AI usage control (AIUC) is a category of security software that finds the third-party AI tools employees use, including the ones nobody approved, and enforces the organization's rules on what may be typed, pasted or uploaded into them at the moment it happens. That is our wording, not Gartner's. Gartner's own public summary, on the abstract page for its Market Overview for AI Usage Control published 20 August 2026, says these tools "discover AI usage, assess risk and enable security policy enforcement for employee use of third-party AI applications." The category sits beside CASB, DLP and the AI gateway rather than replacing them. What sets it apart is the thing it inspects: the prompt, the upload and the agent action, not the file or the domain.
Gartner's Peer Insights page abbreviates it AI-UC; most vendor posts write AIUC. Same category.
Last verified: 20 October 2026, against the public abstract page for Gartner's Market Overview for AI Usage Control, the Gartner Peer Insights AI Usage Control market page and Gartner's press release of 26 August 2026, all read from archived copies (captured 28 September, 23 April and 2 October 2026) because gartner.com refused our automated requests. The public page for Gartner's Solution Criteria for AI Usage Control could not be opened, so its date comes from a search listing and is marked as such. No paywalled Gartner research was read.
Where did the term come from?
Gartner. Four public artifacts carry the name; only their public text is used.
The earliest is a research note titled Solution Criteria for AI Usage Control. According to the search listing for the Gartner page, which we could not open as of 20 October 2026, it is dated 13 January 2026 and names Dennis Xu and Odie Adesina as analysts. We have not read its criteria.
The second is the Gartner Peer Insights market page for AI Usage Control. Its public definition reads: "AI usage control (AI-UC) is a technology to discover the use of third-party AI and enforce the security policies of an organization." It lists key capabilities as "enforcing granular data-sharing policies, automatically detecting and cataloging all AI tools (including shadow AI), and moderating content by filtering sensitive data in real time". The archived copy we read, captured 23 April 2026, listed 20 products and states that reviews are individual opinions and that Gartner does not endorse any vendor listed.
The third is the Market Overview for AI Usage Control, published 20 August 2026, by Ashish Suraj Bhan, Peter Firstbrook and John Watts. The public abstract carries the summary quoted above and lists a Market Definition and an Example Vendors section inside the full research; we have not read either.
The fourth is a Gartner press release dated 26 August 2026, which divides the market for securing AI into "four main areas: AI application security, AI usage control, AI governance platforms, and AI gateways." Gartner forecasts AI usage control at $749 million in 2027, growing 73%, the fastest of the four.
What problem does AIUC solve that DLP and CASB do not?
Each neighboring category inspects something other than a prompt:
- CASB, cloud access security broker: sits between users and SaaS as a proxy or through the SaaS API, and decides which cloud apps may be used and what may be shared through them.
- DLP, data loss prevention: classifies content in files, email and endpoints and blocks or quarantines it when it matches a pattern or a label.
- SSE, security service edge: bundles the CASB with a secure web gateway and private access, delivered from a cloud edge, so the whole session passes through it.
- AI-SPM, AI security posture management: inventories the models, datasets, pipelines and agents your own teams build and scores their configuration against policy; it does not sit in the request path.
- AI gateway: an API layer between your applications and model providers that handles keys, routing, rate limits and spend, and can inspect the prompts your own software sends.
Three mismatches follow.
The prompt is not a file. A DLP engine fires on a document with a label or a pattern; a paragraph typed into a chat box has neither until something reads it as it is typed. The domain is sanctioned. A CASB that allows an office suite also allows the assistant inside it, and that assistant may send text to a model the CASB never sees as a separate app. The agent call is not a session. When an assistant calls a tool on a user's behalf, what matters is the query it ran or the file it wrote, and a session-level control has nothing to say about that.
