Governing Bring Your Own AI: A Parameterized Maturity Model
Researchers propose a parameterized governance model and maturity ladder for Bring Your Own AI, finding data exposure and compliance dominate BYOAI risks.
The paper studies Bring Your Own AI (BYOAI), where employees use personal generative AI accounts such as ChatGPT, Gemini, and Claude outside enterprise identity and security controls. Drawing on a curated corpus of 30 records (24 studies and 6 framework documents), the authors build a risk taxonomy, a five-level governance maturity ladder, and a parameterized model linking control-layer coverage to residual risk. Findings highlight data exposure and compliance as the most prominent risks, inconsistent framework engagement, and evidence that layered technical controls reduce modeled exfiltration risk more than prohibition-based approaches.
- BYOAI is employee-authenticated personal AI use outside enterprise identity and security controls
- Study analyzed 30 records, finding data exposure and compliance the top risk categories
- Five-level maturity ladder ties technical control coverage to residual risk outcomes
- Modeled results show layered controls cut exfiltration risk more than prohibition
From the original article
1 min read at arxiv.orgEmployees are increasingly using personally owned generative AI tools such as ChatGPT, Gemini, and Claude for their daily work. This practice is known as Bring Your Own AI (BYOAI), which is a distinct form of Shadow AI in which employee-authenticated personal accounts are used outside of enterprise identity and security controls.
By Dare Bello · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.