AI is also becoming routine in corporate disclosure. About 84% of Fortune 500 companies now discuss AI in annual reports, while The Conference Board found the share of S&P 500 companies disclosing AI as a risk rose to 83% in 2025 (up from 12% in 2023). Disclosure can alert investors to risk, but it does not prove that a company has assigned ownership, tested controls or decided how issues should be escalated when an AI deployment fails.
The world’s regulators have noticed. More than 1,000 AI policy initiatives have been launched in over 70 countries. The EU AI Act’s key provisions are now in force. In South Korea, the AI Basic Act took effect in January 2026.
In the United States, where federal AI law remains fragmented, states are moving ahead. In 2025, all 50 states, Puerto Rico, the Virgin Islands and Washington, DC introduced AI legislation, and 38 states adopted approximately 100 measures. Connecticut enacted an AI law that creates obligations for employment-related automated decision tools, consumer chatbots, frontier-model developers, generative AI provenance and online platforms used by minors
The gap between planned regulation and enterprise governance is not just a compliance risk. It is becoming a board-level threat.
Three Failures Leaders Need To Face
1. Adoption Without Accountability
Many organizations rush to deploy AI because the pressure to move fast is real. When ownership is unclear, a faster workflow can also become harder to inspect, harder to explain and harder to stop. When something goes wrong, teams may know which tool was used but still have no clear answer for who owned the decision.2. Treating AI Use And AI Security As The Same Conversation
They are separate disciplines. Using AI means putting models into workflows. Securing AI means understanding how those workflows can be manipulated through prompt injection, corrupted data, unsafe integrations, weak access controls or misplaced trust in automated outputs.These risks are already showing up. Researchers have shown that browser agents and copilots can be manipulated through content they are asked to read or summarize, including webpages, emails and other connected sources. One study showed that replacing just 0.001% of training tokens with medical misinformation made models more likely to produce harmful medical errors.
AI agents inside integrated development environments (IDEs), customer relationship management (CRM) systems, ticketing systems and collaboration tools can reach the same inboxes, wikis and databases employees use. Some sit near workflows that move money, change permissions or handle sensitive data. When compromised, they may not just return a bad answer. They can carry the wrong instruction into a real business process before a human has reviewed it.
3. Treating Governance As A Document Rather Than An Operating Discipline
A policy in a shared folder is not governance. Governance is knowing who owns the output, who reviews the data, who can stop a deployment and who answers when the model is wrong and the decision matters.Why Frameworks Need Accountability
Leading government, standards and research organizations have developed useful tools, including NIST’s AI Risk Management Framework, ISO/IEC 42001, the EU AI Act’s risk model, OWASP’s Top 10 for LLM Applications and MITRE ATLAS. Each maps a different part of the terrain. The problem is that knowing the terrain is not the same as controlling it.This is where AI adopters need a practical operating model. The value of any framework, including Adopt, Defend, Govern, depends on whether it helps teams turn guidance into repeatable behavior.
Most organizations interact with frameworks like periodic compliance exercises. That approach worked reasonably well for static infrastructure. It doesn’t work for systems that learn, adapt and generate outputs continuously, where the risk profile changes every time, the underlying model is updated, the retrieval database is modified or a new agentic workflow is added.
Governance requires continuous ownership. Someone must be able to answer the basic questions. What did this AI tool decide? Which data shaped the output? Who approved its use? What happens if the answer was wrong? Without that clarity, governance becomes something teams can point to, but not something they can act on.
Making AI Governance Work
Responsible adoption starts with deliberate choices. Some workflows benefit from automation, while others need slower review because the cost of a wrong answer is too high. Mature adoption means understanding where AI creates genuine value, where it adds unnecessary risk and when a deployment is not ready.Defending AI-enabled environments means treating AI as a security surface with its own failure modes. A poisoned dataset will not look like a malware file. A prompt injection attack will not look like a network intrusion. Security teams need to understand how models behave, how connected tools can be abused and how output can become action through permissions, workflow automation or misplaced trust.
Governing AI at scale means putting oversight into daily operations. Leaders need to know which data is feeding which model, where audit trails exist, which decisions require human review and how accountability moves up the organizational chart. Buying the technology doesn’t transfer responsibility for what it does.
The Urgency Needed From Us
AI governance has felt abstract to many executives because the consequences have often been abstract too. That period is ending. AI now touches hiring decisions, healthcare recommendations, financial analysis, customer interactions and security operations. Regulators, customers, employees and boards are asking harder questions about accountability.Organizations that treat this mainly as a legal exercise may end up spending the next decade reacting to problems after they surface. A stronger path builds ownership into the way AI is selected, tested, deployed and monitored. That work is slower than buying another tool, but it is what makes AI adoption durable.
Moving forward, companies must have more than fast deployments to be leaders in this space. They must also be able to explain what they built, defend how it works and take responsibility when it affects people.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
