AI governance often starts with policies.
Which AI tools are approved? What data can employees share? Which use cases require review? Who is accountable when something goes wrong?
Those questions matter, but there is a more basic problem that comes first.
Do you actually know where AI is being used?
In many organisations, the answer is probably no.
Employees may be using public AI assistants for writing, coding, research or summarisation. Developers may be experimenting with AI coding tools. Business teams may connect SaaS applications with built-in AI features. Vendors may quietly introduce AI into products that were originally purchased for something else.
None of that necessarily appears in a central AI inventory.
That makes governance difficult.
You cannot assess the risk of an AI system you do not know exists. You cannot decide whether sensitive data should be allowed into it. You cannot review its permissions, understand which external services it connects to or determine who is responsible for the output.
This is why AI governance has to begin with visibility.
An organisation needs to know which AI systems are in use, who owns them, what data they touch, what decisions they influence and whether they are allowed to act on behalf of users.
That inventory should include more than obvious tools such as chatbots.
AI may now exist inside productivity software, security platforms, CRM systems, development environments, browsers, cloud services and business applications.
The technology is becoming embedded everywhere.
That makes “shadow AI” different from traditional shadow IT.
An employee may not even realise they are introducing a new AI risk. They may simply enable a feature that already exists inside an approved platform.
The governance question therefore becomes less about banning tools and more about continuously understanding where AI capability exists.
Once visibility is established, other controls become possible.
The organisation can classify use cases by risk, define data restrictions, review access permissions, monitor activity and decide where stronger approvals are required.
Without visibility, those controls are mostly theoretical.
A policy can say what should happen.
Governance needs evidence of what is actually happening.
The first step in AI governance is therefore not writing another policy.
It is building an accurate picture of the AI systems, agents, models and features already operating across the organisation.
Because you cannot govern what you cannot see.