

The Disconnect Between Confidence and Compliance

Research indicates that while 9 in 10 organizations use AI daily or weekly, 88% experienced at least one AI-related security breach in the past year Source. This occurs despite over 80% of organizations expressing confidence in their ability to prevent unauthorized AI data access. Up to 72% of these confident organizations still experienced an unauthorized access incident.

This gap highlights a significant disconnect: IT and security leaders often believe their systems are secure, but this belief is frequently not grounded in actual visibility or operational control. Intent alone does not equate to compliance; real-world data shows many organizations are more vulnerable than they perceive.

The Problem of Limited Visibility

Many organizations are operating without full knowledge of their AI landscape. They often don't know how many AI agents they possess, what these agents are doing, or which AI tools employees are using daily Source.

One study indicates that over 20% of organizations are unaware if unsanctioned tools are being used to create AI agents within their environment. Estimates suggest there are millions of ungoverned AI agents deployed in key markets like the U.S. and UK. Without this fundamental visibility, organizations cannot effectively control their AI use, making compliance with complex and evolving regulations extremely challenging.

Strengthening Governance for AI Compliance

To achieve compliance with AI regulations, organizations need to adopt a standards-based, best-practices approach. Regulations such as the EU AI Act, ISO 42001, and the NIST AI Risk Management Framework require organizations to understand what data AI systems use, how decisions are made, and where potential risks exist.

Essential Steps for AI Governance

• Discovery and Inventory: Begin by identifying all sanctioned and unsanctioned AI tools. Map the data they can access and assign clear business owners for each.
• Policy Enforcement: Implement policies at the point of use by linking approvals, access controls, data classification, retention, and audit trails to the sensitivity of data AI consumes, creates, or acts on.
• Lifecycle Control: Operational AI governance also requires lifecycle control, robust data discovery, effective information management, and comprehensive recovery planning. This helps reduce data overexposure, eliminate redundant, obsolete, or trivial (ROT) data, and protect critical information before AI amplifies existing risks.

By building strong AI governance and data governance frameworks, organizations can deploy AI responsibly, ensure auditability, and align with both regulatory obligations and business objectives. This proactive approach allows organizations to prove controls are effective, correct issues quickly, and recover to a known-good state, avoiding reactive compliance challenges and uncontained risk. Organizations that invest in governance now will be better prepared to scale AI while maintaining compliance, security, and resilience.