Employee adoption is exposing data and operational risks as firms struggle to track AI use and enforce internal policies.

Employee adoption is exposing data and operational risks as firms struggle to track AI use and enforce internal policies. Modern applications now combine internal code with open-source packages, cloud services, AI-generated code, models and third-party tools. JFrog research found that 60% of Singapore DevSecOps stakeholders regard governance and policy enforcement as their largest time burden, whilst 41% said reviewing AI-generated code drains resources. Eighteen per cent of Singapore organisations have policies against unauthorised AI tools but no mechanism to detect violations, according to Rao. “An AI policy does not equal AI control,” he said, warning that outright bans could push usage further underground.