Most enterprise AI governance programs start in the wrong room. A committee is formed, a policy is drafted, an approval workflow is stood up — and only afterward does someone ask the question that should have come first: what AI is actually running inside this organization right now? Gartner's own research suggests the honest answer, for most enterprises, is that nobody fully knows. The average global Fortune 500 enterprise is projected to be running more than 150,000 AI agents by 2028, up from fewer than 15 in 2025, and today just 13% of organizations believe they already have the right AI agent governance in place. A policy that governs a category nobody has counted is not really governing anything yet. It is aspirational text sitting on top of an unmapped surface.
This is not an argument against writing an AI policy — every enterprise needs one. It is an argument about sequence. The organizations struggling hardest with AI governance right now are rarely the ones without a policy; most have one, or are close to finishing one. They are the ones that wrote the policy before building the one asset every other control in the framework depends on: a current, complete inventory of what AI is actually in use, who owns it, what it can touch, and how it got there. Third-party risk teams learned this lesson about vendors years ago — a vendor policy is worthless without a vendor inventory to apply it to. The same lesson now applies, on a faster clock, to AI.
The Sprawl Is Already Larger Than Most Governance Programs Assume
Speaking at the Gartner Digital Workplace Summit in April 2026, Senior Director Analyst Max Goss laid out the scale problem in stark terms: as CIOs and IT leaders watch AI agents multiply across their organizations, many are already contending with an ungoverned sprawl that exposes the business to misinformation, oversharing, and data loss — and Gartner's own projection, an average global Fortune 500 enterprise running over 150,000 agents by 2028 against fewer than 15 in 2025, describes a roughly ten-thousand-fold increase in barely three years. Only 13% of organizations told Gartner they believe their current AI agent governance is adequate to that trajectory.
A separate, independently fielded study points to the same conclusion from a different angle. The 2026 CISO AI Risk Report, based on a structured survey of 235 CISOs, CIOs, and senior security leaders at large enterprises across the United States and United Kingdom, found that 75% have already discovered unsanctioned AI tools running in production environments — and a further 16% are not sure whether they have or not, meaning roughly nine in ten organizations either know they have an unmapped AI surface or cannot rule it out. The same research found 92% of CISOs report they lack full visibility into AI identities operating inside their environment, and shadow AI now ranks as CISOs' single largest risk concern, ahead of phishing and ransomware.
Numbers at that scale change what "governance" has to mean operationally. A committee reviewing a handful of AI tool requests a quarter is a reasonable model when the population of AI in use is small and grows through a formal request process. It stops being a reasonable model once the population is being generated continuously — by employees adopting tools on their own, by vendors shipping AI features into products already in use, and by internal teams standing up agents without routing the decision through any central process at all. None of those three growth paths waits for a committee meeting.
Crest's Agentic GRC practice builds the AI governance layer enterprises actually need — starting with continuous discovery and inventory of AI tools and agents across the business, not a policy document sitting on top of an unmapped environment.
Explore Agentic GRCWhy Policy-First Gets the Order Backwards
Gartner's own six-step framework for managing AI agent sprawl is instructive precisely because of where it places the inventory step. Step one is establishing agent governance and policies — clear rules for when and how agents are built, who can create and share them, and what connectors are permitted. Step two, immediately after, is building a centralized agent inventory, using AI trust, risk, and security management tooling to discover and categorize agents across both sanctioned applications and shadow AI. Only once that inventory exists does Gartner's framework move to defining identity and permission models, information governance, behavioral monitoring, and culture. The sequence Gartner describes is policy, then inventory, then everything else — and that is a defensible design on paper.
Where it breaks down in practice is execution speed. A policy is a document; it can be drafted, reviewed, and signed off in a single cycle, and once it exists, the organization can point to it as evidence that AI governance is "in place." An inventory is not a document — it is an operational capability that has to be built, populated across every business unit, and then kept current as new tools and agents appear. Most organizations complete step one and stall on step two, because step two requires sustained operational investment rather than a single approval. The visible result is a policy binder that describes rules for a population of AI tools and agents nobody has actually counted, which is close to the exact scenario Goss warned against: organizations that resort to blocking or restricting AI usage because they cannot govern what they cannot see, only to push employees toward less visible, higher-risk shadow AI instead of the sanctioned alternative the policy was meant to channel them toward.
The practical fix is not to abandon policy-first thinking, but to treat the inventory as inseparable from the policy rather than a follow-on project. A policy without an inventory to apply it to is not incomplete governance — it is not yet governance at all, in any sense an auditor, a regulator, or a board member examining an AI incident after the fact would recognize.
Three Places Enterprise AI Actually Lives
A large part of why AI inventories stay incomplete is that most governance conversations focus on only one of three distinct surfaces at a time, leaving the other two effectively uninventoried even after real work has gone into the first.
