Most US companies still lack mature AI governance

AI adoption is moving faster than governance

AI agents are moving into business operations quickly. 86% of organizations are testing AI agents, while nearly half already have them in production. This is no longer limited to small experiments. AI systems that can take actions with greater autonomy are becoming part of real workflows.

Governance has not advanced at the same speed. Although nearly all companies are spending on AI governance, only 64% have a formal AI acceptable-use policy that they actively communicate to employees. Just 57% maintain formal policies, and 44% have incident-response procedures designed specifically for AI.

That gap matters. Autonomous AI can make decisions, interact with software, process sensitive information, and perform tasks with less human intervention. As its autonomy increases, companies need to know what systems are operating, what data they can access, who owns the associated risks, and what happens when something goes wrong.

For executives, the objective should not be to slow AI deployment. The better approach is to make governance capable of scaling with deployment. Clear ownership, access controls, monitoring, testing, employee policies, and incident procedures should become part of how AI products move from experimentation into production.

More governance does not automatically mean better governance. A large collection of policies can create bureaucracy without reducing risk. The relevant question for boards and management teams is whether controls work in practice. Governance needs to match the level of autonomy, business impact, and risk of each AI system.

The opportunity remains substantial. Companies that establish practical controls early can continue experimenting while creating a stronger foundation for larger deployments. The goal is controlled acceleration: move quickly, understand what is being deployed, and maintain enough visibility to intervene when necessary.

Technology leaders are accountable for AI they do not fully control

The accountability problem is becoming difficult to ignore. An IBM Institute for Business Value study found that two-thirds of CIOs and CTOs are held accountable for AI systems they do not fully control. AI is spreading through organizations faster than traditional IT functions can track it.

There are several reasons. Employees can access external AI services directly. Business units can purchase AI-enabled software without developing the underlying models themselves. Existing applications are also adding AI capabilities. As a result, responsibility can remain with the CIO or CTO even when deployment decisions, data access, and day-to-day use are distributed across the company.

Autonomous agents raise the stakes because they can perform sequences of tasks rather than simply produce information for a human to review. A Deloitte study found that only one in five companies has a mature model for governing autonomous agents. Weak governance in this area can increase exposure to security vulnerabilities and operational failures.

The executive response needs to extend beyond the IT department. AI governance requires defined responsibilities across technology, cybersecurity, legal, compliance, risk, procurement, and the business teams actually using the systems. Senior leadership should establish who can approve AI deployments, who monitors them, who accepts residual risk, and who has authority to suspend a system.

Visibility is equally important. An organization cannot effectively govern AI systems it cannot identify. Companies therefore need an accurate inventory of deployed AI, including third-party systems, along with information about ownership, data access, intended use, and risk level.

Accountability without authority creates a structural governance problem. If CIOs and CTOs are responsible for AI outcomes, they also need sufficient visibility and decision rights to manage those outcomes. At the same time, centralized IT cannot realistically own every AI decision. The stronger model distributes operational responsibility while maintaining enterprise-wide standards and executive oversight.

This is ultimately about making AI scalable. Clear accountability can reduce unmanaged deployments, accelerate approvals for lower-risk applications, and focus executive attention on systems with the greatest potential impact. As AI becomes more autonomous, that discipline becomes increasingly important.

Autonomous AI requires continuous oversight

AI governance cannot end when a system enters production. This becomes more important as companies deploy autonomous AI agents that can plan tasks, make decisions, use software, and take actions with less direct human involvement.

Manimbo said that as organizations deploy more autonomous AI capabilities, governance should not be treated as a one-time exercise. Companies need continuous processes for oversight, accountability, and validation.

For executives, continuous oversight starts with visibility. Leadership needs to know which AI systems are operating, what they are authorized to do, which data and applications they can access, and who is responsible for their performance. These controls need regular review because AI models, connected systems, business processes, and regulations can all change after deployment.

Validation is also essential. Companies should routinely test whether AI systems continue to operate within defined limits and produce acceptable results. For higher-risk applications, this can include monitoring outputs, reviewing unusual behavior, testing security controls, maintaining audit records, and defining situations that require human approval. Incident procedures should establish who can restrict or stop an AI system when necessary.

There is a management nuance here. Continuous governance does not mean applying maximum oversight to every AI application. That can increase costs and slow useful innovation. Executives can instead use a risk-based approach. A low-impact internal productivity tool may require relatively simple controls, while an autonomous system handling customer data, financial decisions, critical infrastructure, or regulated activities deserves substantially stronger supervision.

The objective is to keep governance aligned with what the technology can actually do. As autonomous capabilities expand, controls should evolve with them. Companies that build this process into normal operations will be better equipped to increase AI autonomy without losing accountability.

Strong AI governance can create business value

Governance is often discussed as a way to reduce regulatory, security, and reputational risk. That is only part of its value. Schellman’s report found that organizations implementing meaningful AI governance reported improved internal efficiency, greater ease in scaling AI and innovation, and increased customer trust.

There is a practical reason. When employees understand which AI tools they can use, what information they can provide to those systems, and which approvals are required, uncertainty falls. Business teams can make decisions faster because acceptable practices are already defined. Technology and risk teams can also focus their attention on higher-risk applications instead of repeatedly resolving basic questions.

Governance can make AI expansion more manageable as well. A company with established standards for testing, approval, monitoring, data access, and accountability does not need to redesign its governance process for every deployment. Reusable controls can reduce friction as AI moves from individual experiments into broader business operations.

Customer trust is another important factor. Enterprise customers increasingly want evidence that vendors are managing AI responsibly, particularly when systems process confidential information or influence important decisions. Demonstrable controls can therefore become relevant to procurement, contract negotiations, security assessments, and long-term commercial relationships.

