AI governance best practices for lean IT teams - LastPass

GUIDE

AI Governance best practices for lean IT teams

Only 27% of organizations have an actively enforced governance program, despite AI being in active use at 92% of organizations. See the practical framework lean IT teams can use to close the gap.

Download the report

Trusted by 100,000+ businesses worldwide · SOC 2 Type II, ISO 27001, ISO 27701 Certified · 4.5/5 on G2

Key stats: What the data shows

Source: The LastPass 2026 State of AI and SaaS Security Report. Insights based on survey responses from 412 IT leaders, login habits from 450,784 users across 20,631 organizations, and app usage at 15,907 organizations.

92% of IT leaders say AI is in use in their organization. But only 27% have a comprehensive, actively enforced governance program.

Why it matters: Many small to mid-sized teams are aware that AI governance is needed but don’t have a clear, simple path to implement it.  

2.5/5 is the average confidence score for detecting when sensitive data has been entered into an AI tool.

Why it matters: The confidence gap is a visibility problem, a reflection of what happens when a policy exists, but the controls to enforce it don’t.

42% of organizations have no technical controls for managing employee access to AI tools.

Why it matters: A policy without controls is intent, not governance. Without controls, employees are left to judge what’s safe, while IT struggles to respond effectively when risky tools are accessed. 

AI governance confidence: What IT teams rate themselves

Source: The LastPass 2026 State of AI and SaaS Security Report (based on responses from 412 IT leaders)

Confidence score: 1 = not at all confident, 5 = very confident.

  • Stopping inappropriate AI tool use: 3.0/5
  • Responding to AI-related security incidents: 2.8/5
  • Detecting unapproved AI tools in use: 2.6/5
  • Detecting sensitive data entered into AI tools: 2.5/5

Confidence ratings across all four governance capabilities fall below 3.5 out of 5.

The data consistently points to the need for visibility. Identifying the tools in use is an important first step toward effective governance.

What AI governance best practices actually means

If yours is a lean team, “best practices” means something more specific: a playbook that produces real governance outcomes without requiring staff you don't have.

Many AI governance frameworks, like those from Gartner or IBM, emphasize policies and controls, a common approach for organizations building governance for large-scale deployments.

But for 92% of organizations, AI adoption is already underway, which means the focus must shift to gaining control over existing AI use.

 

When you're catching up rather than building ahead, policy before visibility presents a challenge.

Your policy won’t reflect what's actually running, employees will ignore it, and you'll be back to the drawing board in six months.

Why governance breaks down before it starts: three patterns behind the confidence gap

Most IT teams responsible for AI governance don’t have dedicated security staff. They’re managing it alongside user support, infrastructure, and access management. Three common patterns appear among struggling teams:

  1. A total ban costs visibility: The LastPass 2026 State of AI and SaaS Security Report found that many IT leaders think complete bans on AI are counterproductive: They push activity outside approved channels and reduce the visibility you need to make informed governance decisions.
  2. Perfectionism creates delays: Why does governance stall? Many organizations wait for the “perfect” policy before acting. Delays in governance make shadow AI harder to control.
  3. Policy without a shared baseline generates resistance: What happens when governance starts before visibility? You get a situation where you have Marketing building workflows around Jasper, Engineering using GitHub Copilot, and Operations running Otter. Without a live inventory, governance discussions become debates about restrictions rather than conversations about risk.

All three challenges share the same root cause: governance with a policy before there’s an accurate picture of what it’s governing. Reversing this order is where effective AI governance begins.

Which governance obstacles are most common? The full findings are in the LastPass 2026 State of AI and SaaS Security Report.

 

Get the complete insights

Download the report

The governance sequence for teams catching up

The teams making meaningful progress on AI governance share one practice: They started with visibility, not policy. AI governance is most effective when visibility and policy development work together.

  1. Discover: Run the inventory before writing anything.
    The first inventory won't be complete, but it’s important to run it.
  2. Assess: Focus on the highest risk use cases first.
    The most effective teams don't attempt exhaustive assessments of every tool immediately. Instead, they prioritize the AI tools most likely to interact with sensitive data or critical systems.
  3. Classify: Match governance to risk.
    Rather than treating every AI tool the same, organizations increasingly use risk-based governance that allows for flexibility while maintaining control.
  4. Enforce: Use the right controls to back up your policy.
    Technical controls make your policy operational:
    •   LastPass Business Max continuously logs SaaS and AI access via the LastPass browser extension.
    •   With Business Max, admins can also apply risk-based rules at the point of access.

Use “Try LastPass Business Max free” or “Get a demo” to see how continuous discovery and risk-based access rules work.

Try LastPass Business Max free Get a demo

What AI governance looks like when it’s working

When discovery and enforcement are in place, five things shift.

  1. You can answer auditors’ questions with evidence: “Which tools are approved? How is usage monitored? What happens when an employee uses an unapproved tool?”
  2. You find out about new tools before sensitive data has moved at scale, not after.
  3. The binary choice between "approve everything" or "block it and lose visibility" disappears. The “warn” tier gives you a third option.
  4. The ability to show each team their specific AI tool usage data turns resistance into a shared problem-solving conversation.
  5. A live inventory and enforcement logs provide an audit trail for SOC 2, GDPR, HIPAA, or internal reviews.

If your organization is also navigating formal compliance requirements such as the EU AI Act, the next step is understanding which specific controls auditors will ask about.

Read: How to Prove AI Governance Compliance: 5 Controls Auditors Expect to See

AI governance: See how your organization compares

The LastPass 2026 State of AI and SaaS Security Report covers AI governance confidence ratings and control adoption rates reported by 412 IT leaders.

Get the complete insights

Download the report

Explore more in the AI & SaaS Security series

GUIDE

AI Governance Compliance: Policies, Controls, and Gaps

Read the guide

View all AI & SaaS security guides

FAQ: AI governance best practices

For lean IT teams, the most effective AI governance best practices follow a specific sequence: discover, assess, classify, enforce.

  • Discover means building a live inventory of AI tools in use.
  • Assess means evaluating each tool’s risk against two questions: Does it handle sensitive data, and does it connect to internal systems?
  • Classify means assigning each tool to a risk tier.
  • Enforce means using technical controls to make Classify operational.

LastPass Business Max can help you maintain a live inventory and apply risk-tiered controls as AI tool adoption grows.

A functional AI governance policy covers four areas:

  • A current tool inventory
  • Data handling rules by sensitivity tier
  • Credential and access controls
  • A review process for new tool requests

A current inventory is often the hardest requirement to maintain manually. LastPass Business Max provides continuous discovery of AI and SaaS apps in use, creating a stronger foundation for governance.

Discovery and initial classification can move quickly.

Most IT teams can build a minimum viable inventory of AI tools in use within 48 hours of enabling LastPass Business Max.

Writing and deploying policy typically takes longer, but sequence matters more than speed.

Most teams wait until every tool is vetted to publish policy. By then, the first set of tools may have changed their data processing terms. A 90% complete inventory you can act on today is more useful than a 100% complete inventory that's already outdated upon publishing.

Don't see your questions here? Visit Support Center.

Descubra LastPass para empresas

Probar LastPass gratis Contactar con un comercial
No hace falta una tarjeta de crédito para la prueba de 14 días.