Forrester warns of shadow AI governance gap in Asia Pacific

Forrester has published its 2027 Asia Pacific predictions report, warning that one in three large enterprises in the region will face a shadow AI agent governance problem.

The research and advisory firm said large organisations across Asia Pacific are likely to uncover at least 10 employee-built shadow AI agents for every officially sanctioned agent, as staff-built tools, embedded software features and locally chosen AI platforms spread faster than internal controls.

It said this would create a new layer of technical debt tied to unmanaged risk, weaker governance, duplicated functions and undocumented dependencies. Forrester argued that executives in the region will need to focus less on the speed of AI deployment and more on control, governance and accountability.

Governance shift

The report sets out a broader view of how AI use in Asia Pacific is changing as deployments move across organisational, geopolitical and human boundaries. It highlights the challenge of governing systems in a region where markets, regulation and AI maturity vary widely.

Among its other projections, Forrester said one in five large regulated enterprises will approve Chinese open-weight models. It said the shift reflects a broader definition of sovereignty, extending beyond data residency to include control over models and inference.

Greater visibility into model weights and bias could persuade some enterprises to approve self-hosted Chinese models where they meet operational sovereignty requirements, even if concerns remain over provenance and geopolitics.

Another prediction is that an employee's personal AI agent will trigger an incident at a Fortune 500 company. According to the report, growing consumer use of AI means more workers will bring personal agents into the workplace, giving them access to corporate devices, credentials and data for work-related tasks.

This exposes a gap in existing security systems, which tend to verify identity and access rather than intent. In that scenario, an agent carrying out an apparently routine task could misuse its privileges or expose sensitive information.

Human oversight

Forrester also forecast that 10 of Asia Pacific's largest consumer-facing brands will seek to differentiate themselves through human assurance. The report said brands pursuing more personalised AI-led services will make human oversight standard in high-consequence interactions, particularly where financial risk, emotional vulnerability or complex decisions are involved.

It added that businesses in sectors such as financial services and healthcare are likely to continue pairing AI-led experiences with access to human experts and licensed advisers, especially where trust is critical.

The forecasts underline how AI adoption in Asia Pacific is broadening from controlled pilots and centralised deployments to more fragmented use across business units, software products and consumer tools. That raises governance questions not only about security and compliance, but also about who is responsible for the actions of autonomous or semi-autonomous systems.

For large enterprises, the issue is likely to be particularly acute where software suppliers add AI features directly into existing products, allowing staff to use agent-like tools without formal technology approval. Combined with business-funded experimentation and region-specific platform choices, this can leave central technology teams with incomplete visibility into how AI is being used.

Forrester's view suggests governance structures in Asia Pacific may need to be more localised than in other regions. Companies operating across multiple jurisdictions may have to navigate different rules on data handling, model hosting and accountability while also responding to customer expectations around transparency and human involvement.

Frederic Giron, Vice President and Senior Research Director at Forrester, said the region's diversity would make governance a central issue for companies scaling AI.

"In 2027, the challenge for Asia Pacific organizations will be to establish AI governance protocols in a region with distinctly diverse markets, regulatory requirements, and levels of AI readiness," Giron said.

"Organisations that adapt their governance to local sovereignty requirements while investing in building long-term trust and resilience with their customers will be better positioned to capture AI's value."