Home > Security and Compliance Blog > Cybersecurity Risk Management > The AI Governance Confidence Gap Is an Evidence Gap

The AI Governance Confidence Gap Is an Evidence Gap

by Patrick Spencer updated November 3, 2026 Cybersecurity Risk Management

Reading Time: 13 minutes

Nearly every organization now owns an AI governance policy, and that fact tells a regulator almost nothing about whether a single AI system behaved the way the policy says it should. Policy is a statement of intent. Evidence is a record of what happened. Most companies are far better stocked with the first than the second.

The clearest proof arrived in September 2026, when EY published its AI Risk and Governance Survey of 202 senior AI decision-makers at US organizations. EY’s report, “Realizing potential: confidence in AI,” found that 98 percent have an AI governance policy and that 47 percent have bypassed their own governance process for an urgent deployment. The same executives who wrote the policy admitted they had stepped around it. Compliance Week picked up the bypass finding as its central warning for compliance teams.

Table of Contents

For a CISO or Chief Compliance Officer, the number that matters is the distance between those two figures. A policy that is bypassed under pressure cannot generate audit-ready proof, because the bypass is exactly the moment the record goes missing. This post walks through what the EY data shows, why the gap is structural rather than cultural, and how an operating discipline at the data layer, such as Kiteworks secure data exchange, turns governance from a document into evidence.

Key Takeaways

1. Policy coverage is near total, and that is the trap.

With 98 percent of organizations holding an AI governance policy, having one no longer separates prepared companies from exposed ones.

2. Bypass is the leading indicator of an evidence gap.

Forty-seven percent have skipped their own governance process for an urgent deployment, and every skipped step is a missing record.

3. Autonomous agents widen the gap fastest.

Among organizations using agentic AI, 85 percent run systems that act without real-time human involvement while 49 percent have not updated their governance framework for agents.

4. You cannot evidence what you cannot see.

Forty-one percent of senior AI decision-makers say they lack visibility into AI use, and 26 percent of agentic AI users cannot detect unauthorized agents.

5. Regulators regulate data, not models.

The defensible answer to an auditor is a tamper-evident record, tied to a named human authorizer, of every time an AI system touched regulated data.

EY Surveyed the People Who Own the Exposure

Governance surveys often poll practitioners one or two levels removed from the decisions. EY went to the senior AI decision-makers, the people who sign off on deployments and answer for them afterward. That choice makes the headline numbers harder to wave away as a middle-management perception problem.

The study ran from May 28 to June 15, 2026, and it covers US organizations only. With 202 respondents, EY cites a margin of error of plus or minus 7 percentage points, which means individual figures are directional. The pattern across the whole report is what carries weight, and the pattern is consistent. Confidence in the paperwork is high, confidence in the machinery behind it is low.

Scope matters here, and it should shape how you use the data. A US-only sample says nothing definitive about European or Gulf organizations, and this post does not treat it that way. Later sections show where regulators in other jurisdictions are reaching the same expectation by their own routes.

You Trust Your Organization is Secure. But Can You Verify It?

Read Now

Policy Coverage Is Near Total and That Is the Trap

Ninety-eight percent of respondents report some form of AI governance policy, and 69 percent say that policy is fully unified across the organization. Read quickly, that is a success story. Read as a compliance officer, it is a warning, because the same report finds that 69 percent are also concerned their organization lacks the internal expertise to evolve its governance controls.

Put those two 69 percent figures side by side and a picture forms. The policy exists, it is unified on paper, and the people responsible for it doubt that their teams can keep it current. That is a description of a document that is ahead of the organization carrying it.

The completed-controls data reinforces the point. EY’s respondents say they have established governance teams (75 percent), regular review processes (73 percent), human-in-the-loop requirements (72 percent), training (71 percent) and escalation procedures (68 percent). Vendor requirements sit at 65 percent, data lineage at 64 percent, and formal frameworks and AI registries at 58 percent each. Every one of those is an input. None of them is an output a regulator can inspect.

An examiner does not ask whether you hold a training program. The examiner asks you to show, for a specific AI interaction with specific regulated data, who authorized it, what policy applied, and what was returned. An input-heavy program with no matching evidence stream answers none of those questions. That is the trap in near-universal policy coverage. It creates the feeling of readiness without producing the proof.

