AI governance is going backwards, and the data controls are what’s slipping

Why Is AI Governance Getting Weaker, While AI Adoption Accelerates?

IBM’s 2026 Cost of a Data Breach report shows that 68% of 602 businesses analysed lacked an artificial intelligence (AI) governance policy to manage AI and prevent shadow AI at the time of their breach. 35% had no policy at all, while 33% were still drafting one.

But the report’s more revealing insight is that five of the six governance controls measured declined year-on-year. As businesses increasingly deploy AI technologies, the common expectation is that governance will evolve accordingly. The data says otherwise. AI governance is losing ground, and the gap between adoption and governance is widening.

An effective AI governance strategy requires ongoing attention and adaptation to technological advancements and associated risks. As AI tools proliferate, you must actively maintain a robust governance framework prioritised at the beginning of your AI adoption journey. Without it, risks such as data breaches, compliance violations and reputational damage can spiral out of control.

So, if your business treats AI governance as an afterthought and a static document that requires a simple one-time sign-off, it’s bound to slide backward. Here are some strategies to help you avoid it.

Breaking Down the Decline of AI Governance Controls

When businesses implement AI governance, they rely on a series of controls essential for managing AI risks. These controls are interconnected because they involve ongoing and recurring operational activities rather than one-time deliverables.

Reviewing them will provide you with valuable insights for maintaining robust AI governance.

1. Strict AI deployment approval processes. Each new AI deployment needs a fresh review to ensure compliance with governance standards. That’s why approval processes are crucial. They ensure that every new AI project is thoroughly vetted before implementation. Nevertheless, this control has fallen from 45% to 38%, increasing the number of businesses at risk of deploying new AI systems without fully understanding their implications.

2. Use of AI governance frameworks or technology. AI governance software and tools are vital for effectively monitoring AI systems and ensuring adherence to standards and policies. To be beneficial, these tools require consistent maintenance and regular analysis of their outputs. However, the adoption of frameworks and technologies to support AI governance strategy has dropped for both controls, from 39% to 33%, undermining the foundations of businesses’ AI accountability.

3. Employee training on AI risks. Continuous education helps you ensure employees are informed about evolving AI-related threats, best practices and challenges. Nonetheless, training initiatives have dropped from 36% to 30%. Less training means that staff may base their decisions on outdated knowledge, which could lead to incorrect conclusions and increased vulnerabilities.

4. Regular audits for unsanctioned AI. Frequent audits integrated into operational workflows let you detect and mitigate unsanctioned AI usage. These measures enable you to protect sensitive data and ensure regulatory compliance. Still, this critical control has crumbled from 34% to 29%.

The Fundamental Difference Between Policy Documentation and Effective AI Governance

The above-mentioned controls are the first to deteriorate when business priorities shift because, when neglected, you won’t perceive any immediate consequences.

For instance, when new employees aren’t trained in AI best practices, you won’t notice any impact, at least initially. Yet this neglect may later cause significant issues, such as data leakage, data breaches or compliance failures.

In contrast, when you create policy documentation and leave it unchanged for months or even years, the policy remains on paper even if no one in the business is following it.

The growing gap between what your business documents and what it actually practices underscores governance’s evolving nature. It explains why effective AI governance relies on continuous maintenance and monitoring of operational activities.

However, even if your policies emphasise the importance of stringent governance, operational demands may still lead to the neglect of these essential controls. Recognising and addressing this gap becomes imperative to ensure a robust AI governance strategy and minimise associated risks.

Why Do Policies Survive While the Underlying Controls Erode?

The deterioration of governance controls isn’t exclusively due to negligence, and it’s more complex than it seems. In fact, governance often breaks down due to structural factors rather than a single failure of intent.

The Mechanisms Behind the Decline

Policies are typically developed during times of concentrated focus, usually triggered by events such as board inquiries, client security questionnaires, cyber security incidents, or regulatory deadlines.

However, once this immediate pressure fades, attention shifts elsewhere, while the AI ecosystem underneath those policies continues to evolve. Individual teams or departments adopt new AI tools, existing software vendors update products with new AI features that weren’t available during initial approvals, and employee turnover erodes the institutional knowledge of AI risks and regulations.

For example, a governance policy you drafted a year ago may still reflect a valid intent but could become almost completely disconnected from your current operational practices. As a result, the transition to a shadow AI environment, where workers adopt unapproved tools or practices, becomes more likely.

Most AI governance strategies don’t systematically track or highlight this drift. Consequently, this disconnection poses a significant risk for those businesses without systems to monitor how policy compliance aligns with changing operational realities.

Limited Resources Add to the Complexity

Resource allocation in many businesses complicates governance oversight. Frequently, the same small team manages AI governance, security operations, compliance and day-to-day IT delivery.

But recurring governance activities often fall through the cracks when resources are stretched thin and new priorities emerge. At first, delaying them may seem beneficial because there are no immediate negative repercussions, however it isn’t a solution.

Why Communication Between Your Governance and Security Teams Is Key

Another striking data point from the IBM report reveals that only 19% of businesses report any coordination between their governance and security teams. This lack of communication amplifies the negative consequences of declining governance controls.

When governance and security teams operate in silos, they create a predictable blind spot. Governance teams usually have a thorough understanding of the approved tools and practices within the business.

