Most (98%) large organizations have an AI governance policy in place, but almost half (47%) admit they have bypassed it for urgent deployments, according to a September 15 EY survey report.

That gap is one of the many crucial findings of an online survey of 202 senior AI executives at U.S. companies with at least $1 billion in annual revenue. The survey was carried out between late May and mid-June 2026. 

“Organizations are applying yesterday’s governance rules to today’s interactions with AI,” said EY Americas Assurance Chief Technology Officer (CTO) Richard Jackson.

AI Governance Frameworks Need to Include Agentic AI

The gap is widest around agentic AI, systems that act autonomously. 

According to the survey results, 91% of respondents say their organization already uses it. While 85% say at least some of their agentic systems act without real-time human involvement, almost half (49%) say their governance framework hasn’t been updated to specifically address agentic AI’s risks.

The survey finds that visibility into agentic AI is another major problem: 26% of respondents whose organization uses agentic AI say they cannot detect unauthorized AI agents operating internally. 

“The biggest agentic AI risk is that human oversight hasn’t evolved accordingly,” said John McLain, EY Americas Assurance Technology Risk AI Leader.

About a Third Has Experienced Materially Negative Impact 

A striking 89% of respondents said they had encountered an AI-related risk in the past year, and 36% reported an AI incident that caused material harm, such as data loss, financial damage, operational disruption, or brand damage. 

The most common worries are: 

• failing to comply with emerging AI regulation 
• being unable to trace data lineage feeding AI decisions 

The survey found that these are among the capabilities many organizations still lack, especially for agentic systems.

Where Governance Is Working

There’s a bright spot: the survey finds that 98% of organizations conduct a formal AI assurance review at least annually. As a result, 64% significantly modified a quarter or more of their AI systems, and a significant share paused or fully stopped a quarter or more of their AI systems.

The most common issues caught are data quality problems (57%), model drift (48%), and shadow AI (39%).

Shadow AI refers to unapproved AI tools and models that employees use inside the organization without IT, security, or data team oversight, while model drift is the gradual decline in an AI model’s performance as real‑world data and conditions change while the model stays the same.

“The fact that reviews so consistently uncover issues and lead to modifications, pauses or cancellations shows that AI governance and assurance work when implemented,” Jackson said.

What This Means Going Forward

The survey makes clear that lack of AI governance policies is not the problem (98% already have one). 

The problem is that the policies haven’t caught up to what agentic AI specifically does. 

Review cycles run slower than the systems they oversee, and a meaningful share of organizations can’t fully see what AI is running inside their own walls.

For chief data officers (CDOs), there are three priorities: 

• Build an explicit agentic AI addendum into AI governance frameworks because general principles do not cover autonomous action 
• Reviews need to be more frequent to move faster than the pace at which agentic systems can act and cause harm 
• Treat visibility into agent action as a governance priority 

With 63% to 69% of respondents citing a lack of internal expertise to design, implement, and evolve these controls, the gap looks like one that’s widening faster than most organizations can currently close it.