Your organisation’s AI footprint may extend far beyond the systems you know about.

Artificial intelligence rarely enters an organisation through a single, clearly identified deployment. It becomes part of everyday operations through employee behaviour, software updates, third-party platforms, outsourced processes and technology embedded within products and services.

As a result, the organisation’s actual AI footprint can develop faster than its ability to identify, assess and govern it. This creates a governance gap: AI capabilities are already influencing information, processes and decisions while visibility, responsibility and control remain fragmented across the organisation.

Your People

General-purpose AI tools are now readily available across almost every professional function. Employees may use them to draft documents, analyse information, generate code, prepare presentations, summarise meetings, translate content or support business decisions — often through individual accounts or applications outside formally approved corporate systems.

Each interaction can create consequences for the organisation. For example, an employee may input confidential, personal or proprietary information into an external AI system without visibility over data retention, secondary use, processing locations, model training practices or access by third parties.

Similar issues arise when AI-generated material is incorporated into professional work without adequate verification, when source code is submitted to external coding assistants, or when employees rely on AI-generated analysis in decisions affecting customers, suppliers or colleagues. The resulting exposure belongs within the organisation’s governance perimeter even where the underlying tool was adopted informally by an individual employee.

Your Software

AI may already be embedded in systems your organisation relies on. Enterprise software is increasingly incorporating AI capabilities into existing products: recruitment platforms, CRM systems, cybersecurity tools, productivity suites, analytics platforms, financial software and sector-specific applications.

These capabilities may be introduced through product updates or activated as additional functionality within systems originally procured for entirely different purposes. A recruitment platform may use machine-learning techniques to rank candidates or recommend profiles. A CRM may analyse customer behaviour and generate predictive recommendations. A cybersecurity platform may use automated models to classify activity as suspicious. A productivity suite may introduce generative AI capable of accessing corporate documents and communications.

Each scenario creates a different combination of data, regulatory, contractual, security and governance considerations. Understanding the organisation’s AI exposure requires visibility into what those systems actually do, which data they process, how their AI capabilities are used and what effect their outputs have within business processes.

Your Providers

Third parties can introduce AI into your operations and data flows. An organisation’s AI footprint extends through its technology and service supply chain.

SaaS providers, cloud platforms, professional advisers, outsourced service providers, marketing agencies, HR suppliers and other contractors may rely on AI when delivering their services. Their technology choices can consequently affect the organisation’s information, processes and regulatory position.

Consider a customer-support provider that introduces generative AI to analyse conversations and draft responses. Customer information may now be processed through an AI system that was not contemplated when the service was originally contracted. A software provider may similarly replace a conventional function with an AI-enabled feature, introducing additional processing operations, subprocessors or technical dependencies into an established workflow.

The significance increases where providers handle personal data, commercially sensitive information, intellectual property or information subject to confidentiality or sector-specific requirements. Effective governance requires sufficient visibility across the supply chain to understand where external AI capabilities intersect with the organisation’s own operations and responsibilities.

Accountability

Technology may be external. Accountability is not. Organisations increasingly operate through complex technology ecosystems. AI systems may be developed by one company, integrated by another, supplied through a cloud platform and ultimately used by employees within a business process controlled by the organisation.

That distribution of technology does not necessarily produce an equivalent distribution of responsibility. Under the emerging European regulatory framework, an organisation’s obligations may depend upon its role in relation to an AI system, the purpose for which the system is used, the context of deployment, the data involved and the consequences for affected individuals.

For example, an employer may use a recruitment platform supplied entirely by a third party while retaining responsibility for how that technology is incorporated into its recruitment process. A financial institution may rely on externally developed analytical technology while remaining responsible for decisions made within its regulated activities. A company may deploy generative AI supplied through a major technology provider while remaining responsible for the information its employees disclose and the purposes for which generated outputs are subsequently used.

Responsibility therefore follows the organisation’s use, decisions and operational role, not simply ownership of the underlying technology.

The Gap Grows with Adoption

AI adoption can move rapidly. Governance structures usually move more slowly. New tools appear. Existing software acquires new capabilities. Employees change working practices. Providers modify their technology stacks. Data begins flowing through systems that were never considered when policies, contracts and controls were originally designed.

Over time, seemingly isolated changes can produce a materially different risk environment. For management, the central issue becomes one of visibility and control: knowing where AI is operating across the organisation, understanding which uses are significant, establishing where responsibility lies and ensuring that governance develops alongside the technology.

That is where effective AI governance begins. Keryon identifies the gap between the AI your organisation believes it uses and the AI that is actually operating across its business.