Agent Sprawl: When Nobody Can List What Runs Where

14 October 2026 · 6 min read

Agent sprawl starts when AI systems accumulate faster than the organisation can keep track of them. Internally built models sit alongside third-party tools, AI embedded in existing platforms, vendor systems processing customer data and agents with access to other systems. They may have different owners, permissions and levels of oversight, with no single record of what is running where.

IBM research finds that only 18% of organisations maintain a complete AI inventory, while fewer than one in three know what AI runs where across their organisation. For many organisations, a basic governance question is difficult to answer: what AI is running, where is it being used and who is accountable for it?

Enterprise AI governance starts with being able to answer those questions. Frameworks including the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act place clear emphasis on governance, accountability and oversight. Yet AI adoption can move faster than the structures needed to manage it.

This article looks at the practical infrastructure needed to bring that activity under control: an AI register, clear ownership, risk classification, review requirements and reporting.

What Leadership Need to Know About AI Governance

Leaders need enough visibility to understand where AI creates risk, who is accountable for it and whether the controls around it are working. That starts with knowing what AI is running across the organisation and where it is being used.

Reporting should focus on the issues that require oversight: significant risks, high-risk systems, material incidents, regulatory exposure and decisions that need escalation. Operational governance goes deeper into new deployments, control exceptions, monitoring results and unresolved issues.

None of that works without a reliable AI inventory. If the organisation cannot identify its AI systems, where they operate and who owns them, it becomes difficult to assess risk, maintain oversight or give the board a clear picture of its exposure.

The AI Inventory Is the Starting Point for Governance

Shadow AI and the Systems Nobody Registered

AI systems that never make it into the inventory are difficult to govern. There may be no clear owner, no record of the data they access and no way to confirm whether the right approvals, monitoring or human oversight are in place.

The register needs enough detail to manage each system throughout its use. That includes what the system does, who owns it, what data it uses, where it is deployed, its approval and monitoring status and when it should be reviewed or retired.

Risk should then be assessed based on how the AI is actually being used. The same model used to summarise internal documents presents a different level of risk when it is connected to sensitive customer data and given permission to modify records or take external actions. Data sensitivity, autonomy, decision impact and the consequences of an error all affect the level of oversight the use case requires.

How Risk Classification Shapes the Control Requirement

Risk classification determines how much control and oversight a use case requires. Higher-risk uses may need additional approval, monitoring and human oversight, while lower-risk uses can be managed with lighter controls.

The classification should be based on clear criteria and documented consistently. It should also be reviewed when something material changes, such as the model, data, intended use, level of autonomy or access to other systems. A change in how the AI operates can change its risk, even if the underlying model stays the same.

Accountability and Decision Rights in AI Governance

From Board Oversight to Individual AI Systems

AI governance needs clear accountability at each level of the organisation. The board or audit committee oversees risk and policy. A cross-functional governance group brings together functions such as security, legal, privacy, risk, compliance, data and relevant business teams. Day-to-day governance may sit with a dedicated team or existing function, while named owners remain accountable for individual AI systems.

The governance group also needs clear decision rights. It should be established who can approve a deployment, require changes, escalate a concern or stop a system from going live. Those decisions become particularly important when a higher-risk deployment is under pressure to move quickly.

Define that authority before it is needed. If responsibility is clear but the people responsible cannot act when a risk emerges, the governance structure has limited practical effect.

Use RACI to Make Accountability Clear

A RACI can clarify who is responsible and accountable at each stage of AI governance, from registering a use case and classifying its risk through to approval, release, monitoring and incident response. Each decision should have a clear accountable owner so there is no ambiguity about who has authority to act.

The roles also need appropriate separation. Internal audit should be able to assess controls independently rather than approve work it may later review. For higher-risk deployments, legal, privacy, security and risk should be involved before approval where relevant, rather than brought in after the decision has been made.

Match the Controls to the Level of Risk

Controls should increase with the level of risk. Lower-risk uses may need basic ownership, documentation and review, while systems with greater autonomy, more sensitive data or more consequential decisions require stronger approval, testing and oversight.

A tiered approach might look like this:

• Low risk: named owner, documented purpose, basic quality and privacy checks, access controls and periodic review.
• Medium risk: documented risk assessment, validation, data lineage, human review, performance thresholds and incident reporting.
• High risk: impact and privacy assessments, independent validation, stronger testing, defined human oversight, staged release, ongoing monitoring and formal approval.
• Critical: executive or risk-level approval, independent challenge, strict limits on what the system can do and regular reauthorisation.

The tier should also change when the use of the system changes. New data sources, additional users, greater autonomy or access to other tools can materially alter the risk even when the underlying model remains the same.

What AI Governance Looks Like Embedded in Operations

Where Governance Sits in the Operating Model

Governance needs to reach the decisions made about AI in day-to-day operations. Envisago’s AIVOM™ places that accountability across four dimensions: Value, Design, Capability and Performance.

Value connects AI activity to business outcomes and risk appetite. Design covers how AI is built into workflows and where controls sit. Capability addresses whether teams can use and manage AI responsibly. Performance tracks whether the expected outcomes and controls are holding over time.

This moves governance beyond policy and into the way AI is designed, managed and reviewed across the operation.

Monitoring, Evidence and Incident Response

Monitoring needs a clear response when something goes wrong. Alerts should reach a named owner, with an escalation path and a defined action such as investigation, remediation or rollback.

The supporting systems also need to preserve evidence of what happened. Depending on the deployment, that may include system records, approvals, monitoring results, audit logs and incident histories. Keeping those records as part of normal operations makes them available when an audit, regulatory review or internal investigation requires them.

Technical controls become useful governance when they connect evidence to ownership and action.

Frequently Asked Questions About Enterprise AI Governance

What regulatory requirements apply to enterprise AI governance in the UK?

UK organisations using AI must comply with existing laws that apply to the use case, including the UK GDPR and Data Protection Act 2018 where personal data is involved, alongside equality and sector-specific requirements. Governance should cover clear accountability, risk assessment and appropriate controls, with DPIAs required for certain high-risk processing.

Where should an enterprise start if governance is informal?

Start with the AI inventory: identify what is running, where it is used and who owns it. Then classify the risk and apply the appropriate controls and oversight.

How does governance scale as the number of AI systems grows?

Automate routine governance where practical, including registration, approvals, monitoring and escalation. Use risk tiers to apply stronger controls where the potential impact is greater rather than treating every AI system the same way.

Start With Visibility and Accountability

Effective AI governance starts with knowing what is running, where it is used and who is responsible for it. From there, organisations can classify risk, apply appropriate controls, monitor what changes and give leadership a clear view of the risks that require attention.

As AI use grows, that structure needs to remain current. New systems enter the operation, existing systems change and responsibilities shift. Governance works when those changes are reflected in the inventory, ownership and controls around them.

Envisago’s AIVOM™ Reading assesses where the operation currently stands across Value, Design, Capability and Performance, including the areas that affect governance and accountability.

Start your free reading at aivom.envisago.com.