The Bypass Is a Queue Problem Before It Is a Culture Problem

When 47 percent of organizations admit bypassing governance for urgent deployments, the instinctive diagnosis is a discipline failure. Staff cut corners, leaders look away, and the fix is more training. The supporting research points somewhere more useful.

OneTrust’s 2026 AI-Ready Governance Report, a survey of 1,200 decision-makers across eight markets fielded in June and July 2026, found that 33 percent of organizations saw employees use unapproved AI because the approved path was too slow. A further 31 percent discovered use cases only after they were already in use. People route around a process when the process cannot keep pace with the business.

That reframes the bypass as a throughput problem. If a governance review takes weeks and a business unit has a deadline in days, the review loses. The organization then holds a policy on paper and an unreviewed deployment in production, and the evidence trail for that deployment starts from nothing.

This is why exhortation fails and architecture works. A control that sits in a policy binder depends on someone choosing to follow it. A control enforced at the point where an AI system requests data cannot be skipped by a deadline, because it is the path the data travels. Governance that is built into the exchange removes the incentive to bypass it. The approved route becomes the fast route, since authorization, policy checks and logging happen in the request itself, with no ticket in a queue.

Agentic AI Turns a Governance Gap Into an Action Gap

A chatbot that answers a question is a read operation with a human reading the answer. An agent that runs code, places orders or touches records is something else. It acts, and it acts at machine speed across many systems.

EY found that 91 percent of respondents use agentic AI in some form. Of those, 85 percent say they have at least a handful of agentic systems executing actions without real-time human involvement, and 49 percent admit their governance framework has not been specifically updated to cover agentic AI risks. Another 26 percent cannot detect unauthorized AI agents operating inside their own organization.

Think about what that last figure means in practice. For roughly one in four agentic AI users, an agent could be running that nobody sanctioned, touching data nobody approved, and the organization has no mechanism to notice. Governance for a system you cannot see is a hope, not a control.

Ownership compounds the problem. EY reports that 56 percent have no single owner for AI governance and 39 percent say accountability for autonomous decisions is undefined. That echoes a pattern that runs through enterprise AI research more broadly. Who owns AI risk is unsettled, and an accountability vacuum is the practical result.

The remedy is not to treat agents as a mysterious new category. An AI agent is an identity operating on behalf of a person, and it belongs in the same governance model as the human it works for. Every action an agent takes should resolve to a named human authorizer, be evaluated against the same data policies that govern that person, and land in the same audit record. When agents and humans share one governed identity model, the question “who authorized this?” always has an answer. When agents run on shared service accounts or unattributed tokens, the answer is silence.

Visibility Is the Precondition and 41 Percent Do Not Have It

Eighty-nine percent of EY’s respondents say their organization has already encountered AI risk. Cybersecurity risk leads at 52 percent, followed by human risk at 47 percent and shadow AI at 46 percent. Thirty-six percent report an actual AI-related incident. Yet 41 percent say senior AI decision-makers lack visibility into how AI is being used across the organization.

Visibility is where the evidence problem becomes concrete. An audit trail can only describe what was instrumented. If AI use occurs through unmanaged tools, personal accounts or agents launched outside the registry, no log captures it, and the organization cannot reconstruct the events when a regulator asks.

Kiteworks’ own research points the same way. Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report, a self-reported survey of 459 respondents conducted in July 2026, found that 65 percent of organizations had discovered shadow AI in their environment. Because the data is self-reported, treat it as directional, but it matches the shape of the EY finding. Hidden AI use is common, and discovery usually happens after the fact.

Notice what the EY registry figure implies as well. Only 58 percent report having a completed AI registry, with another 39 percent in process. A registry is an inventory, and an inventory is the starting line for evidence. You cannot attach authorization records to a system that is not on the list. The registry, the identity model and the audit trail are three views of one problem, which is knowing what is running, on whose behalf, and against which data.

The practical lesson for a CISO is to stop treating discovery as the finish line. Finding shadow AI is useful, but the compliance question that follows is different. For every AI interaction with regulated data, can you prove it was authorized, encrypted and logged? Detection tells you that something happened. Evidence tells a regulator what happened and why it was permitted.

