--- title: "AI governance enters its next phase: closing the confidence gap — Marsanne Studio AI watch" description: "According to EY, 98% of organisations have AI governance policies, but 69% lack in-house expertise and 36% have suffered a serious AI incident." url: "https://marsanne.studio/en/ai-watch/ai-governance-enters-its-next-phase-closing-the-confidence-33e1b0/" lang: "en" --- [Marsanne Studio](https://marsanne.studio/en/) [← Back to home](https://marsanne.studio/en/ai-watch) [← The AI watch](https://marsanne.studio/en/ai-watch) Data study · 15 September 2026 # AI governance enters its next phase: closing the confidence gap **Publication** EY (United Kingdom) **Authors** [Richard Jackson](https://www.ey.com/en_us/people/richard-jackson) , [John McLain](https://www.ey.com/en_us/people/john-mclain) **Published on** 15 September 2026 · read in the page structured data · updated on 16 September 2026 ## Summary The EY AI Risk and Governance Survey shows that AI governance in business is progressing but remains fragile. 98% of respondents say they have formal AI governance policies, but 69% are concerned about lacking the in-house expertise to develop them, and 47% have already bypassed the process for urgent deployments. Agentic AI increases the risks: 85% of organisations using it have systems acting without real-time human oversight, yet 49% have not updated their governance framework accordingly and 26% cannot detect unauthorised AI agents. On cybersecurity, 89% of decision-makers have encountered AI-related risks in the past year, and 36% have experienced an incident with a material negative impact. AI assurance reviews, carried out by 98% of organisations, reveal issues in 92% of cases, sometimes leading to systems being modified or shut down. Summary based on the full text of the article. [Read the article on EY →](https://www.ey.com/en_us/insights/assurance/ai-governance-has-entered-its-next-phase-closing-the-confidence-gap) ## Figures cited - 98 % organisations with formal AI governance policies respondents to the EY AI Risk and Governance Survey > « Nearly all respondents (98%) report their organization having formal AI governance policies in place » Source: EY AI Risk and Governance Survey - 69 % organisations with a fully unified AI governance policy respondents to the EY AI Risk and Governance Survey > « 69% say their organization has a fully unified AI governance policy in place » Source: EY AI Risk and Governance Survey - 69 % respondents concerned about the lack of in-house expertise to develop AI governance controls respondents to the EY AI Risk and Governance Survey > « Yet 69% are concerned that their organization lacks the internal expertise needed to effectively keep evolving its AI governance controls. » Source: EY AI Risk and Governance Survey - 47 % organisations that have bypassed their AI governance process for urgent deployments respondents to the EY AI Risk and Governance Survey > « About half (47%) say their organization has previously bypassed its AI governance process for urgent deployments. » Source: EY AI Risk and Governance Survey - 85 % organisations using agentic AI with at least a few agentic systems carrying out activities without real-time human intervention respondents whose organisation uses agentic AI > « Among respondents whose organizations use agentic AI, 85% say they have at least a handful of agentic AI systems in their organization executing activities such as running code, placing inventory orders or detecting cybersecurity incidents without real-time human intervention. » Source: EY AI Risk and Governance Survey - 49 % organisations using agentic AI whose governance framework has not yet been updated to include agentic AI risks respondents whose organisation uses agentic AI > « 49% of those whose organization uses agentic AI say their existing governance framework has not yet been specifically updated to include agentic AI risk and requirements » Source: EY AI Risk and Governance Survey - 26 % organisations using agentic AI that are unable to detect unauthorised AI agents internally respondents whose organisation uses agentic AI > « 26% cannot detect unauthorized AI agents operating internally » Source: EY AI Risk and Governance Survey - 89 % senior AI decision-makers who have encountered AI-related risks over the past year senior AI decision-makers among respondents > « Eighty-nine percent of senior AI decision-makers report encountering AI-related risks during the past year » Source: EY AI Risk and Governance Survey - 41 % respondents saying that executives lack visibility of all the AI tools used in the organisation senior AI decision-makers among respondents > « yet 41% say senior leaders do not have visibility into all AI tools currently operating within their organization » Source: EY AI Risk and Governance Survey - 36 % organisations that have experienced an AI incident or failure with a material negative impact respondents to the EY AI Risk and Governance Survey > « About a third (36%) say their organization has experienced an AI incident or failure that caused a materially negative impact, including data loss, financial damage, operational disruption and brand damage. » Source: EY AI Risk and Governance Survey - 81 % respondents concerned about a third-party cyberattack compromising AI tools respondents to the EY AI Risk and Governance Survey > « 81% say they are concerned about a third-party AI-enabled cyberattack compromising AI tools » Source: EY AI Risk and Governance Survey - 72 % respondents concerned about non-compliance with emerging AI regulations respondents to the EY AI Risk and Governance Survey > « 72% are concerned about their organization failing to comply with new or emerging AI-specific regulations » Source: EY AI Risk and Governance Survey - 98 % organisations carrying out a formal AI assurance review at least annually respondents to the EY AI Risk and Governance Survey > « 98% of respondents said their organization conducts a formal AI assurance review at least annually » Source: EY AI Risk and Governance Survey - 92 % organisations that found issues during their formal AI assurance review respondents carrying out formal AI assurance reviews > « 92% of those conducting formal AI assurance reviews found issues » Source: EY AI Risk and Governance Survey ## Classification **Country** Worldwide scope **Company size** All sizes **Industries** All industries, or industry not specified **Companies** EY (study author) **Keywords** AI governance, agentic AI, cybersecurity, regulatory compliance, risk management, AI audit EY sells AI services or products: its studies and publications should be read with that interest in mind. Entry written by Marsanne Studio from the cited article, with the help of an AI model (claude-sonnet-5). The rights to the article and its illustrations belong to EY and its authors. Entry translated from French by Claude Sonnet 5.5.