Gartner's framing of the gap, in the August press release, is that "traditional security tools often treat AI applications like any other software and need significant updates to address AI-specific threats." The Peer Insights definition says the same: many discovery tools "treat AI applications as any other application". Our piece on AI security vs DLP vs CASB vs SSE explains why TLS interception and certificate pinning leave the network position blind to some of this traffic.
| Category | What it sees | Where it enforces | Agents covered? | Evidence produced |
|---|---|---|---|---|
| AI usage control (AIUC) | The prompt, paste, upload and response, per user and per AI tool, including unapproved tools | At the point of use (browser, endpoint or local inspection point), before data leaves | Varies by vendor; ask whether tool calls are inspected | Per-event record: user, tool, classifier hit, policy, action |
| CASB | Which SaaS app a session goes to, and what is shared through it | Proxy in the session path, or the SaaS API after the fact | No; a tool call is not a SaaS session | App usage and sharing logs |
| DLP | Labeled or pattern-matching content in files, email and endpoints | Endpoint agent, email gateway, file store | No | File and message incidents |
| AI-SPM | Inventory and configuration of the models, pipelines and agents you build | Nowhere inline; engineers fix findings | As inventory and posture, not at runtime | Posture findings and risk scores |
| AI gateway | Prompts and responses your own applications send to model APIs | In the API path between your app and the model | Only model traffic routed through it, not tool calls | Request logs, token and spend records |
Read the table as a map of blind spots. A CASB and an AI gateway can both be present, and an employee on a personal AI account in a home browser is outside both. An AI-SPM tool can list every agent your engineers built and miss the one a sales rep installed yesterday. AIUC is the category Gartner drew around that remaining space; our AI control plane hub covers how the categories compose into one policy layer.
Press hardest on "agents covered?". The term spans products that only watch a chat window and products that inspect what an agent does with a tool. That is why the checklist gives agents a group of their own.
The 25-question AIUC evaluation checklist
Put each question to the vendor as written and score on evidence shown.
Discovery
- How do you find AI tools used through a personal account, with no SSO and no corporate network involved?
- Do you detect AI features inside sanctioned SaaS, such as the assistant in a CRM or an office suite, or only standalone AI sites?
- How many tools does your catalog hold today, and how soon after a new tool launches does it appear?
- Can you show which identity used which tool, when, and whether the account was corporate, personal or shared?
- Do you discover MCP servers, browser extensions and locally installed agents, or only web traffic?
Inline control
- At what point do you inspect a prompt: before it leaves the browser or app, at a proxy, or after the fact from logs?
- Which actions can one policy take on a single prompt: allow, warn, redact a field, block the request, or require a justification?
- What is your p99 added latency on an inline decision, measured on what traffic, and will you commit to it in the contract?
- How do you treat pasted text, file uploads, screenshots and voice input differently?
- Do you need TLS interception or a root certificate on the device, and what happens with certificate-pinned apps if you do?
Agent coverage
- Do you see the tool calls an agent makes, such as a database query, a file write or an outbound email, or only the prompt that started the session?
- Can a policy block one specific tool call for one specific agent, rather than blocking the agent's model traffic as a whole?
- How do you tie an agent's action back to the human who started it, or to the service identity it runs under?
- Which items in the OWASP Top 10 for Agentic Applications do you address in product, starting with ASI02 Tool Misuse and Exploitation and ASI03 Identity and Privilege Abuse?
- Can an agent be paused or stopped from your console, and how long does that take to take effect?
Evidence and audit
- For one blocked event, can you show the full record: user, tool, policy, classifier hit, action, timestamp, and whether the content was stored?
- Can we export evidence per control for ISO/IEC 42001, SOC 2 and the NIST AI RMF, rather than as raw logs we must map ourselves?
- Are logs tamper-evident, and what is the default retention period?
- Can a DPO or an external auditor get read-only access without going through a security administrator's console?
- How do you report coverage gaps: the devices, users or tools that are not being inspected at all?
Deployment and privacy
- What has to be installed or changed: a browser extension, an endpoint agent, a proxy setting, an API connector? Which are mandatory?
- Where is prompt content processed and stored, in which region, and for how long?
- Can inspection run inside our own cloud account or on our premises?
- How do you avoid becoming a copy of our most sensitive data: redaction before logging, hashing, or no content retention at all?
