7 Things CISOs Must Know About AI Governance
AI has arrived in your organisation faster than any governance framework could anticipate. It came through browser extensions, embedded vendor features and staff who found something that made their work quicker, rather than through a strategy paper or a board mandate.
This guide is written for CISOs in UK financial services firms who are now accountable for AI they did not commission. It is a self-assessment rather than an explainer. Each of the seven sections closes with one diagnostic question about your own organisation. Answer all seven with evidence and your AI governance position is stronger than most. Answer two or three and you have found the gap.
1. Your employees are already using AI, whether you approve or not
Shadow AI risk is not a forecast. The pattern is consistent across mid-market firms: AI is running in three places at once, in sanctioned tools, in personal accounts on personal devices and in features quietly added to software the firm already licenses.
Blocking rarely holds. Firewall rules and DNS filtering move usage off the corporate network, where you lose the logging you had. You cannot manage exposure you cannot see, and an inventory built from procurement records will always be shorter than reality.
Diagnostic question: Do you know which AI tools your employees are using right now, not only the ones IT approved?
2. AI changes the security threat model
Prompt injection, data poisoning, model theft, inference leakage and supply chain compromise are not variations on familiar problems. The NCSC has noted that prompt injection may never be fully mitigated, which means the control you want does not exist yet.
Connect that to something concrete. An assistant that reads inbound client email is reachable by anyone who can email your firm, so untrusted input now sits inside a trusted process. Data poisoning matters the moment you fine-tune on your own records. Inference leakage matters when one model serves several client books.
Diagnostic question: Has your threat model been updated to account for AI-specific attack surfaces in the last 12 months?
3. AI governance is becoming an accountability question
The EU AI Act, ISO 42001 and ICO guidance all shape where this ends up. The question that reaches you first is narrower and more personal: who approved this system, and on what evidence?
Senior manager accountability regimes mean the answer will contain a name. Supervisory requests tend to focus less on AI strategy and more on the register, the risk assessment, the approval trail and the date each was last reviewed.
Diagnostic question: If the ICO or FCA asked for your AI risk register tomorrow, what would you hand them?
4. AI systems fail differently from traditional software
AI systems degrade quietly. A model that passed testing in March can produce materially different output in September because the vendor updated it, the input distribution shifted or a prompt template changed upstream. Nothing alerts. Nothing breaks in a way your monitoring recognises.
Most assurance processes assume a system stays as tested until someone changes it deliberately. That assumption does not hold here, which is why you cannot secure an AI system once and treat the matter as settled.
Diagnostic question: Do you have a process for detecting when an AI system’s behaviour has drifted from its approved baseline?
5. Data governance becomes a security issue
Prompts are an exfiltration path with no data loss prevention coverage in most firms. Client files, pipeline documents, board papers and remediation notes are pasted in daily because it saves time. Retention and training terms in the vendor contract then decide whether that content stays yours.
The consequence is uncomfortable. Poor data classification will break an AI programme faster than a poor model choice, because every downstream control you design depends on knowing what the data was in the first place.
Diagnostic question: Do you know what data your employees are putting into AI tools, and whether any of it is classified, personal or commercially sensitive?
6. Third-party AI is the largest unmanaged risk
Most mid-market financial services firms are not building AI. They are consuming it through vendors, and that is where the biggest untracked exposure sits.
Procurement typically requests ISO 27001 or SOC 2 evidence and treats AI functionality as a product feature rather than a component with its own risk profile. The questions that rarely appear on the form:
- Which model sits underneath the product, and who hosts it
- In which jurisdiction inference is processed
- Whether our data is used for training
- What happens to prompt content, and for how long it is retained
- Who is liable when the output is wrong
- Whether this falls within scope of model risk management
Sub-processors and model versions then change without notice.
Diagnostic question: When your procurement team last onboarded a vendor with AI capabilities, what security questions did they ask and who reviewed the answers?
7. The board narrative
Three questions are heading towards you. Where is AI used across the firm and who approved each use. What is the worst credible outcome and what currently limits it. Which obligations apply to us and how do we evidence compliance.
Each one is answerable with a register, an assessment and a named owner. Without those, the honest response is that nothing has gone wrong yet, and that answer does not survive a follow-up question in a board meeting or a supervisory conversation.
Diagnostic question: If your board asked you today to quantify the organisation’s AI risk exposure, what would your answer be?
Where this leaves you
Seven questions. If you hesitated on four or more, the issue is visibility rather than capability. You cannot write policy, set risk appetite or brief a board on exposure you have not mapped.
The most important question for CISOs is no longer whether AI should be allowed. That decision has already been made. The real question is how the organisation adopts AI safely before it outruns its ability to control it.
Our AI Governance Snapshot exists to answer the visibility question quickly. It is a 30-minute session at no charge, and you receive a written one-page output covering your current AI exposure, the two or three gaps that matter most and what to address first. Availability is limited each month. Where the answer is a longer piece of work, our AI Security Programmes take the same starting point and build the controls and evidence around it.
Close the visibility gap first
You cannot write policy, set risk appetite or brief a board on exposure you have not mapped. An AI Security Programme starts with the inventory and works outward.