Executives should still be careful about interpreting the evidence. The source says respondents reported benefits from meaningful governance, but it does not provide numerical improvements in efficiency, innovation, or customer trust. Nor does the supplied text establish that governance alone caused these outcomes. More mature companies may have other capabilities that contribute to better results.

The strategic point remains useful. Effective governance should not be designed purely as a compliance function. When controls are clear, proportionate, and integrated into business operations, they can support faster decisions and more confident AI deployment. The strongest programs protect the organization while helping it scale technologies that create measurable value.

Regulatory readiness is becoming a core AI priority

AI regulation is moving higher on the executive agenda. A majority of companies said they were preparing to comply with U.S. regulations, while nearly one-third were preparing for the EU AI Act. This shows that governance is increasingly influenced by regulatory requirements across multiple markets.

For multinational companies, the challenge is broader than complying with one set of rules. AI requirements can vary by jurisdiction, industry, use case, and level of risk. An organization may therefore need to understand where an AI system operates, what decisions it influences, which data it processes, and which legal requirements apply.

The EU AI Act is particularly relevant because it uses a risk-based framework. Obligations become more demanding for certain higher-risk applications, while some AI practices are prohibited. The law also contains requirements affecting general-purpose AI models. For C-suite leaders, this means compliance decisions need input from legal, technology, security, risk, and business teams rather than being assigned to a single function.

Timing also matters. The EU AI Act entered into force on August 1, 2024, with requirements applying in stages rather than at one single deadline. Some provisions are already applicable as of 2026, while additional requirements are scheduled to take effect under the Act’s phased implementation. Executives should therefore assess the obligations relevant to their specific systems rather than treating the legislation as a future issue.

The U.S. environment is more fragmented. Companies can face federal requirements and guidance, state laws, sector-specific rules, and existing privacy, consumer protection, employment, and anti-discrimination obligations that may apply when AI is used. A governance program designed around a single anticipated federal AI law could therefore leave significant gaps.

Early preparation has a practical benefit. Companies that maintain inventories of AI systems, assign accountable owners, document risk assessments, and preserve evidence of testing and monitoring should be better positioned to respond as requirements evolve. The objective is not simply to pass a compliance review. It is to create processes that can adapt without repeatedly rebuilding the organization’s approach to AI risk.

AI governance has become a business requirement

AI governance is moving beyond an internal technology concern. Customers, regulators, boards, and business partners increasingly want evidence that companies understand how their AI systems operate and can manage the resulting risks. For senior executives, governance is therefore becoming connected to corporate oversight, commercial relationships, regulatory exposure, and growth strategy.

Avani Desai, CEO of Schellman, described this shift directly, stating that governance has moved from an optional factor in AI deployment to a mandatory one. She emphasized the growing expectation for companies to prove that governance works rather than simply show that policies exist.

This distinction matters. A company can have extensive AI policies and still have weak governance if employees do not follow them, responsibilities remain unclear, or deployed systems are not monitored. Demonstrable governance requires evidence. Depending on the system, that can include documented ownership, risk assessments, access controls, testing records, incident-response procedures, monitoring, audit trails, and records showing that employees understand acceptable AI use.

Boards also have a strategic role. They do not need to manage individual AI models, but they should understand where material AI risks exist, how management assigns accountability, and whether controls remain effective as deployment expands. Executive teams should be able to explain both the opportunities created by AI and the mechanisms used to control significant operational, legal, security, and reputational exposure.

There is an important nuance for leadership: governance should be proportionate to risk. Applying complex controls to every AI application can increase costs and slow adoption without producing equivalent benefits. Strong programs distinguish between relatively low-risk uses and systems capable of creating significant consequences for customers, employees, financial decisions, sensitive information, or regulated operations.

The commercial implications are becoming significant as well. Enterprise customers and business partners may request evidence of AI controls during procurement, security reviews, and contract negotiations. Companies that can provide credible documentation may find it easier to establish confidence in how they develop and use AI.

Desai summarized the longer-term business case: “The organizations that build trust through mature, demonstrable governance programs will be better positioned to scale AI, navigate regulatory change and create long-term business value.”

For C-suite leaders, that is the central objective. Governance should allow the company to deploy AI with greater confidence, respond to regulatory change, and prove to stakeholders that its controls work. As AI becomes more autonomous and more deeply integrated into business operations, that capability becomes increasingly important.

Key takeaways for leaders

• AI adoption is outrunning governance: With 86% of organizations testing AI agents and nearly half already using them in production, governance needs to scale at the same pace. Leaders should establish clear ownership, acceptable-use rules, monitoring, and AI-specific incident response.
• Close the accountability gap: Two-thirds of CIOs and CTOs are accountable for AI systems they do not fully control. Give technology leaders sufficient visibility and authority while assigning clear responsibilities across business, security, legal, and risk teams.
• Make AI oversight continuous: Autonomous AI changes after deployment as models, integrations, permissions, and use cases evolve. Use ongoing monitoring, validation, and risk-based controls rather than treating governance as a one-time approval.
• Make governance an enabler of scale: Strong governance is associated with better internal efficiency, easier AI scaling and innovation, and greater customer trust. Build reusable controls that manage material risks without creating unnecessary friction for lower-risk AI.
• Prepare for regulation now: Companies face evolving requirements across the U.S., EU, and other markets. Maintain AI inventories, risk assessments, accountable owners, testing records, and compliance evidence that can adapt as regulatory obligations change.
• Prove governance works: Customers, boards, regulators, and business partners increasingly expect evidence of effective AI control. Leaders should build demonstrable governance that strengthens trust while supporting responsible AI growth.