As AI adoption accelerates, governance lags behind

For many organizations, the debate around AI governance still centers on regulation: will governments introduce new rules, how strict will they be, and how much time remains before compliance becomes mandatory?

That question could take years to answer.

The more immediate challenge is that AI adoption is already moving at pace. Recent research from OneTrust found that 74% of organizations report departmental or scaled AI adoption. Yet 47% describe their AI governance processes as reactive, slow or manual, and just 5% say they have clear coordination and accountability across the AI lifecycle.

Together, these figures reveal a troubling gap between AI adoption and the governance needed to manage it effectively. As organizations embed AI into everyday workflows, build processes around it, and make decisions influenced by its outputs, that mismatch creates growing risk.

Awareness hasn’t caught up either

In addition to the lack of clear governance, our own latest survey reveals many organizations struggle with policy awareness.

Only 31% of respondents say their organization has an AI policy and that they know what it covers. But one of the most revealing statistics is that 21% of respondents are unsure whether their organization even has an AI policy. This points to a broader communication issue. Many organizations have invested significant effort in drafting policies and guidance. But creating rules is only half the story. A key part of governance is ensuring those rules are understood, adopted, and embedded into day-to-day decision-making.

When one in five employees can’t say whether a policy exists, organizations should question whether governance is reaching the people it’s designed to protect. 

Leaders and employees aren’t seeing the same picture

Senior leaders are expected to oversee AI risk, approve investment decisions, and ensure responsible deployment. Yet our research shows a significant awareness gap between those at the top of organizations and those expected to work with AI day to day.

Owners and partners were the most well-informed about their organizations’ AI governance policies, with nearly 60% saying their institutions had AI guidelines in place, and they were familiar with the details. Non-managers and apprentices/trainees were the least knowledgeable, with only 15% and 14%, respectively, being familiar with their company’s AI policy. This disconnect creates a risk that governance remains concentrated among leadership teams rather than becoming embedded across the organization.

For governance to be effective, it can’t be confined to boardrooms or policy documents. Employees need to understand not just that rules exist but how those rules shape their use of AI in practice. 

Governance makes way for innovation

Organizations can only realize AI’s potential when leaders have confidence that the right controls, accountability, and oversight are in place. As Richard Beck, QA’s Director of Cyber, notes, “Governance should not be viewed as a barrier to innovation but as an enabler of responsible adoption.”

This is especially important as AI use becomes increasingly decentralized. Without clear ownership, communication, and accountability, organizations risk creating environments where AI adoption grows faster than their ability to manage it.

Regulation is not the starting point

Regulators may eventually define minimum standards, but policy alone can’t create accountability or build trust. Organizations need to establish those foundations themselves. That means assigning ownership, communicating policies clearly, educating employees, and ensuring leaders understand both the opportunities and risks associated with AI.

Organizations that have already built the behaviors, accountability, and oversight needed to make the rules effective will be better placed for success when regulation finally arrives.