Data study ·
AI governance enters its next phase: closing the confidence gap
- Publication
- EY (United Kingdom)
- Authors
- Richard Jackson , John McLain
- Published on
- 15 September 2026 · read in the page structured data · updated on 16 September 2026
Summary
The EY AI Risk and Governance Survey shows that AI governance in business is progressing but remains fragile. 98% of respondents say they have formal AI governance policies, but 69% are concerned about lacking the in-house expertise to develop them, and 47% have already bypassed the process for urgent deployments. Agentic AI increases the risks: 85% of organisations using it have systems acting without real-time human oversight, yet 49% have not updated their governance framework accordingly and 26% cannot detect unauthorised AI agents. On cybersecurity, 89% of decision-makers have encountered AI-related risks in the past year, and 36% have experienced an incident with a material negative impact. AI assurance reviews, carried out by 98% of organisations, reveal issues in 92% of cases, sometimes leading to systems being modified or shut down.
Summary based on the full text of the article.
Read the article on EY →Figures cited
-
98 %
organisations with formal AI governance policies
respondents to the EY AI Risk and Governance Survey
« Nearly all respondents (98%) report their organization having formal AI governance policies in place »
Source: EY AI Risk and Governance Survey
-
69 %
organisations with a fully unified AI governance policy
respondents to the EY AI Risk and Governance Survey
« 69% say their organization has a fully unified AI governance policy in place »
Source: EY AI Risk and Governance Survey
-
69 %
respondents concerned about the lack of in-house expertise to develop AI governance controls
respondents to the EY AI Risk and Governance Survey
« Yet 69% are concerned that their organization lacks the internal expertise needed to effectively keep evolving its AI governance controls. »
Source: EY AI Risk and Governance Survey
-
47 %
organisations that have bypassed their AI governance process for urgent deployments
respondents to the EY AI Risk and Governance Survey
« About half (47%) say their organization has previously bypassed its AI governance process for urgent deployments. »
Source: EY AI Risk and Governance Survey
-
85 %
organisations using agentic AI with at least a few agentic systems carrying out activities without real-time human intervention
respondents whose organisation uses agentic AI
« Among respondents whose organizations use agentic AI, 85% say they have at least a handful of agentic AI systems in their organization executing activities such as running code, placing inventory orders or detecting cybersecurity incidents without real-time human intervention. »
Source: EY AI Risk and Governance Survey
-
49 %
organisations using agentic AI whose governance framework has not yet been updated to include agentic AI risks
respondents whose organisation uses agentic AI
« 49% of those whose organization uses agentic AI say their existing governance framework has not yet been specifically updated to include agentic AI risk and requirements »
Source: EY AI Risk and Governance Survey
-
26 %
organisations using agentic AI that are unable to detect unauthorised AI agents internally
respondents whose organisation uses agentic AI
« 26% cannot detect unauthorized AI agents operating internally »
Source: EY AI Risk and Governance Survey
-
89 %
senior AI decision-makers who have encountered AI-related risks over the past year
senior AI decision-makers among respondents
« Eighty-nine percent of senior AI decision-makers report encountering AI-related risks during the past year »
Source: EY AI Risk and Governance Survey
-
41 %
respondents saying that executives lack visibility of all the AI tools used in the organisation
senior AI decision-makers among respondents
« yet 41% say senior leaders do not have visibility into all AI tools currently operating within their organization »
Source: EY AI Risk and Governance Survey
-
36 %
organisations that have experienced an AI incident or failure with a material negative impact
respondents to the EY AI Risk and Governance Survey
« About a third (36%) say their organization has experienced an AI incident or failure that caused a materially negative impact, including data loss, financial damage, operational disruption and brand damage. »
Source: EY AI Risk and Governance Survey
-
81 %
respondents concerned about a third-party cyberattack compromising AI tools
respondents to the EY AI Risk and Governance Survey
« 81% say they are concerned about a third-party AI-enabled cyberattack compromising AI tools »
Source: EY AI Risk and Governance Survey
-
72 %
respondents concerned about non-compliance with emerging AI regulations
respondents to the EY AI Risk and Governance Survey
« 72% are concerned about their organization failing to comply with new or emerging AI-specific regulations »
Source: EY AI Risk and Governance Survey
-
98 %
organisations carrying out a formal AI assurance review at least annually
respondents to the EY AI Risk and Governance Survey
« 98% of respondents said their organization conducts a formal AI assurance review at least annually »
Source: EY AI Risk and Governance Survey
-
92 %
organisations that found issues during their formal AI assurance review
respondents carrying out formal AI assurance reviews
« 92% of those conducting formal AI assurance reviews found issues »
Source: EY AI Risk and Governance Survey
Classification
- Country
- Worldwide scope
- Company size
- All sizes
- Industries
- All industries, or industry not specified
- Companies
- EY (study author)
- Keywords
- AI governance, agentic AI, cybersecurity, regulatory compliance, risk management, AI audit
EY sells AI services or products: its studies and publications should be read with that interest in mind.
Entry written by Marsanne Studio from the cited article, with the help of an AI model (claude-sonnet-5). The rights to the article and its illustrations belong to EY and its authors. Entry translated from French by Claude Sonnet 5.5.