EY 2026: 47% say their AI governance process was skipped for urgent deployments.
Nearly all say their company has formal AI governance policies in place.
18 October 2026
of senior AI executives say their company has skipped its AI governance process for urgent deployments
say their senior leaders cannot see every AI tool operating in their organization
of those whose company uses AI agents say it cannot detect unauthorized AI agents operating inside it
Ernst & Young LLP (EY US), AI Risk and Governance Survey, September 2026
Ernst & Young LLP (EY US) published its first AI Risk and Governance Survey on 15 September 2026. EY’s assurance team commissioned an online survey of 202 US senior AI executives at publicly traded companies with at least $1 billion in yearly revenue. It ran from 28 May to 15 June 2026. EY gives a margin of error of plus or minus 7 percentage points.
Nearly all of them (98%) report that their company has formal AI governance policies in place. About half (47%) say their company has skipped its AI governance process for urgent deployments at some point.
Two in five (41%) say their senior leaders cannot see every AI tool now operating in their organization.
Of those whose company uses AI agents, 85% say at least a handful of these agents carry out actions without a person involved in real time. Of all those whose company uses AI agents, 26% say their company cannot detect unauthorized AI agents operating inside it.
About a third (36%) say their company has had an AI incident or failure that caused a materially negative impact, such as data loss or financial damage.
What Mandate does
Mandate applies your rules to each message to AI before it leaves, and the signed record shows which AI tools were used and what was decided.
Sources
-
Ernst & Young LLP: AI Risk and Governance Survey release (September 2026)
Source for the 98%, 47%, 85%, 26% and 36% figures and for how the survey was run, from EY US’s 15 September 2026 release.
-
EY US: “AI governance has entered its next phase: closing the confidence gap” (September 2026)
Source for the 41% figure, from EY US’s 15 September 2026 summary of the same survey.
More reading notes
-
CB Financial Services 2026: an SEC filing over customer data put into an AI app the bank had not approved
19 October 2026CB Financial Services told the SEC that customer names, Social Security numbers and dates of birth were handled with an AI application the bank had not authorized.
-
OWASP 2026: misuse of an AI agent’s identity and access is a top threat
9 June 2026The OWASP security project lists misuse of an agent’s identity and access among the ten highest-impact threats to AI agents, and recommends each agent get its own identity.
-
NTT DATA 2026: what the companies furthest ahead with AI prioritize in governance
9 June 2026Of the companies furthest ahead with AI in NTT DATA’s survey of 2,567 executives, 59.4% named data privacy or sovereignty across countries a top governance concern, against 49.6% of those furthest behind.
-
University of Queensland and MIT 2026: which sectors are most exposed to AI risk
8 June 2026A panel of 272 experts judged information, finance and national security the sectors most exposed to AI risk, and the authors write that the standards and enforcement AI needs are still forming or missing.
-
Schrems II and the CLOUD Act: which law reaches your data
18 May 2026Under the US CLOUD Act, a US court can order a provider under US law to hand over data it controls, wherever that data is stored.
-
IBM 2026: 18% of Canadian organizations say they have systems to govern AI across everyday operations
8 May 2026In an IBM Institute for Business Value study, 18% of Canadian organizations said they have systems to coordinate and govern AI across everyday operations.
-
United States v. Heppner: documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged
30 April 2026A US federal court found that documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged.
A free AI acceptable use policy template, written for Canadian privacy law and ready for your lawyer to adapt wherever you operate. Get the template