Most IT teams already run a security stack for their organization to track things like web traffic, what apps are installed, and what runs on each device. Each of these does its job well, but AI tools work differently than the software those security systems were designed around.
Understanding why explains a lot about why so many teams feel like they have visibility and still can’t answer basic questions about AI usage on their fleet.
AI Tools Carry Settings That Matter
When an employee installs a normal business application, there isn’t much to decide. The application runs, does what it is designed to do, and the choices for the employee are minimal.
AI tools are different, with each one having unique settings that determine what it can reach, what data it can send, which model it talks to, and how much it can do on its own. Those settings often live on the device itself in configuration files, which means your network may not be able to see them.
What Each Tool Can and Can’t Tell You
Web filtering tools show which sites and services a device connects to, which can flag when employees are using AI services in a browser. They may miss how an AI application is installed on that same device or how it is configured.
Endpoint detection tools watch what is running on the device and can flag unusual behavior. These are not designed to evaluate if an application has settings that match your policy.
App inventory in your device management platform shows what is installed, and is clear and reliable for traditional software. AI tools add a layer of command-line tools and connections to other services, which inventory entries can miss.
Manual configuration is where many teams end up by writing the settings by hand for each tool. This works, but has to be redone every time a vendor updates something.
The Three Questions
If you put the tools you use together, you may still have three critical questions that go unanswered:
- Which employees are using AI, and how are they using it?
- How should these tools be configured?
- Can your organization show your policy decisions around AI and if those policies are being followed and enforced?
None of these questions are a shortcoming of the tools themselves because the tools are answering the questions they were built to answer. AI governance brings in different questions, and answering it means looking at the device itself.
Apple Built the Foundation for This
Apple platforms have an advantage for governing AI. macOS includes a management framework that allows IT to set configuration directly on the device wirelessly. These settings aren’t easily changed locally, which is exactly what AI governance needs.
Jamf built their new AI Governance capability on that foundation, and it is included in Jamf for Mac at no additional cost.
What Jamf for Mac with AI Governance Does
Jamf for Mac organized the new AI Governance feature around three things that build on each other, with each one designed to answer a question most organizations currently cannot.
- Visibilityanswers the question of which AI tools are being used at your organization, and if they are the ones that are approved for use. The tool surfaces which AI applications are running across your Mac fleet, along with the connections those applications are making to other services. This is built on Jamf Protect and uses data Mac already produces, so there is no additional software to install on your devices. It is often what gives organizations a complete list of what AI is actually in use for the first time.
- Control answers the question of how each tool should be configured, and if the tools in use are actually configured correctly. Once you know what is running, the policy builder lets you configure supported AI applications without writing the configuration by hand. Jamf translates each application’s enterprise controls into plain-language options, and you can choose from curated policy levels instead of having to build a configuration from scratch. The policies deploy through Jamf Blueprints in the same way your other device policies already deploy. They can also be scoped to specific teams so your engineering group and finance group don’t have to share one policy.
- Governance answers the question of if the policies you have decided on are being followed and enforced. Jamf generates a report your security team can hand to an auditor or bring to a board meeting to show which tools are sanctioned, how they are configured, and what has been enforced across the entire fleet. The report includes a crosswalk against EU AI Act and NIST AI RMF requirements for a defined set of control families.
There is also a tracking engine that monitors vendor releases and flags when an AI application’s controls change, so your policy stays current.
AI Governance That Works Like Everything Else
The practical case for this approach is that it does not require anything new. This capability is delivered through the same platform, Blueprints, and groups your team already uses. An organization does not need a separate system, additional infrastructure, or a new console for someone to learn to start using it.
For teams moving from broad AI restrictions toward something more precise, it’s the natural place to start. You can govern AI the same way you already govern everything else on the fleet, using capabilities Apple built into the platform for this exact kind of control.
A Practical First Step
The new AI Governance feature is available now, and for most Jamf for Mac customers, the capability may simply need to be turned on. Organizations that have been with Jamf for several years may still be licensed on an older product that doesn’t include it, in which case, migrating to the current Jamf for Mac offering is what unlocks access.
MBS can help you confirm your licensing, turn the AI Governance features on, and build a first policy that reflects how your teams actually work. Reach out and we’ll walk through what makes sense for your environment.
—
Mac Business Solutions is a certified Apple and Jamf partner specializing in enterprise Apple device management, lifecycle services, and IT infrastructure for commercial and federal clients.
Apple, the Apple logo, Mac, and macOS are trademarks of Apple Inc., registered in the U.S. and other countries and regions.
Want to learn more?
Contact MBS to discuss classroom technology for your district.
