Most organizations assume they will see their AI footprint. A 2026 survey of over 650 senior enterprise safety leaders discovered that 90% consider they’ve visibility into AI utilization throughout their group, but 59% concurrently affirm or suspect shadow AI is operating someplace inside it (Purple E book Neighborhood / ArmorCode, State of AI Danger Administration 2026). AI governance doesn’t begin with audit trails or compliance frameworks. It begins with closing that hole: realizing who’s utilizing AI, through which workspaces, and what it prices.
This information covers what to trace first, how utilization visibility pertains to frameworks just like the EU AI Act and NIST’s AI Danger Administration Framework, and why value monitoring is its personal governance drawback, not a footnote to it. For the broader image of AI observability, see What Is AI Observability? A Sensible Information; for the agent-behavior aspect particularly, see AI Agent Observability; for the build-vs-buy tooling determination, see AI Observability Instruments: Do You Want a Separate One?
Key Takeaways
- 59% of safety leaders affirm or suspect shadow AI of their group, although 90% consider they have already got visibility, a niche that utilization monitoring closes first.
- AI governance begins with adoption and utilization visibility (who, the place, how a lot), not with deep audit trails or compliance automation.
- Regulatory frameworks just like the EU AI Act and NIST’s AI RMF matter, however utilization visibility helps that compliance work reasonably than satisfying any particular regulation by itself.
- Token-based pricing means AI value scales with utilization in methods which might be simple to lose monitor of with out per-workspace or per-user breakdowns.
- 52% of organizations nonetheless lack a proper AI governance framework, regardless of near-universal AI adoption (Cycode, State of Product Safety for the AI Period 2026).
Why AI Governance Begins with Utilization Visibility, Not Audit Trails
The arrogance hole in AI visibility will not be a minor knowledge high quality difficulty. When 90% of safety leaders consider they’ve AI visibility however 59% additionally affirm or suspect shadow AI, the issue will not be that organizations lack governance ambitions; it’s that they’re governing AI they can not totally see. Separate analysis places a quantity on how widespread that is on the basis: 52% of organizations nonetheless lack a proper AI governance framework regardless of AI now operating in practically each enterprise perform (Cycode, 2026).
Because of this utilization visibility, not audit trails or coverage paperwork, is the sensible place to begin. An audit path solutions “what occurred on this particular interplay.” A governance coverage solutions “what ought to be allowed.” Utilization visibility solutions a extra primary query that has to return first: “is AI operating right here in any respect, and the way a lot.” With out that baseline, each audit trails and insurance policies are being utilized to a footprint no one can totally affirm.
For knowledge and analytics leaders particularly, this normally reveals up as a resourcing query earlier than it reveals up as a compliance query: which groups are literally utilizing AI options, is that utilization rising, and the place ought to governance consideration go first. Utilization knowledge solutions that with proof as a substitute of assumption.
What to Monitor: Adoption, Utilization, and Value per Workspace and Person
On the governance degree, three classes of utilization knowledge matter most, and all three have to be damaged down by workspace and consumer, not simply reported as an organization-wide whole.
Adoption. What number of workspaces or groups have not less than one energetic AI consumer, and what number of customers have triggered not less than one AI motion in a given interval. This helps shut the visibility hole for AI exercise inside the programs and workspaces you monitor.
Utilization quantity. What number of AI actions or queries ran, damaged down by workspace and by consumer. A single workspace producing a disproportionate share of exercise is price realizing about earlier than it turns into both a scaling success story or a governance blind spot. That is additionally the info level most certainly to feed into broader enterprise KPIs as soon as AI adoption turns into one thing management tracks alongside different operational metrics.
Value. Token utilization and question prices, damaged down the identical means. Token consumption is the main indicator right here: mixture spend tells finance what was spent; per-workspace and per-user breakdowns inform governance the place it was spent and whether or not that matches anticipated utilization.
Assembly EU AI Act, NIST AI RMF & GDPR Necessities
Regulatory frameworks are a serious driver of AI governance funding, however utilization visibility is finest understood as a basis for compliance work, not an alternative to it. The desk under maps what utilization visibility helps below every framework, and the place it stops.
| Framework | What utilization visibility helps | What it doesn’t cowl |
|---|---|---|
| EU AI Act | Proof about the place AI is deployed, who makes use of it, and operational utilization patterns that may assist monitoring and risk-management processes | Documentation, human oversight, and conformity necessities for high-risk programs |
| NIST AI RMF | Helps MAP by establishing utilization context and MEASURE by offering operational proof for monitoring and evaluation | The broader governance, danger identification, prioritization, therapy, and organizational processes throughout GOVERN, MAP, MEASURE and MANAGE |
| GDPR | Helps establish the place AI programs course of private knowledge | Knowledge minimization design, consent mechanisms, and the suitable to rationalization for automated selections |
The EU AI Act’s timeline is price realizing as a result of not all provisions apply on the identical time. The Regulation grew to become usually relevant on August 2, 2026, however the core necessities for high-risk programs have later dates: Annex III use instances apply from December 2, 2027, and Annex I programs embedded in regulated merchandise from August 2, 2028 (European Fee, AI Act Service Desk; Digital Omnibus on AI). NIST’s AI Danger Administration Framework, in contrast, is voluntary steerage reasonably than binding legislation, and GDPR predates most AI-specific regulation however nonetheless applies wherever AI programs course of private knowledge.
