EY survey finds AI governance lagging behind autonomous AI adoption

A survey of 202 senior AI executives at US companies with at least $1bn in annual revenue has found that AI governance is failing to keep pace with the deployment of autonomous systems. While 98% of respondents said their organisation has formal AI governance policies, 69% cited a lack of internal expertise to evolve those controls, and 47% admitted their organisation had bypassed its own governance process for urgent deployments.

Agentic AI is already widespread, with 91% of respondents reporting active pilots or full enterprise deployment. Among those users, 49% said their governance framework has not been updated to cover agentic AI risks, 85% said at least some systems act without real-time human involvement, and 26% cannot detect unauthorised AI agents operating internally.

Reported harm is common: 89% encountered AI-related risks in the past year, including cybersecurity (52%), human risk (47%) and shadow AI (46%), and 36% suffered an AI incident with material impact such as data loss, financial damage or brand damage. EY’s Richard Jackson said organisations are applying yesterday’s governance rules to today’s AI interactions, and that speed and governance are not mutually exclusive.