Assurance Reviews Prove That Controls Fail Quietly

EY’s review data deserves a close read, because it contradicts the comfortable assumption that governance problems are rare. Among organizations conducting formal AI assurance reviews, 92 percent found issues. Reviews are frequent, with 98 percent running them at least annually and 80 percent monthly or quarterly, and they lead to consequences. In the past year, 64 percent said at least one-quarter of reviewed AI systems were significantly modified, 29 percent said at least one-quarter were paused and later restarted, and 25 percent said at least one-quarter were stopped entirely.

The issues reviews uncovered most often were data quality problems at 57 percent, model drift at 48 percent and shadow AI at 39 percent. Two of those three are data-layer problems.

This is encouraging in one respect. Organizations are looking, and they are acting on what they find. It is sobering in another. Issues surfaced in review were, by definition, present and unmanaged until the review happened. A control that works only when a periodic review catches the failure is a control that failed quietly in the interval.

Consider the timing from a regulator’s perspective. A supervisory authority does not accept “we found it in our quarterly review” as the first indication of a problem that has been running for months. It asks for the continuous record. Periodic assurance and continuous evidence solve different problems, and a mature program needs both. The review tells you whether the controls are well designed. The evidence stream tells you whether they operated, every time, on every interaction.

Regulators Regulate Data, Not Models

The strongest frame available to a compliance leader is also the simplest. Regulators regulate data, and the law attaches to the data regardless of whether a human or an AI agent touched it. HIPAA does not carry an exemption for algorithms, and neither do the privacy and security regimes that govern financial, defense and personal data. An agent that reads a protected record triggers the same obligations as an employee who reads it.

That principle is showing up in current law across several jurisdictions, and the specifics matter, so it is worth stating them precisely.

In Germany, the NIS 2 implementation act (NIS2UmsuCG) entered into force on December 6, 2025. Section 30 of the amended BSI Act sets out the risk management measures that covered entities must implement, and Section 38 places the duty to implement and monitor those measures on the management body. Executives cannot delegate away the accountability, which is the same ownership question EY’s respondents struggle to answer.

In the European Union, the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026. It moved the application date for Annex III high-risk AI obligations to December 2, 2027 and for Annex I systems to August 2, 2028, while transparency duties under Article 50 have applied since August 2, 2026. A delayed deadline for one category does not delay the data protection, security and accountability obligations that already bind the data these systems use.

In the United Kingdom, the Cyber Security and Resilience Bill passed the House of Commons on June 16, 2026 and completed Lords report stage on October 26, 2026, with third reading scheduled for November 2. Alongside it, the UK GDPR accountability principle in Article 5(2) already requires controllers to demonstrate compliance, not merely assert it. That wording is the entire argument of this post in one sentence.

EY’s respondents sense the pressure already. Seventy-two percent are concerned about failing to comply with new or emerging AI-specific regulations, and the same share worry about their ability to trace or audit the data lineage and inputs that feed critical AI decision models. Lineage is another word for evidence. A regulator who asks where an AI output came from is asking for the chain of data access behind it, and an organization that cannot reconstruct that chain cannot answer.

None of these instruments is a US rule, and the EY sample is US-only, so they should not be read as measuring the same population. They matter because they show the direction of travel. Across jurisdictions, regulators are converging on a single demand. Show the record.

What an Operating Discipline Looks Like at the Data Layer

If the gap is an evidence gap, the fix must produce evidence as a byproduct of normal operation. Retrofitting proof after the fact, by assembling logs from five systems the week before an audit, is the pattern that leaves teams with evidence packages that take weeks to compile when a regulator’s clock runs in days.

A workable operating discipline has four parts, and they map to the questions an auditor will ask.

Identity linked to a human authorizer. Every AI request must carry an identity that resolves to a person who is accountable for it. This is the answer to the accountability vacuum, because “who authorized this?” returns a name instead of a service account. Delegated authorization using OAuth 2.0 is the standard mechanism, and it gives agents and humans a shared, governed identity model.

Policy evaluated per request. Access decisions should reflect the data, the user and the context at the moment of the request. Attribute-based access control (ABAC) evaluates those attributes, so an agent acting for a clinician sees what that clinician may see and nothing more. That also supports data minimization, since the agent never receives data it has no authorization to use.

Encryption that meets the standard. Regulated data in motion and at rest should be protected with FIPS 140-3 validated encryption, so the control is verifiable rather than asserted.

