Governing Bring Your Own AI: A Parameterized Maturity Model

2026-09-04

AI Summary

研究针对员工使用个人AI工具（BYOAI）带来的风险，通过文献综述构建了一个参数化治理模型，以评估不同治理成熟度对降低剩余风险的影响。

Abstract

Employees are increasingly using personally owned generative AI tools such as ChatGPT, Gemini, and Claude for their daily work. This practice is known as Bring Your Own AI (BYOAI), which is a distinct form of Shadow AI in which employee-authenticated personal accounts are used outside of enterprise identity and security controls. Existing frameworks were designed for AI tools managed by organizations, and their coverage does not extend to unmanaged AI tools used with a personal account. In addressing these issues, we developed a governance model through a systematic review of the literature that produces a risk taxonomy and a framework-engagement profile. We also developed a parameterized governance model that measures how much a level of governance maturity reduces residual risk. A five-level maturity ladder is coupled to a technical control architecture through a chain in which the coverage of the control layer influences the security outcomes. Our study of a curated corpus of 30 records (24 research studies and 6 framework documents) indicated that the most prominent categories identified were data exposure and compliance, and framework engagement was inconsistent. Three mutually supporting pillars (technical, governance, and human) were established to support safeguards. Additionally, the results of the model demonstrated that prohibition-based solutions will result in residual risk levels close to those achieved through baseline solutions. Under the specified parameterization, layered control-based solutions substantially reduce modeled exfiltration risk and increase enforceable coverage.

Problem

• Bring Your Own AI
• Shadow AI
• governance model
• risk taxonomy
• security controls

Innovation

• Parameterized Maturity Model
• Bring Your Own AI (BYOAI)
• Risk Taxonomy
• Governance Framework
• Layered Control Solutions