Why Your AI Governance Isn't Working

A recent enterprise survey by WitnessAI found that 30% of organizations report unmanaged or poorly governed AI has led to cost overruns. Another 27% say it's delayed or canceled AI initiatives altogether. The report's conclusion is straightforward: organizations are deploying AI faster than they're building the visibility, ownership, and risk management practices to manage it responsibly.

I don't disagree with that. If anything, I think it points to a bigger issue than the survey captures.

Most organizations believe they already have AI governance in place. They've approved a set of tools. They've published an acceptable use policy. They've tightened their security controls and updated their data privacy requirements. Those are all worthwhile investments, and I don't want to diminish them. But they're a starting point, not a finish line. Real AI governance is a lot broader than governing the technology itself.

In my experience, governance efforts fall short for three reasons. They stop at the tool. They ignore how the work itself is changing. And they assume you can actually see where AI is being used. The third is the one I think matters most, but let me take them in order.

Governance that stops at the tools and policies

The first reason so many organizations struggle is that their governance stops at the tool.

Whether approving ChatGPT or Copilot, defining an acceptable use policy, or restricting sensitive data; all of it matters. It reduces risk, and it gives employees the guidance they've been asking for. But it only answers one question: which AI tools should people use?

It doesn't answer the question that matters more: how is AI changing the way our organization operates?

And here's the thing. Approving a tool and defining a policy aren't even that effective on their own. Roughly six in ten employees say they use personal or unapproved AI tools at work, and that number holds up across study after study. What's striking is how little it moves based on whether a company has policies and authorized tools in place. In one survey, half of workers said they'd refuse to give up their personal AI tools even if their employer banned them outright. Shadow AI isn't just a symptom of missing policy. It persists right through the policy. So even the narrow goal, deciding which tools people use, is one most organizations are quietly losing at.

That leads straight to the second reason.

The work itself is changing, and few have noticed

Most organizations haven't stopped to understand how the work is changing underneath them.

People aren't just doing the same tasks faster. They're researching differently. Writing differently. Analyzing differently. Preparing recommendations differently. In a lot of cases, they're solving problems in ways that didn't exist a year ago.

Whether leaders have noticed or not, the workflows are already evolving.

The problem is that most leaders haven't brought their people into the conversation. They haven't sat down with their teams to find out which tools actually work for them, where they see room to be more productive, or how AI is already reshaping the way they get things done. That knowledge lives with the employees who are experimenting every day, and in most organizations it never surfaces, never gets shared, and never gets acted on.

Leaders also haven't been proactive about the next step, which is sitting down with their teams to intentionally define new workflows and playbooks for how they operate. It's not enough to notice the work is changing. Someone has to deliberately redesign how it's done, capture what's working, and turn it into a shared way of operating. Very few organizations have done that.

So when leaders don't engage their people and don't intentionally define the new way of working, employees define it for themselves. That's a big part of why shadow AI is so stubborn. The organization leaves a vacuum on how work should happen, and people fill it on their own, one personal workaround at a time.

You can't always see where AI is influencing decisions

The third reason is the one I think matters most, and it's the one leaders are least prepared for.

Most companies are approaching governance as if they can identify every place AI shows up and put a control around it. That doesn't hold up. AI's influence is often invisible and happens well before the typical leadership reviews.

Consider a few ordinary moments. A manager preparing for a promotion decision asks ChatGPT how to evaluate the candidates before she ever meets with HR. A pricing analyst uses a personal Gemini account to pressure-test his logic before recommending a customer price increase. A sales manager asks Copilot to build a proposal for a potential new client before walking it into a leadership meeting.

None of those show up in an approved workflow. None get documented. The AI use may be out in the open, or it may not be. But in every case, AI has already shaped the decision by the time anyone with authority sees it.

So here's the shift I think leaders need to make. Stop assuming you can find every place AI is involved. Start assuming it's involved in every decision, whether it shows up in your formal process or not. Once you accept that, the target of governance has to change. If you can't reliably control the tool at the moment it's used, then the thing worth governing was never the tool. It's the decision itself.

And this is the part that trips people up. Controlling decisions in the age of AI doesn't look like controlling decisions used to.

For years, the model was layered approvals. Work moved up the chain, someone reviewed it, someone signed off. The control sat at the end, on the finished product.

That worked when the thinking happened in plain view on its way up. But AI does its work much earlier, long before anything reaches an approver. By the time a recommendation lands on someone's desk, the assumptions are already set, the analysis is already framed, and the reasoning is mostly locked in. Signing off on the final version tells you very little about what actually shaped it.

Controlling decisions in the age of AI means moving upstream, to the inputs and the reasoning, not the sign-off. In practice, that looks like a few habits:

• Defining and documenting the source of the key inputs behind a decision, so it's clear what the recommendation rests on.

• Having explicit criteria for validating data, instead of accepting a clean-looking output at face value.

• Making sure that accountability for the judgment is clear, not just the approval.

  
  

None of this means you stop controlling AI. The approved tools, the acceptable use policy, the security controls, the data privacy requirements, they all still matter. Keep them. But treat them as the floor, not the ceiling. They protect the perimeter. They can't reach the decision. And the decision is where AI's real influence lives, so that's where governance has to follow.

The question worth asking

All of this points to a different question than the one most governance programs start with. Instead of asking "how do we control AI use," ask:

What are we doing to help people make better business decisions, whether or not AI was involved?

That one shift moves the conversation away from governing technology and toward strengthening the organization itself.

Are people working from the right information? Are the important assumptions getting challenged instead of waved through? Is accountability clear? Are decision makers actually learning from their outcomes? Are leaders building an environment where good judgment wins out over speed and convenience?

AI governance will always include policies, approved tools, security controls, and data privacy. It should. Those are essential building blocks, and I'd never argue otherwise.

But if we stop there, we shouldn't be surprised when initiatives stall, costs climb, and people quietly invent their own ways of folding AI into everyday work.

The organizations that win over the next decade will be the ones that decide better in a world where AI is part of nearly every decision we make.

Reference: WitnessAI. 2026 Enterprise AI Risk Survey: The Hidden Cost of Enterprise AI.

About Root Idea

Root Idea helps CFOs protect the business from AI decision risk. Root Idea works directly alongside finance teams to map AI influence, establishes decision governance controls that hold up to board scrutiny, and delivers training and change management to make governance stick. 

If your organization is scaling AI and governance hasn't kept pace, that's exactly the conversation we're built for. Learn more at rootidea.ai.