AI Governance Statistics 2026

What the numbers say together

PromptFluent's reading of the findings above. The studies themselves draw none of these conclusions across one another.

More policy, fewer controls

In IBM's 2026 breach study, AI governance policies “in development” rose from 22% to 33%, while strict approval processes for AI deployments fell from 45% to 38%. Organizations are writing about AI faster than they are controlling it. A policy is a document; a control is what happens when someone opens a chat window. Traditional AI governance platforms primarily center on AI systems, use cases, lifecycle risk, and compliance, which is necessary and still leaves the work itself ungoverned.

The gap sits between principle and practice

Half of PwC's respondents named translating responsible-AI principles into operational processes as their top barrier. Not values, not regulation: the translation step. KPMG found 44% of employees using AI in ways that contravene policy, and Grant Thornton found 78% of senior leaders unsure they could pass an AI governance audit within 90 days. The policy exists, the behavior wanders off, and nobody can prove which is which. That translation layer is what AI execution governance covers; the difference between AI governance and AI execution governance is laid out separately.

Shadow AI is where the invoice arrives

Shadow AI was involved in 43% of the security incidents IBM studied, up from 20%, and breaches involving it averaged $5.39 million against a $4.99 million average for all breaches in the same edition. Those are two findings from one study, not a comparison IBM draws, and they describe breached organizations rather than everyone. Netskope's telemetry adds the behavior behind it: 30% of observed enterprise AI users worked only in personal AI apps. More on what shadow AI is and how to govern it.

Evidence is the scarce resource

Only 11% of ISACA's European respondents were completely confident they could investigate and explain a serious AI incident to leadership or a regulator, and 59% could not say how quickly they could halt an AI system. The EU AI Act's Article 12 already sets record-keeping obligations for high-risk AI systems. Here is how laws, frameworks and standards fit together.

How to read these figures

• The studies ask different people: breached organizations, senior leaders, digital-trust professionals, employees, and platform telemetry. Don't average them or rank them against each other.
• IBM's figures describe the 602 breached organizations it studied, not all organizations. Its 43% is a share of security incidents.
• Surveys report what respondents say; telemetry reports what a vendor's platform observed. Both are useful. They are not the same kind of evidence.
• Figures were checked against each publisher's own page on 10 September 2026. The Grant Thornton and ISACA figures were re-checked on 18 October 2026.