AI governance statistics expose the gap between policy and enforcement

At a glance

What this is: This article argues that AI governance has become a policy-heavy, enforcement-light discipline, with adoption and board attention still trailing actual control implementation.

Why it matters: IAM, GRC, and AI security teams need to treat AI governance as an operational control problem, because access, accountability, and auditability determine whether policy has any real effect.

By the numbers:

• Only 25% of organisations have fully implemented AI governance programs, revealing a gap between awareness and execution.
• Just 27% of boards have formally incorporated AI governance into committee charters, showing limited leadership integration.
• 97% of AI-related breach victims have been shown to lack proper access controls, highlighting enforcement as the main weakness.
• Nearly all organisations, 98%, expect AI governance budgets to rise, signalling a shift toward operational investment.

Context

AI governance is the set of controls, roles, and monitoring practices used to manage GenAI risk across an enterprise. The article’s core message is that organisations have enough awareness and policy language, but not enough enforcement, board integration, or access control discipline to make governance reliable in practice.

For identity and security teams, the important point is that governance becomes real only when it is tied to authentication, authorisation, logging, and accountability. In AI environments, that means the same control logic that protects human and machine access in IAM and PAM must extend to AI workflows and data exposure.

The article also shows that this is not a fringe maturity problem. The starting position is now typical across organisations adopting GenAI: policy arrives first, then oversight, then control enforcement, often in that order.

Key questions

Q: What breaks when AI governance exists on paper but not in enforcement?

A: Policy-only governance fails when teams cannot technically restrict access, log decisions, or revoke permissions in the systems AI actually uses. That creates a false sense of control while data exposure, privilege creep, and untracked actions continue. Effective governance must be enforced through identity, access, and audit mechanisms, not only through policy documents.

Q: Why do access controls matter so much in GenAI governance?

A: Because GenAI risk is usually exercised through data access, not just model behaviour. If a user or system can query too much data, governance fails even when the policy is sound. Access controls define the boundary between acceptable assistance and uncontrolled exposure, which makes them central to AI security.

Q: How can organisations tell whether AI governance is actually working?

A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.

Q: Who should own AI governance when business teams are adopting it quickly?

A: Ownership should sit with the business function using AI, supported by IAM, security, and risk teams. That model keeps accountability tied to the actual use case instead of allowing governance to drift into a shared-no-one model.

Technical breakdown

Why AI governance fails when policy is not enforced

AI governance is often drafted as a policy exercise, but policy alone does not restrict what a model, user, or agent can access. Enforcement depends on identity and access controls, logging, approval flows, and technical guardrails that operate at runtime. Without those mechanisms, governance becomes documentary rather than operational. In practice, that means teams can claim oversight while still allowing over-broad access to sensitive prompts, data, or model outputs.

Practical implication: Treat governance as a control plane problem, not a policy publication problem.

Board oversight and committee charters in AI governance

Board awareness is not the same as governance ownership. When AI governance is missing from committee charters, responsibility often sits informally across risk, security, legal, and product teams, which weakens accountability and slows remediation. Formal oversight matters because AI introduces cross-functional risk that cannot be managed by technical teams alone. Good governance requires named owners, measurable reporting, and escalation paths that match the speed of AI deployment.

Practical implication: Make AI oversight explicit in governance charters and reporting lines.

Access control as the enforcement layer for GenAI risk

The most direct security gap in GenAI programmes is often access control, because AI systems can surface data far beyond the intended user boundary. Proper access controls define who can query what, which datasets an AI system can reach, and whether outputs are filtered, logged, and reviewed. This is where identity security and AI governance intersect: without tight authorisation, any policy remains vulnerable to oversharing, privilege creep, and accidental disclosure.

Practical implication: Apply least-privilege access and audit trails to every GenAI workflow that touches data.

