IT and security leaders are well-versed in the risks of unauthorized integrations, misconfigured tools and vendor compliance. Now, AI has introduced a separate and harder-to-detect problem.
IT and security leaders are well-versed in the risks of unauthorized integrations, misconfigured tools and vendor compliance. Now, AI has introduced a separate and harder-to-detect problem.
Across every function, employees use provisioned AI tools to generate production-grade code, build automated workflows and deploy agents to support business processes. That experimentation is happening without visibility into what others have built, or the structural risks accumulating as a result.
The governance models enterprise organizations relied on even six months ago were not designed for this moment, or what lies ahead. We’ve focused so intently on which AI risks to govern that we never stopped to reimagine what operating model should underpin the governing.
A predictable operating bottleneck plays out inside large enterprises. A team needs AI support, but the formal channel is slow, backlogged or unclear. So, the team builds something independently. That instinct is right, but the structure is not.
The costs from this kind of inefficiency can compound quickly. Effort gets duplicated across departments with no visibility into each other’s work. Siloed tooling emerges with no shared standards, and security and data handling practices diverge. People get pulled away from their core responsibilities to maintain AI tools that three other teams independently built last quarter.
Meanwhile, the governance function stays busy reviewing the growing queue it can see: integrations passing through approvals and vendors that appeared in a procurement request.
In context
- Topic: Estrategia y Gobierno de TI — Decisiones de portafolio, costo total, gobierno y marcos de referencia.
- Source: CIO
- Published: 12/10/2026
Continue reading at the original source →
Excerpt published automatically by the site radar. The full text belongs to its publisher and is linked above.
Why it matters
IT governance rarely fails for lack of technology. It fails for lack of clarity about who decides what. A story like this one is usually the visible symptom of an operating model that no longer fits the size of the organisation, and those models get changed before the pressure arrives, not after.
My filter is always the same: does this change a decision, or only a tool? If at the end of the quarter the same people are approving the same things by the same criteria, there was no transformation, there was a purchase. The difference shows up in the committee minutes, not in the press release.
What usually goes wrong
What usually goes wrong is the part never discussed with the areas that will carry the work. It gets decided at the top, communicated downward, and the resistance shows up not as opposition but as slowness. Nobody says no; everything simply takes twice as long and nobody can explain why.
What to watch
- Whether business metrics appear or only delivery metrics — cost per transaction beats percentage complete.
- The real calendar of contracts and renewals: that is where you see whether the move was strategic or was an expiry date.
- What gets switched off to fund the new thing; if nothing does, the budget will hurt in six months.
How I read this entry
I would treat it less as a technology story and more as a market signal. If one player moves this way, in twelve to eighteen months the rest will have to answer something. Better to decide now, calmly, what that answer will be, rather than improvise it when a client asks.
This entry is an excerpt from the original source, selected by the site radar. The commentary above is the site's own and does not belong to the cited publisher.
Comments
No comments yet. Yours can be the first.
Living through this in your own team?
Open the chat and tell me how you're handling it. I'm interested in comparing notes.