None of those frameworks are happy by utilization visibility alone, however realizing who used AI, the place, and the way a lot is the proof base the remainder of a compliance program, together with auditability and audit trails, is dependent upon. For a broader framework overlaying accountability, coverage infrastructure, and danger administration, see GoodData.AI’s enterprise blueprint for AI governance.
Uncover how GoodData.AI helps you construct, govern, and scale analytics, AI, and brokers from one platform.
Why Token-Primarily based Value Is Its Personal Governance Downside
Conventional software program prices scale with seats or infrastructure, each of that are simple to forecast and cap. Token-based AI pricing scales with utilization in a means that’s far much less predictable: a single workspace operating extra complicated queries, longer conversations, or a newly in style AI function can shift month-to-month value considerably with out anybody making an specific determination that ought to occur.
This creates a selected governance drawback: value overruns in AI programs usually are usually not the results of misuse or a safety incident, and barely rise to the extent of compliance violations on their very own. They’re the pure results of adoption succeeding quicker than anticipated, in a pricing mannequin the place no one set an higher certain. With out per-workspace or per-user value breakdowns, that sample is invisible till the whole invoice arrives, at which level the dialog shifts from governance to wreck management.
Treating value visibility as a governance perform, not only a finance one, modifications when the dialog occurs. A governance staff watching value developments per workspace can flag an uncommon spike whereas it’s nonetheless a knowledge level, not after it turns into a price range escalation. Inference value, mannequin alternative, and structure selections add one other layer to this; for a deeper technical have a look at what drives AI inference value in manufacturing, see The Hidden Value of AI Analytics. Seeing these prices early can be what makes them reducible, since levers like caching, sensible routing, and right-sized context can take away a big share of token spend.
How GoodData.AI Approaches AI Utilization Visibility At the moment
GoodData.AI approaches AI utilization visibility as a part of the analytics atmosphere itself reasonably than as a separate governance knowledge pipeline.
GoodData.AI Observability supplies group directors and analytics engineers with a ready-made view of AI exercise throughout their GoodData group. It tracks adoption and utilization throughout customers and workspaces, conversations, agent exercise, reliability, errors and timeouts, token consumption, and utilization developments.
The observability knowledge is collected robotically as customers work together with GoodData AI options and is uncovered by means of a normal GoodData workspace. Groups can subsequently discover the managed dashboards, filter the info, or lengthen the offered analytics with their very own metrics and visualizations.
This supplies a helpful operational basis for AI governance: groups can see the place AI is being adopted, which customers and workspaces are producing exercise, how completely different brokers are getting used, and the place unusually excessive token consumption or reliability points seem.
The place to Go From Right here
AI governance that begins with utilization visibility provides a corporation one thing audit trails and coverage paperwork can not: a factual reply as to whether AI is getting used, the place, and by whom, earlier than deciding what to manipulate extra deeply. That reply can be the quickest one to get, because it doesn’t require instrumenting each interplay earlier than it delivers worth.
In case your staff owns AI governance and needs utilization knowledge damaged down by workspace and consumer with out standing up a separate stack, see how GoodData.AI’s agentic analytics platform surfaces AI utilization out of the field, or request a demo to see it in motion.
Uncover how GoodData.AI helps you construct, govern, and scale analytics, AI, and brokers from one platform.
Regularly Requested Questions
Utilization visibility: realizing who’s utilizing AI, through which workspaces, and the way a lot. This closes the hole between organizations that consider they’ve AI visibility and the shadow AI that usually exists anyway, and it’s the proof base that later governance and compliance work is dependent upon.
Not by itself. Utilization visibility helps compliance work by offering the proof base for danger evaluation and monitoring, however the EU AI Act’s necessities for high-risk programs, which apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I), contain further obligations round danger administration, documentation, and human oversight that utilization knowledge alone doesn’t cowl.
Shadow AI is AI device utilization inside a corporation that runs outdoors official approval, monitoring, or governance processes. It’s common even in organizations that consider they’ve full visibility into their AI footprint; a 2026 survey discovered 59% of safety leaders affirm or suspect it regardless of 90% reporting confidence of their visibility.
As a result of token-based pricing scales with utilization in methods conventional software program licensing doesn’t. A single workspace can generate a disproportionate share of AI spend with out anybody deciding that ought to occur, and with out per-workspace or per-user value breakdowns, that sample stays invisible till the invoice arrives.
No. It’s voluntary steerage, not like the EU AI Act, which is binding legislation. Organizations use it as a structured method to figuring out and managing AI danger, organized round capabilities for governing, mapping, measuring, and managing danger.
It usually begins with knowledge and analytics leaders, since utilization visibility solutions governance and resourcing questions earlier than it turns into a compliance or authorized matter. As AI governance matures, possession usually expands to incorporate compliance, safety, and finance stakeholders working from the identical utilization knowledge.
