AI governance is harder to maintain at 500 employees than it was at 50, and harder still at 1,000. This is not because organisations become less diligent as they grow. It is because growth changes the nature of the problem faster than governance programmes are designed to respond.
At 50 employees, an IT Director can hold the SaaS estate in their head. They know which tools are in use, who approved them, and roughly what data each one touches. Shadow IT exists, but it is catchable. When a new AI tool appears, there is a reasonable chance someone will notice before it has been processing company data for six months.
At 500 employees, that model has already failed; usually quietly, and usually before anyone articulated that it had changed. The estate is too large and too fast-moving for any individual to maintain accurate mental inventory. The governance process that worked at 50 has not been redesigned; it has just become progressively less reliable. And the organisations that recognise this early enough to redesign their governance approach before scale breaks it are, in practice, a small minority.
What Scale Actually Does to an AI Governance Programme
Governance programmes are typically designed once and maintained incrementally. A set of policies gets written, an approval process gets defined, a register gets created. The assumption embedded in that design is that the organisation's AI and SaaS adoption will grow at a rate the programme can track.
Scale breaks that assumption consistently and in ways that compound each other. The volume problem arrives first: at 50 employees, five new SaaS tools per quarter is manageable. At 500 employees, five new tools per week; through formal procurement, team-level decisions, and individual sign-ups, is closer to reality. A programme designed for the first cadence cannot keep pace with the second, and the gap between them widens every month the design goes unchanged.
The knowledge distribution problem is less visible and more damaging. At 50 employees, the IT Director reviewing a new AI tool probably knows which teams will use it, what data those teams handle, and which existing systems it will connect to. At 500 employees, that contextual knowledge sits in different people's heads across different departments, and the reviewer may have none of it. The quality of governance decisions degrades not because the process changed, but because the information required to make good decisions is no longer in the hands of the people making them.
The surface area problem is the one organisations most consistently underestimate. AI features shipping inside existing tools, API connections made without procurement involvement, free-tier accounts adopted on personal email addresses, these categories of adoption were negligible at 50 employees and become the dominant mode of AI acquisition at 500. A governance programme designed before these categories mattered will not catch them when they do, because catching them requires discovery mechanisms the original design never included.
The Knowledge Concentration Problem
One of the most reliable patterns in organisations that have grown faster than their governance programmes is the emergence of individuals who become de facto custodians of what is actually deployed. The CISO who knows the AI tools in the environment because she reviewed each approval personally. The IT manager who maintains a personal spreadsheet is more accurate than the official register because he has been here long enough to track the gaps.
This feels like a solution. It is not. It is a fragility that compounds quietly.
When knowledge about the actual AI estate is concentrated in specific individuals, the governance programme's effectiveness depends on those individuals' continued presence, availability, and memory. When one of them is unavailable during an incident response, the investigation has to reconstruct the estate from indirect signals. When one of them leaves, they take knowledge with them that the official record does not contain. The register says what was approved. The departing employee knew what was actually running.
IAPP's AI Governance Profession Report 2025, surveying 671 organisations across 45 countries, found that only 1.5% of organisations are satisfied with their current level of ai governance staffing. The near-universal dissatisfaction reflects a recognition that the people-dependent model is not scaling, that knowledge concentration creates a fragility that headcount alone cannot solve, because the problem is structural rather than a simple shortage of resources.
Why Adding Governance Layers Makes This Worse, Not Better
The standard response to a governance programme that is struggling to keep pace with scale is to add layers. More approval stages. More documentation requirements. A larger review committee. A more comprehensive register template.
Each of these additions addresses a real gap. Collectively, they create a different problem: the governance process becomes slower and more burdensome at exactly the moment when the organisation's adoption rate is accelerating. Employees who might have engaged with a lightweight approval process when the organisation was smaller find that the scaled-up version requires effort that feels disproportionate to the risk. The avoidance pattern described in the companion article to this one, employees choosing the unofficial path because the official one costs too much; becomes more prevalent, not less, as governance layers accumulate.
Gartner's research on AI agent governance found that organisations applying uniform governance across all AI use cases, regardless of actual risk level, experience higher failure rates and operational rollbacks than those using proportional approaches. The same principle applies to SaaS and AI governance at scale: a one-size-fits-all process that treats a low-risk productivity tool with the same friction as a high-risk customer data processor does not produce better compliance. It produces more avoidance.
The Enterprise Risk Management Gap That Scale Creates
As organisations scale, the gap between their formal AI governance framework and the actual state of their AI estate tends to widen, not because governance stops trying, but because the mechanisms designed to maintain the framework were built for a smaller, slower-moving target.
The enterprise risk management consequence is that decisions get made on partial information. When an incident involves an AI tool that was never in the register, the response starts with a reconstruction exercise rather than a risk assessment. When a regulatory review asks for an Article 30 record of processing activities covering AI tools, the response reflects what the programme managed to capture rather than what the organisation is actually running. When a DORA supervisory review asks for an ICT third-party register, the completeness of that register reflects the AI compliance programme's capacity at scale, not the actual estate.
