What happened
Compliance Week reported this week on EY's inaugural US AI Risk and Governance Survey, and the headline number is uncomfortable. Almost every organization has an AI governance policy, and about half have already set it aside when a deployment was urgent. The survey drew on 202 senior AI decision makers, including board members, C-suite executives and vice presidents, at publicly traded US companies with at least a billion dollars in annual revenue. It was fielded between late May and mid June 2026.
The gap is stark. 98% report formal AI governance policies in place, and 47% say their organization has previously not applied that process for an urgent deployment. Two thirds also doubt their own bench strength: 69% are concerned about a lack of internal expertise to keep evolving AI governance controls, and 63% say the same about implementing and designing them.
Agentic AI is where the drift shows. 91% of respondents say their organization uses agentic AI through pilots or full deployment, yet 49% of those say the governance framework has not been updated to cover agentic requirements and risks. 85% concede that at least a handful of agentic systems execute actions without real time human involvement, and 26% cannot detect unauthorized AI agents operating internally.
The damage is no longer hypothetical. 36% report an AI incident or failure with materially negative impact, spanning data loss, financial damage, operational disruption and brand damage. Asked about risks encountered in the past year, 89% name at least one: cybersecurity at 52%, human risk at 47% and shadow AI at 46%. Richard Jackson of EY put the pattern plainly, saying organizations are applying yesterday's governance rules to today's interactions with AI.
Why this is a GRC story
Policy existence was never the control. For years the maturity questionnaire asked whether an AI policy existed, and 98% can now answer yes. The interesting number is byte sized behaviour under pressure, and a bypass rate near half tells you the control fails exactly when risk is highest.
Urgency is an unlogged exception path. Every bypass has an approver, even when no record exists. If urgent deployments can skip review, then the exception process is the control to design, with a named decision maker, a time box and a retrospective review, so speed becomes a documented choice rather than a quiet one.
Agentic AI breaks the review model. A tool a person operates can be governed by training and acceptable use. A system that executes actions on its own needs a register of what it can touch, and a way to detect ones nobody registered. One in four organizations admitting they cannot spot unauthorized agents is a visibility gap, not a culture problem.
What to watch
Whether assurance providers start testing AI governance the way they test financial controls, with samples of deployments and evidence of approval, rather than reading the policy and moving on. Watch also for the first enforcement or litigation that turns an unlogged AI exception into the centre of a disclosure question. The 72% who fear failing new AI regulations, and the 72% who cannot trace data lineage behind AI decisions, are describing the same weak spot from two directions.
Attribution: Analysis based on Compliance Week reporting on the EY US AI Risk and Governance Survey, and related public reporting. This article is original commentary, not a repost of the source material.