Topic starter
09/07/2026 12:35 pm
TL;DR: AI governance remains uneven despite broad awareness, with only 25% of organisations fully implementing programs, 27% of boards adding it to committee charters, and 97% of AI-related breach victims lacking proper access controls, according to Knostic’s source article. Policy alone is no longer the issue; enforcement, accountability, and measurable controls now determine whether governance actually reduces risk.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “The 20 Biggest AI Governance Statistics and Trends of 2025”.
By the numbers:
- Only 25% of organisations have fully implemented AI governance programs, revealing a gap between awareness and execution.
- Just 27% of boards have formally incorporated AI governance into committee charters, showing limited leadership integration.
- 97% of AI-related breach victims have been shown to lack proper access controls, highlighting enforcement as the main weakness.
Key questions
Q: What breaks when AI governance exists on paper but not in enforcement?
A: Policy-only governance fails when teams cannot technically restrict access, log decisions, or revoke permissions in the systems AI actually uses.
Q: Why do access controls matter so much in GenAI governance?
A: Because GenAI risk is usually exercised through data access, not just model behaviour.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Translate AI policy into runtime controls Map each governance rule to a technical enforcement point such as access control, logging, content filtering, or approval workflow.
- Assign named ownership for AI governance Place AI governance into formal committee charters and assign accountable owners across security, risk, legal, and product.
- Apply least privilege to GenAI data access Restrict which datasets, prompts, and outputs each AI use case can reach, and review entitlements as use cases change.
Bottom line: The article’s central finding is that AI governance is widely discussed but still weakly enforced, especially where access control and accountability should translate policy into action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:40 pm
AI governance is becoming an identity enforcement problem, not a policy-writing problem. The article’s strongest signal is that organisations already know governance matters, but they still fail at control execution. That matters because GenAI risk is expressed through access, data exposure, and decision authority, all of which sit on top of IAM and auditability. Practitioners should judge governance by runtime enforcement, not by the existence of policy documents.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should own AI governance when business teams are adopting it quickly?
A: Ownership should sit with the business function using AI, supported by IAM, security, and risk teams. That model keeps accountability tied to the actual use case instead of allowing governance to drift into a shared-no-one model.
👉 Read our full editorial: AI governance statistics expose the gap between policy and enforcement