Reading time: 4 min 30 sec
Note: This article reflects the author’s personal opinions and analysis and does not represent the position of any organization with which the author is or has been affiliated.
Your company may be using more artificial intelligence than you realize, and not necessarily because it has a grand corporate AI strategy. It may be in the assistant that helps an employee draft a document, a smart feature recently added to software already used by Finance, a tool purchased directly by Marketing, a service that analyzes customer conversations, or an application that a team began testing on its own.
Each case may seem small, but together they raise a different question: Who governs all that AI?
The problem may begin before the strategy
When a company formally considers adopting artificial intelligence, it may envision an orderly process: first identifying an opportunity, then evaluating a solution, obtaining the necessary approval and, with IT involvement, implementing it.
But adoption does not always follow that path. AI may also arrive embedded in products the organization already uses, perhaps purchased directly by a business unit or adopted by employees who find a useful tool to meet an immediate need. This means an organization may begin using AI before explicitly deciding how it wants to govern it.
Various published studies and accounts of AI adoption point to a recurring tension: its use can advance faster than organizations’ ability to oversee it, assign responsibilities and maintain visibility into how it is used.
A recent example helps illustrate the scale of the problem: a study by the IBM Institute for Business Value, in collaboration with Oxford Economics, published in June 2026, surveyed 2,000 technology executives across 33 geographies and 19 industries. It reported that 77% of respondents said AI adoption was outpacing their current governance capabilities. Another finding may be even more revealing: 70% said business teams were deploying technology faster than IT could track it.
These figures refer to that survey. They do not necessarily mean that 77% or 70% of all companies worldwide face these situations, but they do illustrate an important problem: technology can enter an organization through more doors than its traditional mechanisms can detect.
Do we really know what AI we are using?
An important distinction emerges here: a company may know that it “uses AI” without having a complete picture of how it uses it.
What tools are employees using?
What AI features are included in products already purchased?
What information is entered into them?
Which providers process that data?
Which solutions merely generate content, and which influence decisions?
Which departments are experimenting?
Which systems are already part of important processes?
Who knows all of this?
None of these questions implies that every organization needs to immediately build an extensive AI governance structure, or that every new tool requires a committee. It does mean something more basic: it is difficult to govern what an organization cannot see clearly enough.
Visibility is not the same as control
It may be tempting to think this is exclusively an IT problem: if new tools appear, IT should detect and control them. But that addresses only part of the problem.
Suppose IT identifies an AI application used by a sales team. Questions remain: Is its use permitted? With what information? Who decided the risk was acceptable? Who is accountable for the outcome? Should the provider be reviewed? Are there decisions this tool should not be allowed to influence? And who has the authority to set those conditions?
These are no longer merely questions about technology; they are questions about organizational decisions.
The literature and documented experiences on AI governance show that, as its use expands, questions of authority, accountability, escalation and oversight emerge.
This does not mean no one is governing AI. Some organizations have already established accountable roles and formal mechanisms; others are developing them. The more pertinent question is: how explicit, visible and consistent is that governance as adoption spreads throughout the organization?
Using AI does not mean governing it
A tool may deliver satisfactory results: it may save time, produce useful outputs and even create value. None of that automatically answers who authorized its use, what limits apply, who bears its risks or what happens if it comes to be used differently from what was intended.
That is why the first AI governance problem may arise long before writing a policy or designing a formal structure: an organization may be using more AI than its current decision-making, accountability and oversight mechanisms can see.
And before asking which framework to adopt, which committee to create or which controls to implement, it may be worth starting with something simpler: looking within the organization and asking:
Where are we using AI today?
Who knows?
Who decided we could use it?
And, above all: who is governing it?