EY AI Risk & Governance Survey - policy coverage vs operational visibility (assurance stress-test)

Most of the AI conversation right now is a conversation about adoption, which is probably why the number that ought to trouble executives sits unread in a different column.

EY's new AI Risk and Governance Survey, drawn from 202 senior decision-makers at US public companies valued above a billion dollars, reports that 98 per cent have a formal AI governance policy in place, while 26 per cent concede they cannot detect unauthorised AI agents operating inside their own systems. Coverage on paper is close to universal, yet the visibility required to enforce any of it plainly is not.

The detail beneath those headline figures is less comfortable again. Of the 91 per cent now piloting or deploying agentic AI, roughly half have not updated governance to address agentic risk specifically, 47 per cent acknowledge that governance was bypassed at some point to meet a deployment deadline, and 36 per cent have already absorbed an AI incident with material negative effects.

One finding runs the other way, and it happens to be the useful one. Where organisations put deployments through formal assurance review, 92 per cent surfaced problems, and those reviews went on to change deployment decisions rather than quietly endorse them.

All of which points to the lesson worth carrying into the next board paper: a policy that has never been operationally stress-tested is not governance so much as documentation, and assurance is the point at which the two are finally reconciled.

The question I would put to my own team, then, is when an assurance review last changed a deployment decision here, because an answer of "never" describes an untested record rather than a clean one.

#AIGovernance #CorporateRisk #Assurance

https://lnkd.in/eaEbgBfM

Next phase of AI governance: closing the confidence gap | EY - US

ey.com