A significant majority of UK businesses that have adopted AI lack full identity and access management (IAM) controls across their systems. This governance gap creates risk when AI tools shape software development, handle customer data, or make decisions that affect business operations. The finding highlights why many organisations need better oversight of who can access AI systems, approve changes, and review outputs.
What the Data Reveals
The statistic—59% of AI adopters operating without comprehensive IAM controls—reflects a wider tension in how quickly AI has been rolled out. Teams eager to gain speed and insight have deployed AI tools faster than governance structures have caught up. Without full IAM controls, businesses cannot reliably track who used an AI system, when they used it, what decisions it made, or whether those decisions followed policy.
This gap is especially serious in software development and operations. When AI assists in writing code, approving deployments, or managing customer-facing services, every action needs a clear audit trail. If IAM controls are incomplete, a business cannot prove who authorised a change or whether an AI system's recommendation was sound.
Why IAM Matters in AI Development
Identity and access management is the foundation of accountable AI. It answers three essential questions: Who has permission to use this AI system? What can they do with it? Can we prove what they did? When those answers are unclear or missing, risk grows quickly. Regulators, customers, and internal audit teams all expect businesses to show that AI decisions are traceable and governed.
In AI-assisted software development specifically, IAM controls prevent unauthorised changes and ensure that every piece of code or configuration altered by an AI system has human approval and oversight. This is where Kinsugi's approach differs. Kinsugi works with reusable software modules, automated checks, and built-in governance so that approvals and checks happen by design, not as an afterthought.
The Business Impact of Governance Gaps
- Audit and compliance risk: Businesses cannot demonstrate that AI decisions followed policy or were properly authorised.
- Operational blindness: No clear log of who used AI tools, when, and what the outcomes were.
- Security exposure: Without full IAM, insider threat detection and access revocation become unreliable.
- Slower decision-making: Teams lack confidence in AI recommendations because they cannot verify who approved or tested them.
Moving Toward Full AI Governance
Closing the IAM gap requires more than buying tools. Businesses need to embed governance into how they develop and deploy AI. This means defining who can approve AI-generated code, who reviews its output, and how changes flow through the organisation. Automation plays a role here: when checks and approvals happen by design, fewer decisions fall through the cracks.
For software teams adopting AI, the priority is clear: build governance into your development process from day one. Assume every AI-assisted change needs human approval and an audit trail. Use reusable modules where possible, because they can embed the same checks and controls every time. The goal is to make good governance the natural state of how your team works, not a compliance box to tick after the fact.
What Comes Next
The 59% figure is a warning. It shows that AI adoption is outpacing governance maturity across the UK business sector. Organisations that act now to strengthen IAM and embed approvals into their AI workflows will build trust faster, reduce compliance risk, and move with confidence. Those that ignore the gap risk escalating scrutiny from regulators and loss of confidence from customers and staff.