Dive Brief:
- Nearly half of senior AI leaders say their organizations have bypassed AI governance processes for urgent deployments, despite almost all having formal policies in place, according to an EY report published Tuesday. The company surveyed more than 202 senior AI executives at businesses generating at least $1 billion in annual revenue.
- The rise of agentic AI is a top pain point for businesses, with the technology’s development outpacing regulation. Roughly half of respondents saying their frameworks have not been updated to accommodate its specific risks.
- “Effective AI governance should be more than a piece of paper or a set of policies that is filed away,” Richard Jackson, EY Americas Assurance chief technology officer told CIO Dive. “It should be lived and breathed by the organization, translated into practice and practical outcomes.”
Dive Insight:
Enterprises are dealing with a widening gap between AI governance policies and their execution. Despite prominent, well-documented cybersecurity incidents that reflect the technology’s risk profile, organizations continue to bypass existing protocols.
CIOs must help their businesses create governance processes that are robust enough to manage risk without becoming a hurdle to operations.
“Moving fast and applying appropriate governance are not mutually exclusive,” Jackson said. “Governance is what gives organizations the confidence to move quickly without losing control.”
This approach requires embedding governance into the AI development and deployment lifecycle, with clear requirements for testing, approval, monitoring and escalation. CIOs should also establish an explicit process for exceptions, including who can authorize an expedited deployment and what additional controls or post-deployment reviews are required.
The challenge becomes more acute as organizations deploy agentic AI. Among respondents using the tech, around one in four said accountability for maintaining or monitoring it post-deployment was undefined.
CIOs therefore need to look beyond initial approval and establish ownership throughout an AI system’s lifecycle. That includes determining who monitors autonomous systems, who is responsible when behavior changes and when human intervention is required.
According to Jackson, organizations need clear human and technology guardrails, visibility into what agents are doing and the ability to detect when an agent operates outside its intended parameters.
The survey also highlights a skills problem, with around two-thirds of respondents expressing concern about a lack of internal expertise to design, implement or evolve AI governance controls.
For CIOs, the lesson is to carry out regular assurance reviews, treating them as an operational feedback loop rather than a compliance exercise. Testing whether controls work in practice, and using the results to modify, pause or stop systems, can help ensure governance evolves alongside AI deployment.
“The role of a CIO and leadership is to establish cross-functional teams, bringing together legal, IT, security and compliance teams, and make sure governance across each team is keeping pace with AI deployment,” Jackson said. “The insight and expertise of the CIO has never been more critical to helping inform and enable governance across the organization.”