NHI Mgmt Group analysis

AI governance is becoming an identity enforcement problem, not a policy-writing problem. The article’s strongest signal is that organisations already know governance matters, but they still fail at control execution. That matters because GenAI risk is expressed through access, data exposure, and decision authority, all of which sit on top of IAM and auditability. Practitioners should judge governance by runtime enforcement, not by the existence of policy documents.

The control gap is now more visible than the policy gap. With 97% of AI-related breach victims lacking proper access controls, the issue is not whether organisations can articulate principles. It is whether those principles constrain access paths, data retrieval, and model interaction in production. That is a measurable enforcement failure, not a communications failure.

AI governance debt is accumulating faster than board structures are adapting. The article shows that boards are still incorporating AI through partial oversight rather than fully embedding it into charters and operating rhythms. That creates governance debt, where risk grows faster than accountability structures. The practical conclusion is that security leaders must connect AI governance to existing identity, data, and control ownership models.

Need-to-know access is the new baseline for safe GenAI adoption. AI systems expand the blast radius of weak permissions because one over-broad entitlement can expose many prompts, datasets, or generated outputs at once. That makes least-privilege design, access review, and logging foundational to AI governance, not optional hygiene. Teams should align GenAI governance with the same control discipline they expect for privileged access and sensitive data handling.

Enforcement-traceability gap: the article shows that the common failure mode is not absent policy but weak traceable enforcement across the AI lifecycle. NIST AI RMF and ISO/IEC 42001 both point toward accountable, measurable governance, but the article shows many organisations are not operationalising those ideas yet. Practitioners should convert governance claims into evidence that can be reviewed, challenged, and audited.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Risk Board Briefing

What this signals

Enforcement-traceability gap: the article shows that many organisations can describe AI governance but still cannot prove it in operations. That creates a control gap where policy coverage, access restrictions, and audit evidence drift apart, leaving security teams to discover governance failures only after exposure.

AI governance will increasingly be measured by how quickly organisations can connect policy to identity controls, data boundaries, and exception handling. For practitioners, that means the next maturity step is not more wording in policy documents but better control instrumentation across GenAI use cases.

For practitioners

• Translate AI policy into runtime controls Map each governance rule to a technical enforcement point such as access control, logging, content filtering, or approval workflow. If the rule cannot be enforced, it is only guidance, not governance.
• Assign named ownership for AI governance Place AI governance into formal committee charters and assign accountable owners across security, risk, legal, and product. Unclear ownership is where governance programmes stall.
• Apply least privilege to GenAI data access Restrict which datasets, prompts, and outputs each AI use case can reach, and review entitlements as use cases change. Over-broad access is the most common enforcement weakness in AI environments.
• Measure governance by evidence, not intent Track policy hit rates, access violations, audit latency, and control exceptions so governance maturity is visible in operations. If the metrics are missing, the programme is not yet governable.

Key takeaways

• The article’s central finding is that AI governance is widely discussed but still weakly enforced, especially where access control and accountability should translate policy into action.
• The evidence is stark, with only 25% of organisations fully implementing AI governance and 97% of AI-related breach victims lacking proper access controls.
• Practitioners need to treat governance as an operational control problem, because the difference between policy and enforcement now determines whether GenAI risk is contained.

Key terms

• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• Enforcement: Enforcement is the technical and procedural mechanism that makes policy real. For AI programmes, that means access controls, logging, approval gates, and exception handling that constrain behaviour at runtime rather than relying on guidance alone.
• Access Controls: Access controls are the rules that limit who can see or use data and systems. They may use roles, attributes, authentication strength, and policy checks to reduce exposure. In DLP programmes, access controls help ensure sensitive content is only available to approved users and processes.
• AI Management System: An AI management system is the governance structure used to define accountability, monitor risk, and control how AI is developed and operated. In practice, it connects policy, evidence, and oversight so AI use can be managed continuously rather than reviewed only at launch or during audit.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry’s only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle controls. It helps practitioners connect access governance to the broader security programme they run every day.