A tamper-evident audit record. Each interaction should write to an audit trail that cannot be quietly altered and that streams to your SIEM, so the record exists before anyone asks for it.

These four checkpoints are how Kiteworks Compliant AI governs AI access to regulated content, with policy enforced through the Data Policy Engine. The Secure MCP Server lets an MCP-compatible AI platform reach enterprise content through that same governed path, so the approved route is also the compliant one. Because enforcement sits in the data path rather than inside any one model, it applies whichever AI tool the business adopts next.

Governance at this layer also changes the leadership conversation. A CISO Dashboard that shows AI access activity by identity, policy and data class gives the board a measure of operating effectiveness, which is the measure EY’s data suggests most organizations lack. Leaders can then align the program to frameworks such as the NIST CSF Govern function and extend the same discipline to third-party risk management, where 81 percent of EY respondents say they are concerned about a third-party AI-enabled cyberattack compromising AI tools.

For a deeper treatment of how these controls fit together, see Kiteworks’ guides to AI data governance and zero trust for generative AI.

A 90 Day Starting Plan for Compliance Leaders

Evidence discipline does not require a program rebuild. A focused sequence gets most organizations from policy to proof in a quarter, and it begins with questions that EY’s data suggests many cannot yet answer.

In the first thirty days, build the inventory. List every AI system, model, agent and third-party tool that touches regulated data, and name one accountable human for each. EY’s foundational question is the right starting point. Can you provide a complete inventory of AI systems, models, agents and third-party tools? If the answer is no, nothing downstream can be evidenced.

In days thirty to sixty, move enforcement into the data path. Route AI access to regulated content through a governed exchange so that identity, policy evaluation and logging happen on every request. This is also where you remove the reason to bypass governance. If the approved path is the fastest path, the deadline pressure that drives the 47 percent figure loses its force.

In days sixty to ninety, test the evidence. Pick a regulator-style request, such as “show every AI access to a defined data set in the past thirty days, with the authorizing person for each.” Time how long the answer takes. If it takes days of manual log assembly, the gap is still open. If it takes a query, you have an operating discipline. Repeat the test quarterly and report the result to the board alongside the review findings.

One caution applies throughout. Do not let the plan become another document. The point of the exercise is to turn each control into a record that a third party could check without your help.

To learn more about producing audit-ready evidence for AI agent access to regulated data, schedule a custom demo today.

Frequently Asked Questions

A policy documents intent, and the EY data shows that intent and operation diverge. Nearly half of respondents have bypassed their own governance process for an urgent deployment, and 41 percent lack visibility into AI use. The gap is between a policy that exists and evidence that it operated on every interaction. Closing it means building an audit trail into the data path and aligning it to your data governance program.

Expect requests for four things. Auditors want to know who authorized the access, which policy applied, how the data was protected, and a tamper-evident record that ties these together. The UK GDPR accountability principle in Article 5(2) captures the standard by requiring controllers to demonstrate compliance. A governed exchange that writes this record automatically is far easier to defend than logs assembled after the request arrives. See how compliant AI approaches this with identity, policy and logging at each request.

They are the same problem at a different speed. An AI agent acts on behalf of a person, so its actions should resolve to that person as the accountable authorizer and follow the same data policies. The difference is volume and autonomy. EY found that 85 percent of agentic AI users run systems acting without real-time human involvement, which makes automatic attribution essential. Controls such as ABAC and a shared identity model keep agents and humans inside one set of rules.

Surveys disagree on whether the CIO, CISO or another executive owns AI risk, and that disagreement is itself the finding. A practical approach is to name one accountable executive per AI system and to give the CISO and Chief Compliance Officer joint responsibility for the evidence stream. Whoever owns it, the board will expect a measurable view of operating effectiveness, which a CISO Dashboard can support. Link that to your broader GRC reporting.

No. The Digital Omnibus on AI moved the high-risk application dates to December 2, 2027 and August 2, 2028, but it did not suspend data protection, security or accountability duties that already apply to the data AI systems use. NIS 2 in Germany and the UK GDPR still expect demonstrable controls today. Treat the delay as time to build an evidence stream, and review your NIS 2 compliance and GDPR compliance posture while you do.

Additional Resources