Most organizations running Apple devices have already deployed AI in some form. A recent survey of 687 IT and security leaders across Apple enterprises found that nearly three-quarters have AI running somewhere in their environment, from team-level pilots to deep integration into daily workflows. The conversation now has moved past whether companies are adopting AI, and is now focused on seeing what AI is doing within the company.
That’s the gap AI governance is focused on closing, which is a different problem than traditional device management solutions were built to solve.
AI Doesn’t Behave Like Traditional Software
When an employee installs a typical app, IT has a reasonably complete picture of what it does. AI tools break that pattern. A developer running Claude Code or Cursor is running something with model access, MCP server connections, and the ability to take autonomous action on the codebase in front of it. Configuration state and runtime behavior for these tools are in raw JSON that shifts with every vendor update, and that is invisible to the tools IT already has in place.
This brings a level of risk that shows up in two distinct populations. Developer teams working with agentic coding tools can face code exfiltration risk, unrestricted model access, and autonomous agents acting without a policy boundary. For the broader workforce, using personal AI accounts to upload documents or query business systems creates less technical but equally real exposure risks. The problem most organizations face is that they don’t have visibility into these risks.
The numbers back this up. 81.7% of organizations in the survey say they’re exposed to AI risk, and 22% have already had a cost or security incident tied to AI. The organizations who have the deepest AI integration have nearly a 40% higher incident rate than those still exploring, showing that adoption and risk move together.
AI Framework: Visibility, Control, and Governance
Closing the gap comes down to three connected stages.
- Visibility comes first. You can’t govern what you can’t see. Right now, most organizations can see the device, but not what the AI running on it is actually doing. Much of that blind spot is Shadow AI, which are tools, models, or features employees adopt on their own without IT or security approving or even knowing about them. Working on visibility means surfacing every AI tool on the fleet, sanctioned or not. It also means knowing what launched it, what it’s connecting to, and which invocations carry real risk.
- Control comes next. Visibility tells you what is happening, and control lets you decide what should be allowed to happen and enforce it. For Mac fleets, that means vendor-correct configuration for tools like Claude Code, Claude Cowork, and OpenAI Codex, deployed at the OS level.
- Governance is the stage most teams haven’t reached quite yet, and it also is the one leadership is asking for more and more. Once policy is in place, someone needs to be able to monitor it is being followed with things like an audit trail, a clear picture of sanctioned versus ungoverned tools, and reporting.
Most organizations are pursuing all three of these stages at the same time. Automating IT operations, deploying AI productivity tools, and establishing AI governance are being prioritized at nearly identical rates. Governance is moving right alongside AI adoption.
Why This Belongs at the OS Level
Network-based tools like CASBs can show which cloud AI services a device is hitting, but that visibility stops at the network edge. Even when the AI itself runs in the cloud, the access itself happens on the device.
It makes sense to govern AI the same way Mac fleets are already managed, natively through the device management solution already in place. Jamf for Mac now includes this capability directly at no added cost to existing customers. It starts with policy support for Claude Code, Claude Cowork, and OpenAI Codex via AWS Bedrock. Curated postures (Permissive, Balanced, and Strict) deploy as a Blueprint in a single session with no manual JSON editing required. A Governance Report ships alongside every configuration, including an audit trail and a crosswalk against EU AI Act and NIST AI RMF requirements, which covers a defined set of control families.
Where to Start
AI Governance is available now. For both new and existing Jamf for Mac customers, provisioning generally happens automatically. The capability may just need to be turned on.
Organizations that have been using Jamf for several years may still be licensed on an older Jamf product that doesn't include AI Governance. In those cases, migrating to the current Jamf for Mac offering is required to gain access.
If your team is expecting AI Governance but doesn't have access yet, first confirm you're licensed for the current Jamf for Mac offering that includes AI Governance. If you're unsure, reach out to MBS and we'll help determine your eligibility and next steps.
A practical first step is the same regardless of where you are in launching the new tool, and that is to start working on the visibility stage. Working to understand what AI tools are already running on the fleet will give you a good place to start the moment your organization turns AI Governance on.
—
Mac Business Solutions is a certified Apple and Jamf partner specializing in enterprise Apple device management, lifecycle services, and IT infrastructure for commercial and federal clients.
Apple, the Apple logo, and Mac are trademarks of Apple Inc., registered in the U.S. and other countries and regions.
Want to learn more?
Contact MBS to discuss classroom technology for your district.
