AI product management · Industry brief

The British Standards Institution launched three AI assessment schemes in October 2024 targeting high-risk biometric systems under the EU AI Act, large language model applications, and product-level AI risk management. The schemes address growing market demand for independent validation of AI safety and reliability, with BSI research showing only 25 percent of business leaders have formal AI governance programs. BSI is piloting the biometric conformity assessment while working toward designation as an EU AI Act Notified Body, following Annex VII procedures for technical documentation and quality management review. The product-level assessment uses the NIST AI Risk Management Framework and ISO/IEC 23894 standards. Competing assessment services are expanding in the market, including DEKRA (accredited by the Dutch Accreditation Council for biometric AI conformity assessment), SGS, TÜV SÜD, TÜV Rheinland, and others offering gap analysis, technical testing, and voluntary certifications. These services serve different purposes: mandatory third-party conformity assessment is required for certain high-risk systems under the EU AI Act to achieve market access, while voluntary assessments support procurement, due diligence, and governance decisions for other AI products.

The global shadow AI risk and governance market was valued at USD 1.0 billion in 2025 and is projected to reach USD 8.7 billion by 2033, growing at a CAGR of 31.0% from 2026-2033. North America leads with 42.3% revenue share in 2025, while Asia Pacific is the fastest-growing region. The market is driven by organizations' need for visibility into unauthorized AI tools, data protection, and AI governance frameworks as enterprises expand AI adoption across business functions. Shadow AI Discovery & Visibility held the largest segment share at 26.2% in 2025, with cloud deployment and large enterprises dominating adoption. Growing regulatory requirements around AI governance are encouraging companies to formalize AI governance frameworks and strengthen oversight of AI-related risks. Key recent developments include Cisco Systems launching Cisco Cloud Control in June 2026 for unified AI agent management and governance, and expanding Cisco AI Defense in February 2026 with AI supply chain governance capabilities. BigID collaborated with Amazon Web Services in May 2025 as a launch partner for AWS's Data & AI Governance and Security initiative. SailPoint Technologies launched Shadow AI Remediation in March 2026 to detect unauthorized AI tools and prevent sensitive data uploads. The market remains moderately fragmented with competition among large technology providers (Cisco, Microsoft, Palo Alto Networks) and specialized vendors (Credo.AI, BigID, SailPoint).

The Conference of State Bank Supervisors (CSBS) released a principles-based Artificial Intelligence Supervisory Framework designed to help state examiners assess AI use and associated risks at state-chartered banks and state-licensed nonbank financial institutions. The framework, based on resources from the National Institute of Standards and Technology, Cyber Risk Institute, and U.S. Department of the Treasury, includes guidance on governance and oversight, AI inventories, generative AI use cases, third-party vendor risk, model risk, and consumer protection. Financial institutions can use the framework to evaluate their AI programs, strengthen governance and risk management practices, and prepare for state examinations, though adoption will be determined individually by each state regulatory agency, so institutions should monitor state-specific supervisory guidance as it develops.

Microsoft and NVIDIA published "Risk Management for Open-Weight Models in Enterprise," a joint framework grounded in ISO standards and the NIST AI Risk Management Framework to help enterprises assess and manage risks when deploying open-weight AI models. The paper introduces a shared risk taxonomy organized into five categories—Cybersecurity, Data Protection, Content, Human-AI Interaction, and Bias—and maps evaluations to specific risks, emphasizing that weight openness alone does not determine an AI system's risk; rather, risk depends on the model, use case, deployment context, and implemented safeguards. The guidance connects identified risks to controls that can operate across model, inference, application, and operational layers, with plans for future extensions across runtime and application layers and a joint repository for shared evaluation resources.