Employee-adopted tools are the surface most people mean when they say "shadow AI" — a personal AI writing assistant, a browser extension that summarizes documents, an AI feature inside a personal productivity tool, all adopted because they help someone get work done faster, without going through procurement or security review. Crest has covered this surface directly in why shadow AI is becoming the new shadow vendor problem, and it remains real ground: it is the surface most existing endpoint and network-monitoring tooling is best positioned to detect.
Vendor-embedded AI is the surface that arrives inside products an enterprise already approved, through a routine feature update rather than a new purchase — an HR platform's AI screening feature, a CRM's AI-drafted outreach, a customer-analytics tool's new predictive layer, none of which triggered a new vendor onboarding because, formally, no new vendor relationship was created. Crest's piece on why an AI inventory should start with the vendor inventory a TPRM program already maintains goes deep on this surface specifically, and argues a mature vendor list is the fastest starting point for finding it.
Internally built and deployed agents are the surface Gartner's 150,000-agent projection is really describing — agents engineering, operations, finance, or customer-service teams build and deploy themselves, often using low-code or agent-building platforms that put agent creation within reach of people well outside a formal AI governance function. This is the fastest-growing of the three surfaces by volume, and the one least likely to appear on any existing vendor list or endpoint scan, because nothing was purchased and nothing was installed from outside the organization — the agent was assembled internally, sometimes in an afternoon.
What a Complete AI Inventory Has to Cover
- All three surfaces, not the one that's easiest to scan. Employee-adopted tools, vendor-embedded features, and internally built agents each need their own discovery method — no single tool finds all three.
- A named owner per entry, not a department. "Marketing" is not an accountable owner; a specific person who can answer for a specific tool's use is.
- Capability, not just presence. A vendor relationship existing is not the same fact as a new AI capability inside that vendor's product going live.
- Currency over completeness-at-a-point-in-time. An inventory finished once and never refreshed is already stale against a population growing by the day.
- A record of approval status, not an assumption of it. Most discovered AI use was never formally approved or denied — it simply started, and the inventory has to say so honestly.
Crest's TPRM Platform maintains a living vendor inventory as a starting point for AI-capability discovery, and Crest's TPRM Agents apply the same continuous, AI-assisted classification approach to AI tools and agents themselves — across all three surfaces, not just the vendor-delivered one.
An Eight-Point Framework for Building an Enterprise AI Inventory
None of these eight checks is conceptually new — they mirror the discipline mature TPRM and IT asset-management programs already apply elsewhere. What is new is the urgency of applying all eight consistently across a population of AI tools and agents that is growing continuously, rather than treating inventory-building as a one-time project that can be marked complete.
AI Tool & Agent Discovery
Surface every AI tool, browser extension, embedded feature, API integration, and autonomous agent in active use, not just what was formally requested or purchased.
Business Owner Identification
Attach a named, accountable individual owner to every discovered tool or agent, not a department name that diffuses responsibility.
Provider & Model Mapping
Record which vendor, foundation model, and version powers each entry, since capability and risk change with every model or provider update.
Data Access & Permission Scope
Document exactly what data, systems, and credentials each AI tool or agent can reach, and whether that access exceeds its stated purpose.
Purpose & Business Process Mapping
Tie each AI use to the specific business process or decision it touches, rather than a generic productivity or efficiency label.
Criticality & Risk Classification
Score each entry by the sensitivity of the data it touches and the reversibility of the decisions it can make or influence.
Approval & Policy-Fit Status
Flag whether each discovered tool or agent has been through a formal review against current policy, or is running on tacit, undocumented approval.
Continuous Monitoring & Re-Discovery
Refresh the inventory on a standing basis rather than a periodic audit cycle, since new agents and feature updates outpace any static registration process.
Skip step one and every downstream control — access review, incident response, audit evidence — is built on a partial map. Skip step eight and a complete inventory built today is already degrading the moment a new agent-building platform gets adopted next quarter. Crest's own work on why continuous monitoring is becoming an AI governance requirement, not just a TPRM feature covers the currency problem in more depth once an inventory baseline exists — this framework is what that baseline needs to look like before continuous monitoring has anything reliable to monitor.
Where Agentic AI Fits in Building the Inventory Itself
There is a genuine irony in using AI to inventory AI, and it is worth addressing directly rather than skating past it: the same category of technology creating the sprawl problem is also the most credible way to keep pace with it. A security or compliance analyst can manually catalogue a few dozen high-visibility AI tools. Nobody can manually catalogue an environment approaching Gartner's projected 150,000 agents per enterprise, and nobody can keep a manual catalogue current when new agents and feature updates are being created continuously rather than in scheduled batches.