In contrast, security teams know which tools are actively running on the network and their associated risks. Unfortunately, neither perspective is enough on its own.

For instance, imagine your governance team approves an AI-powered recruiting tool based on actual assessments and policies. Six months later, the HR team using the tool quietly allows it to access more data than originally approved.

The change will go undetected by your governance team because the tool was already signed off, putting your business at risk of compliance issues and fines. At the same time, your security team would also miss this change because the tool was already on the approved list, leaving potential vulnerabilities unmonitored.

This shows how this disconnect can lead to significant oversights. For example, an AI tool that originates from an approved vendor may gradually become misaligned with governance policies as it evolves. Moreover, since 71% of businesses don’t audit unsanctioned tools identified by their security teams, all unauthorised use will remain undetected.

Can You Answer the Right Questions?

Ultimately, the real question isn’t just whether your employees are using AI, but rather what data these tools consume, where the data is sent, who has access to the outputs, and whether these activities are logged adequately to support post-incident analysis or regulatory scrutiny.

To address these questions, you need a robust data control strategy along with coordinated efforts between your governance and security teams. That’s what most businesses are missing, according to IBM’s 19% statistic. They simply don’t have the structural capacity to answer those operational queries effectively.

As a result, the risk of encountering unmitigated issues increases, leaving businesses vulnerable to security breaches, compliance failures and reputational damage.

Measuring Governance Decay: 4 Key Examples for IT and Security Leaders

As an IT Director or Chief Information Security Officer (CISO), you must adequately assess the health of your business’s AI governance. However, simply verifying that your business has governance policies in place isn’t enough.

AI policies describe intent and how people are supposed to use AI, but they are sometimes mistakenly assumed to cover broader governance issues, even if they don’t. In fact, a policy that only exists on file, isn’t governance.

Therefore, to measure your business’s governance decay effectively, assess how recent and relevant your current activities’ policies are.

The Methods

Here are four proactive approaches that you can use to measure your business’s governance deterioration.

Example # 1. Assess recency, not existence. While AI governance frameworks and AI policies have different purposes, they are both essential. Don’t ask your governance team only whether governance frameworks and an AI acceptable use policy exist. Instead, inquire when they were last reviewed against the actual tools currently in use. If the answer is that the AI policy hasn’t been updated in months despite the adoption of new AI tools, it already indicates that your governance is declining.

Example #2. Check unsanctioned tools’ audit frequency. Verify when your team last audited unsanctioned AI. If the audit isn’t recent or hasn’t been conducted regularly, your governance may lack proper oversight.

Example #3. Validate training completion rates. How many employees have completed AI risk training since they joined the business? A low rate may indicate that your employees aren’t adequately prepared to use AI responsibly.

Example #4. Inquiry about new tools deployed. Ask your IT team how many AI-enabled tools have been released since the last approval review. A backlog of unapproved tools highlights potential governance erosion.

The Outcome

Each of these examples should produce a quantifiable metric that evolves over time, similar to how your teams monitor, report and escalate metrics such as patching cadence or backup testing if maintenance falls behind.

By tracking these figures, you will gain a clear understanding of your governance’s health trend. This enables timely escalation and remediation strategies. Additionally, your governance remains a priority rather than an afterthought, empowering you to respond effectively to the changing landscape of AI technologies.

The Next Steps

Establish a shared, regularly updated inventory of AI tools along with the data they access. To do so, ensure your governance and security teams jointly own and maintain an inventory that:

1. Provides both teams with a comprehensive view of your organisation’s AI ecosystem.
2. Ensures alignment between approved AI policies, governance frameworks, security measures and operational realities.

While this initiative may not be glamorous and often competes for visibility against more high-profile or urgent projects, this foundational work is essential to reduce governance decay.

By committing to measure and manage governance decay systematically, you set up your business for sustained operational effectiveness and compliance in an increasingly complex environment.

Cracking the Code: Treat AI Governance as an Operational Discipline

Treating AI governance as an operational discipline necessitates a fundamental shift in approach and mindset, particularly in light of recent findings. The fact that 68% of businesses were victims of cyber attacks lacked an AI governance policy at the time of their breach, as highlighted in IBM’s report, is alarming, but it reveals a documentation gap.

Additionally, the year-on-year decline in critical controls points to a more serious operational decay. This trend isn’t only decreasing. It’s also worsening now that AI adoption accelerates.

Consequently, businesses are most at risk not necessarily because they lack governance policies. They are in danger when they assume their existing policies are effective without mechanisms to identify outdated or flawed controls. This false sense of security can expose businesses to considerable risk.

Moreover, AI governance should be treated like other well-established operational disciplines, such as vulnerability management, access reviews and business continuity testing, all of which industry standards recognise require ongoing maintenance.

Unfortunately, AI governance is still relatively new, and the assumption that it also requires ongoing oversight has yet to become the default.

Given this context, the crucial first question for any IT Director or CISO shouldn’t be whether an AI governance policy exists, but rather “When was each control that supports an AI governance policy last effectively implemented and reviewed?”

If your business cannot confidently answer this critical question, Acora’s AI and data governance expertise can help you bridge the gap and ensure robust oversight.

Get in touch. Let’s work together to transform your business’s governance from a dormant policy into a proactive, enduring operational discipline.