- What is the realistic time from contract to first enforced policy at current customers, and can we speak to two of them?
What should a buyer do now?
- Write the rule before the RFP. Decide which classes of data may go to which classes of AI tool. Without it, every demo looks fine.
- Run discovery before you buy anything. The baseline usually surprises: 82% of organizations discovered previously unknown AI agents in the past year, according to a Cloud Security Alliance and Token Security survey from April 2026.
- Pick three live scenarios. A paste of realistic customer data into a public chatbot, an upload of a labeled document into a sanctioned assistant, and an agent making a tool call. Run all three on every shortlisted product.
- Send the questionnaire with the checklist. Our 50-question AI vendor security questionnaire is useful here because it covers the vendor's own security posture, which the 25 questions above leave out.
- If agents are in scope, add the agent RFP. Our AI agent security RFP maps its questions to OWASP ASI01 through ASI10, so answers to the agent coverage group can be scored against a named risk rather than filed.
- Score the evidence, not the demo. Ask for the exported record of your three scenarios and judge the product on what that file holds.
Thirty days is enough if the scenarios are chosen on day one.
What software can do here, and what it cannot
No product decides which data may leave the company. The CISO, the DPO and the business write that rule, and an AIUC deployment is only as good as it. Software cannot say whether a use of AI is lawful in a jurisdiction, and no AIUC tool makes an organization compliant with a law or a standard.
What software can do is see the moment of use and act on it. AccuroAI discovers 1,400+ AI tools, inspects prompts and uploads with 40+ data classifiers, and redacts or blocks in line at the point of use, without TLS interception. It logs every event against a user and a tool, so the evidence group has something to export. The archived Peer Insights page listed AccuroAI among its 20 products; as that page says, a listing is not an endorsement. Our workforce AI governance page covers the deployment options questions 21 to 25 ask about.
Judge us by the same 25 questions.
Frequently asked questions
Is AI usage control the same as AI-SPM?
No. AI-SPM inventories and scores the AI your own teams build and is not in the request path. AIUC watches employee use of third-party AI at the moment of use. Many enterprises will run both.
Is AIUC a Gartner Magic Quadrant?
Not on any public Gartner page we could find. What is public is a Peer Insights market, a Market Overview dated 20 August 2026 and a Solution Criteria note that search listings date to 13 January 2026.
Is this the same AIUC as the AIUC-1 standard?
No. The Artificial Intelligence Underwriting Company also uses the letters AIUC, and its AIUC-1 is a certification standard for AI agents that accountants have started offering alongside SOC 2. Gartner's AI usage control is a product category, not a standard, and the two are unrelated.
Does AI usage control cover AI agents?
The public Gartner definition covers third-party AI use by employees and does not mention agents. Some products inspect agent tool calls and some do not; ask questions 11 to 15 first. For the adjacent category, see our guide to what an AI agent gateway is.
We already have SSE with an AI app category. Do we still need AIUC?
Test it. Run the three scenarios above through the SSE and read what the log shows for the sanctioned-assistant paste and the agent tool call. If both are visible and blockable at field level, you may not.
How big is the AI usage control market?
Gartner's press release of 26 August 2026 forecasts AI usage control at $749 million in 2027, with 73% growth, inside a securing-AI market of almost $4.8 billion that year and almost $7.7 billion by 2028. We have not seen the underlying report.
This is not legal or audit advice; an auditor or counsel should confirm what your control set requires.
Sources
- Market Overview for AI Usage Control, Gartner, 20 August 2026 (public abstract page)
- AI Usage Control Reviews and Ratings, Gartner Peer Insights (public market definition)
- Gartner Forecasts the Market for Securing AI Will Reach $4.8 Billion in 2027, Gartner press release, 26 August 2026
- Solution Criteria for AI Usage Control, Gartner, gartner.com/en/documents/7332830: title, date and analysts from a search listing only; page not opened
- OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security, 9 December 2025
- Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, Cloud Security Alliance and Token Security, April 2026