This is precisely the role Gartner assigns to AI trust, risk, and security management tooling in step two of its own sprawl-management framework: continuous discovery and categorization of agents across both sanctioned applications and shadow AI, feeding a centralized inventory that adaptive controls can then be built on top of. Applied to the eight-point framework above, agentic AI can run continuous discovery across application, integration, and API traffic to surface new tools and agents as they appear; cross-reference each discovery against known vendors, model providers, and prior entries to avoid duplicate or stale records; and flag entries missing an owner, a data-access scope, or an approval determination, so a human reviewer's attention goes to the gaps rather than to re-verifying what is already well documented. What agentic AI does not do is decide whether a given tool or agent should be approved, restricted, or retired — that risk-acceptance judgment stays with a named governance owner, working from a complete and current picture the AI assembled rather than a static snapshot someone had to go looking for.
This piece connects to several angles Crest has already covered on the accountability and audit-trail side of AI governance. Once an agent is inventoried, the question of who is accountable for its decisions is covered in GRC becoming agent-ready — but who is accountable for an AI agent's decision, and the evidentiary mechanics of proving what an agent actually did are covered in why AI agents need audit trails too. The identity dimension specifically — AI agents as a distinct, fast-growing non-human identity population inside the enterprise — is covered in the fastest-growing identity in your enterprise isn't human. Read together, the pattern across all four pieces is the same: an enterprise cannot govern, hold accountable, audit, or manage the access of an AI agent it has not first found.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
Shadow AI usually refers to one specific surface of the inventory problem: AI tools employees adopt on their own, outside any procurement or security review, such as a personal AI writing assistant, a browser extension, or an AI feature switched on inside an already-installed app without anyone requesting it. It is a real and significant surface, but it is only one of at least three. Vendor-embedded AI arrives inside products an enterprise already approved, through a routine feature update rather than a new purchase. Internally built and deployed AI agents are created by engineering, operations, or finance teams themselves, often outside the formal AI governance process, and are the fastest-growing category by volume. An inventory that only hunts for shadow AI in the classic sense will miss the other two surfaces entirely, and Gartner's agent-sprawl projections suggest the internally built category is where the numbers are heading fastest.
Gartner's six-step framework for managing AI agent sprawl lists establishing governance policy first and building a centralized agent inventory second, but the practical sequencing problem shows up in how organizations execute those two steps. A policy is a document that can be finished in a single drafting cycle. An inventory is an operational capability that has to be built, populated, and kept current — and most organizations stop at the document. The result is a policy that states what should happen without a system of record showing what is actually happening, so the policy has nothing concrete to apply itself to. Gartner separately found that only 13% of organizations believe they already have the right AI agent governance in place, which is consistent with a governance layer sitting on top of an incomplete map rather than a genuinely ungoverned environment.
A mature third-party risk management program already tracks which vendors an enterprise uses, who owns each relationship, and what data each vendor can access — and that vendor inventory is a genuinely useful starting point, since a meaningful share of enterprise AI exposure arrives through vendors an organization already approved. But an AI inventory has to go further than the vendor list in two directions. First, it has to capture AI that isn't a vendor relationship at all — agents and tools built internally by a company's own teams, which never appear on a procurement record because nothing was purchased. Second, for AI that is vendor-delivered, a vendor-level entry ("we use this CRM platform") is not the same as an AI-capability-level entry ("this CRM platform's AI feature, enabled in the March update, can now draft outbound customer communications using our data") — the vendor inventory tells you the relationship exists, not that a new AI capability inside it needs its own risk review.
Crest's earlier piece on starting an AI inventory from the vendor inventory focuses specifically on one of the three surfaces described here: AI capability arriving inside products an enterprise already approved, and the practical argument that a mature TPRM vendor list is the fastest, most complete starting point for finding it. This piece takes a broader view, arguing that vendor-embedded AI, employee-adopted shadow AI, and internally built agents all belong in a single inventory discipline, and that the sequencing failure — writing governance policy before any of the three surfaces has been mapped — is the more fundamental problem a governance program needs to solve first, regardless of which surface an organization tackles initially.
A handful of high-visibility AI tools can be catalogued manually by a security or compliance team. An environment approaching Gartner's projected 150,000 agents per Fortune 500 enterprise by 2028 cannot be inventoried that way, and cannot stay current through periodic manual audits either, since new agents and tool updates are created continuously. Agentic AI and AI trust, risk, and security management tooling apply continuous discovery across applications, integrations, and API traffic to surface AI tools and agents as they appear, classify them against a common risk taxonomy, and flag entries where an owner, data-access scope, or approval status is missing or stale. The decision to approve, restrict, or retire a given tool or agent remains with a named human owner and the governance function overseeing it — the AI accelerates discovery and classification, not the risk-acceptance judgment itself.