2026 Riskonnect Survey: Corporate AI Use Outpaces Governance
Artificial Intelligence (A.I.)

2026 Riskonnect Survey: Corporate AI Use Outpaces Governance

Generative AI may be transforming business operations at warp speed, but AI governance and risk management are lagging. Just 17% of risk leaders feel very prepared for AI and AI governance risks. Another 62% say they feel somewhat prepared.

That’s according to Riskonnect’s 2026 New Generation of Risk Report. This fourth annual report surveyed more than 250 risk, compliance, and resilience professionals worldwide on how they and their organisations are responding to a risk environment moving faster than ever.

More Have AI Policies – But They Only Go So Far

This year, 72% of respondents say they have a policy governing AI use by employees, up sharply from 58% last year. But the data indicates these policies are stopping at the surface. Only 54% of respondents say they have clear policies and guidelines on what AI tools can be used and how they can be used. That indicates a sizable minority is left to figure things out on their own.

That gap matters because organisations are making judgments on specific AI tools – and governance must go deeper than a blanket AI policy.

Respondents have clear opinions on which AI tools are lower in risk. When asked to rank large language models – including ChatGPT, Claude, Copilot, Gemini, Grok, and Perplexity – by perceived risk to the organisation (with 1 representing lowest risk and 6 highest risk), Copilot is considered lowest risk, with 64% rating it a 1 or 2, followed by ChatGPT (54%) and Claude (39%).

According to the report, only:

  • 31% have a policy against using foreign AI models like DeepSeek.
  • 30% have a policy in place to govern the use of AI by partners and suppliers.
  • 23% have a dedicated plan to specifically address AI risks, including but not limited to deepfakes and AI-driven fraud attacks.
  • 11% have a budget specifically aimed at mitigating AI-related risks.

Few Companies Have Assessed Risk of Agentic AI

Agentic AI – where nonhuman agents autonomously execute tasks – is gaining ground. Most respondents indicate their companies are somewhere on the agentic AI adoption curve, saying they’ve either already incorporated (27%) or are considering (56%) incorporating agentic AI solutions into the organisation’s operations or products.

Among those that say their companies have already incorporated agentic AI, 84% say they’ve assessed the risk, though that number should arguably be 100% for a technology already live within the business. Among the much larger group still considering it, 58% have not assessed the risk.

Moving fast on agentic AI shouldn’t mean skipping the conversation about risk. Companies that build risk into the evaluation and decision process from the start are in a better position to capture the value agentic AI can deliver while staying ahead of what it can get wrong.

Training Lacks on What to Trust Versus Challenge

Less than half of respondents – 46% – say their organisations have trained employees on how to evaluate AI outputs in terms of what to trust versus challenge. Just 35% say their companies have trained employees on how to interpret and act on AI-driven insights.

Training also lags when it comes to governance and managing the risks of AI. While 66% have trained employees on rules, responsibilities, and defined roles around AI oversight and accountability, just 19% have formally trained or briefed the entire company on risks related to agentic AI.

Even for generative AI, which has been on the mass market longer than agentic AI, only 35% of companies have done formal and company-wide training on the risks. This number has climbed slowly from 17% in 2023.

Next Steps: How to Think About AI Governance

AI adoption is not waiting for the corporate green light. New tools, use cases, and integrations show up regularly. Staying ahead of the risk starts with building strong guardrails that consider the bigger picture:

  • Where is your organisation currently using AI? Which tools are in use, in which functions, and who is making the call to use them?
  • What’s your process for evaluating a new AI tool before it’s brought in?
  • Are you tracking how the AI tools change over time?
  • Which outside partners and AI model providers sit behind those tools? Do you know the full list?
  • How does the AI tool make its decisions?
  • What level of autonomy do you want the tool to have and where should human oversight kick in?
  • How does the AI tool fit into the core business processes?
  • Who oversees the AI tool?
  • If the AI tool stops working, what happens? Do you have a continuity plan?

Bringing in a new AI tool deserves the same scrutiny as hiring a new employee. Is it trustworthy? Do you understand its decision making? Is it ethical? Can it do the work you expect it to? Does it deliver with confidence?

You wouldn’t hire someone and never check in again – and AI’s performance must be similarly reassessed, especially as tools update. Watch for drift. Assign someone to be accountable for how each tool is performing over time.

Many organisations already rely on AI tools to improve operational efficiency, support decisions, and even complete tasks. Minimise your exposure by governing AI like any other risk. Teach employees when to trust what AI tells them, when to challenge, and how to validate results. Deploying a tool isn’t the same as preparing people to use it responsibly.

For an in-depth look at the survey findings, download the 2026 New Generation of Risk Report, and visit riskonnect.com.

Your Next Read

'; var url = API_ROOT + '/posts/' + postId + '?_embed=1'; fetch(url) .then(function (response) { if (!response.ok) { throw new Error('Post not found'); } return response.json(); }) .then(function (post) { renderPostCard(post, element); }) .catch(function (error) { console.error('Custom post fetch error:', error); element.innerHTML = '
Blog post could not be loaded.
'; }); } function initCustomPostTags() { var elements = document.querySelectorAll('[cuspostid]'); elements.forEach(function (el) { fetchPostForElement(el); }); } if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', initCustomPostTags); } else { initCustomPostTags(); } })();