IBM's 2024 Cost of a Data Breach Report found that 35% of data breaches involved shadow data, data held in systems that organisations had not formally identified or governed. Scale is the primary driver of this category: the larger the organisation, the harder it is to maintain complete visibility of every system processing data, and the wider the gap between what is formally governed and what is actually running.
What Governance That Holds Together at Scale Actually Requires
Scaling governance is not the same problem as adding governance. The distinction matters because the typical response to a programme that is lagging the estate; more layers, more reviewers, more documentation, addresses the wrong constraint. The constraint at scale is not rigour. It is coverage. A more rigorous AI compliance process applied to 60% of the estate still misses 40%. Getting to 95% coverage requires a different kind of design, not a more demanding version of the existing one.
This requires shifting from a process that captures what went through the official approval channel to a process that discovers what is actually deployed, regardless of how it arrived. At 50 employees, these two things are close enough together that the distinction barely matters. At 500 employees, the gap between them is material, and at 1,000 employees, a governance programme that only reflects the approved estate is missing a significant portion of what is actually running.
Continuous discovery addresses the scale problem in a way that additional governance layers cannot. Discovery that combines identity provider signals, email and calendar metadata, financial and expense data, and browser-level telemetry produces a current picture of the actual estate, not a snapshot of what was approved last quarter. It catches the AI feature that is activated inside an existing tool on a vendor update schedule. It surfaces the free-tier account that never generated a corporate invoice. It finds the tool a team adopted during a project and did not report when the project ended.
Security governance designed to hold at scale runs discovery continuously rather than periodically, classifies tools automatically rather than manually, and routes each new tool to an appropriate review level based on its actual risk, rather than putting every tool through the same process regardless of what it does. The register stays current because the process that feeds it does not require a human to initiate each entry from scratch. At scale, that design difference is what separates a governance programme that reflects the actual estate from one that accurately documents the approved portion of it while the rest grows unchecked.
The governance programme that worked when 50 employees were there and has not been redesigned when the number became 500 has already made a choice. It has chosen to govern the approved estate while the actual estate grew without it. That choice was not a decision made by anyone in a meeting. It is something that happened gradually, through the same compounding of small gaps the article describes. The question is not whether to redesign the programme, it is how long the gap can be tolerated before the reconstruction exercise costs more than the redesign would have. At some point, the estate that grew unchecked becomes the thing that you are managing and not the governance programme you intended to build. - Ankur Arora, Co-Founder, Montro |
Frequently Asked Questions
At what scale does AI governance typically start to break down?
There is no single threshold, but the inflection point is usually somewhere between 150 and 300 employees, the point where the IT Director or CISO can no longer hold an accurate mental inventory of the estate, and where adoption events are happening faster than any manual review process can track. Below that point, a well-designed but relatively lightweight governance process can stay current. Above it, the same process starts to lag the actual estate, and the gap widens with every passing month unless the governance design is deliberately updated to match the new scale.
Why does adding more governance layers not solve the scale problem?
Because the problem at scale is not insufficient oversight, it is that oversight is applied to an incomplete picture of what exists. Adding approval stages, documentation requirements, and review committees makes the governance process more rigorous for the tools that go through it. It does nothing to surface the tools that bypass it. At scale, the proportion of adoption that bypasses the official process tends to grow, not shrink, as the process becomes more burdensome. More governance applied to the visible portion of the estate leaves the invisible portion ungoverned and increasingly large.
What is the knowledge concentration risk in SaaS governance?
It is worth naming this risk precisely because it masquerades as competence. The CISO who has maintained an accurate picture of the AI estate through personal review, or the IT manager whose spreadsheet is more reliable than the official register, looks like a governance asset; until they are unavailable, or until they leave. The fragility is invisible while they are present because the programme appears to be working. It becomes visible in the worst possible moment: an incident response where the investigation cannot proceed without knowledge that was left with a former employee, or a regulatory review where the register's accuracy depended on a single person's memory rather than a documented process. The fix is not to find better individuals. It is to stop designing governance programmes that require specific individuals to function.
How does SaaS and AI estate growth create regulatory compliance exposure?
Regulatory obligations under GDPR Article 30, DORA Article 28.3, and the EU AI Act Article 26 all require records and oversight that reflect the current, actual state of what an organisation is running, not what went through formal procurement. As the estate grows faster than governance can track, these records become progressively less accurate. The compliance exposure is not created by the growth itself but by the gap between what the records say and what is actually running. At scale, that gap tends to be larger, older, and more expensive to close than it was when the organisation was smaller.
What does proportional AI governance mean in practice?
Proportional AI governance matches the level of review and documentation required to the actual risk level of each tool, rather than applying the same process to every AI tool regardless of what it does or what data it touches. A free-tier note-taking tool with no personal data processing requires different treatment from an AI platform making customer-facing decisions with sensitive financial data. Proportionality matters at scale because a flat process that treats all tools identically becomes too burdensome for low-risk tools and too permissive for high-risk ones. Organisations that maintain governance accuracy at scale typically use risk classification to route tools to appropriate review levels rather than a single universal process.
