As AI adoption accelerates, governance lags behind

For many organisations, the debate around AI governance still centres on regulation: will governments introduce new rules, how strict will they be, and how much time remains before compliance becomes mandatory?

That question could take years to answer.

The more immediate challenge is that AI adoption is already moving at pace. Recent research from OneTrust found that 74% of organisations report departmental or scaled AI adoption. Yet 47% describe their AI governance processes as reactive, slow or manual, and just 5% say they have clear coordination and accountability across the AI lifecycle.

Together, these figures reveal a troubling gap between AI adoption and the governance needed to manage it effectively. As organisations embed AI into everyday workflows, build processes around it, and make decisions influenced by its outputs, that mismatch creates growing risk.

Awareness hasn’t caught up either

In addition to the lack of clear governance, our own latest survey reveals many organisations struggle with policy awareness.

Only 31% of respondents say their organisation has an AI policy and that they know what it covers. But one of the most revealing statistics is that 21% of respondents are unsure whether their organisation even has an AI policy. This points to a broader communication issue. Many organisations have invested significant effort in drafting policies and guidance. But creating rules is only half the story. A key part of governance is ensuring those rules are understood, adopted, and embedded into day-to-day decision-making.

When one in five employees can’t say whether a policy exists, organisations should question whether governance is reaching the people it’s designed to protect. 

Leaders and employees aren’t seeing the same picture

Senior leaders are expected to oversee AI risk, approve investment decisions, and ensure responsible deployment. Yet our research shows a significant awareness gap between those at the top of organisations and those expected to work with AI day to day.

Owners and partners were the most well-informed about their organisations’ AI governance policies, with nearly 60% saying their institutions had AI guidelines in place, and they were familiar with the details. Non-managers and apprentices/trainees were the least knowledgeable, with only 15% and 14%, respectively, being familiar with their company’s AI policy. This disconnect creates a risk that governance remains concentrated among leadership teams rather than becoming embedded across the organisation.

For governance to be effective, it can’t be confined to boardrooms or policy documents. Employees need to understand not just that rules exist but how those rules shape their use of AI in practice. 

Governance makes way for innovation

Organisations can only realise AI’s potential when leaders have confidence that the right controls, accountability, and oversight are in place. As Richard Beck, QA’s Director of Cyber, notes, “Governance should not be viewed as a barrier to innovation but as an enabler of responsible adoption.”

This is especially important as AI use becomes increasingly decentralised. Without clear ownership, communication, and accountability, organisations risk creating environments where AI adoption grows faster than their ability to manage it.

Regulation is not the starting point

Regulators may eventually define minimum standards, but policy alone can’t create accountability or build trust. Organisations need to establish those foundations themselves. That means assigning ownership, communicating policies clearly, educating employees, and ensuring leaders understand both the opportunities and risks associated with AI.

Organisations that have already built the behaviours, accountability, and oversight needed to make the rules effective will be better placed for success when regulation finally arrives.