Seventy-four percent of respondents report departmental or scaled AI adoption at their organizations, including within individual teams or departments, across business functions, and as part of processes and operations, according to the latest OneTrust 2026 AI-Ready Governance Report. The remaining respondents are planning, evaluating, or experimenting with AI, while 1% report no AI use.
Which best describes how your organization currently performs AI governance? (Source: OneTrust)
Putting AI governance into practice
This level of adoption puts governance to the test in active settings, where policies, reviews, and controls need to support decisions across departments and operating processes.
Companies integrate governance into the AI lifecycle at varying levels of maturity. Some embed governance by design, while others describe their approach as reactive and fragmented or defined but slow and manual. These approaches indicate challenges with speed, consistency, and cross-functional execution. Only 17% select the highest maturity level, with governance embedded by design to enable innovation.
Organizations have connected governance to the AI lifecycle and established a range of activities. Others have defined parts of their programs without reaching the same level of integration and scale.
Of AI governance activities, risk classification and impact assessments are the most common, followed by employee usage controls, policy and governance documentation, and incident management. These activities connect to daily operations through inventory management, continuous monitoring, third-party reviews, and evidence collection.
Around three-quarters of respondents are confident in their ability to perform the governance activities assessed in the survey, though only 29%–33% report the highest level of confidence. Companies generally have capable teams and established practices. The level of coordination across the AI lifecycle varies.
“Governance has always relied on knowing in advance what a system will do. But AI is faster, there is far more of it, and the same request can be helpful in one context and harmful in another. Static rules worked for governance when a person made every decision. Now, judgment has to live in the runtime itself, deciding and enforcing in the moment AI acts, and standing apart from the tools it governs,” said Blake Brannon, Chief Innovation Officer at OneTrust.
Agent adoption moves ahead of governance
Eighty-seven percent of respondents say their organizations encourage the use of AI agents. Of those surveyed, 47% encourage agent use with defined governance, oversight, and controls in place, while another 40% encourage use as governance and controls continue to develop.
Some organizations know agents are being used in parts of the business without consistent oversight. Others lack visibility into where and how agents are used.
Autonomous or agentic workflows are the AI initiatives most often slowed, paused, or complicated by governance, risk, or review requirements. Nearly half of respondents reported at least one incident during the past year in which AI systems or agents took unapproved actions.
Data integrity ranks as a top risk in assessments of incident preparedness. Companies are most likely to experience, and least prepared to manage, data loss, corruption, or misclassification. Unvetted automation or agentic actions are the next concern.
Agents put the wider operating model to the test. When an agent acts, authority, oversight, controls, monitoring, and evidence need to work together.
Coordination remains fragmented
Companies are actively governing AI, conducting an average of four governance activities and reporting high confidence in individual capabilities. Only 5% say coordination and accountability are defined across the AI lifecycle.
Thirty-three percent of respondents say employees had used unapproved AI tools because approved options or processes were not available quickly enough. Slow access can lead employees to seek tools outside established channels, resulting in late discovery and reviews after adoption.
Governance requirements affect AI delivery across companies. Ninety-six percent of respondents say at least one AI initiative was slowed, paused, or complicated by governance, risk, or review requirements. The impact extends to data analysis, third-party tools, agentic workflows, customer experiences, and employee copilots.
Data quality, access, privacy, and security are the most common causes of delays. Other challenges include limited visibility into third-party AI, undefined ownership and handoffs, and manual or inconsistent reviews.
Managing third-party AI requires ongoing oversight beyond the initial purchase review. Organizations need to identify, assess, monitor, and document third-party AI throughout its use.
Budgets set to increase
Eighty percent of respondents say their function spends more time managing AI-related risk than it did 12 months ago.
Of organizations that experienced at least one of the AI-related incident types assessed in the survey, employee training and AI literacy lead remediation efforts, followed by formal AI review and approval processes and expanded monitoring or governance controls.
During the next financial year, 98% of respondents plan to increase budgets for technologies used to govern AI.
Download: The Agentic Software Development Guide
