Apple @ Work: The browser is the biggest gap in your AI governance strategy

Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

Most IT teams have a reasonable handle on what AI apps are installed across their Mac environment. Your device management vendor can show you what’s running; policies can block which apps shouldn’t be there; and vendors have been adding AI visibility features over the past year. The app layer is mostly solved, but the browser remains a concern depending on your environment.

About Apple @ Work: Bradley Chambers has been an Apple IT admin since 2009. Through his experience deploying and managing firewalls, switches, a mobile device management system, enterprise grade WiFi, 1000s of Macs, and 1000s of iPads, Bradley will highlight ways in which Apple IT managers deploy Apple devices, build networks to support them, train users, share stories from the trenches of IT management, and ways Apple could improve its products for IT departments.

The app layer is the easy part

When AI governance topic comes up, it’s usually about:

Those are all actual questions that IT teams should know, and if they don’t, then that is priority one. If an employee installs an unapproved AI coding tool or a local model inference engine, IT can detect it, flag it, and automatically remove it. That part of the problem is largely within reach for any organization running a managed Mac fleet.

The browser is where data actually leaks

Here’s the bigger issue for most IT teams: an employee opens Safari or Chrome, goes to ChatGPT or Claude, logs into their free personal account, and uploads a corporate document to ask the model a question about it. No app was installed, and nothing shows up in your app inventory report from your device management vendor. The action happens entirely inside a browser that IT typically has no visibility into at the web application layer, depending on your filtering setup.

Jamf is addressing this directly with browser AI governance coming in Q4 2026. The capability will let admins identify the use of personal AI accounts in Safari, Chrome, Firefox, Edge, and other browsers, and enforce policies at the point of action, including blocking actions. I am very interested to see this in action once it arrives.

The enterprise browser approach

A different answer to the same problem is the enterprise browser, and I think many orgs will consider this going forward. Island is the most prominent example in this space that I’ve seen. The idea is that instead of trying to bolt governance into an existing browser from the outside that’s not necessarily native, you give employees a managed browser that IT controls from the ground up. Every use case happens inside a container IT governs, including which web AI tools employees can access, whether they can paste corporate data into a prompt, and what can be downloaded or uploaded to it.

The tradeoff is there, though. Asking employees to switch their primary browser is a harder ask than deploying a policy through an extension, and on Mac specifically, Safari is deeply integrated in ways that make replacing it as their daily browser likely to meet pushback. Chrome runs into the same problem. Island is growing rapidly, though. They recently announced a $400 million Series F round at a $ 6.4 billion valuation, and I think their model might end up being the default for many enterprises.

Ultimately, the tools to manage this are either just arriving or still in development; the policy frameworks haven’t caught up with the coming technical capabilities, and use cases change quickly.

Wrap up

AI governance on the Mac is not just about managing which AI apps are installed. It’s much harder than that. The browser is where corporate data actually moves to personal AI accounts, and it’s the part of the stack that traditional Apple management tools were never designed to govern at the web application layer. I expect this market to evolve a lot in the coming years.

Apple @ Work is exclusively brought to you by Mosyle, the only Apple Unified Platform. Mosyle is the only solution that integrates in a single professional grade platform all the solutions necessary to seamlessly and automatically deploy, manage, and protect Apple devices at work. Over 45,000 organizations trust Mosyle to make millions of Apple devices work ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

...