The governance gap is not simply a lack of policy. It is the distance between how quickly AI is entering the organisation and how clearly leaders can see its purpose, ownership, expected value, risk and current status.
What current research shows
The Governance Institute of Australia reported results from 485 directors, executives and governance professionals across Australasia and beyond. The findings describe adoption among governance professionals and the maturity of board oversight in the organisations represented:
A separate 2025 Human Technology Institute survey, reported in the AICD and HTI Director’s Guide to AI Governance, found that 90% of 419 surveyed directors, senior executives and decision-makers said their organisations were using or planning to use AI. These surveys measure different groups, but point in the same direction: adoption is broad and formal oversight is still developing.
Why AI use is difficult to see
AI rarely enters through one controlled programme. It arrives through staff subscriptions, supplier products, productivity tools, experimental projects and features added to software the organisation already owns. This creates three common blind spots:
- Product visibility: procurement may know the supplier, but not every AI feature or business use.
- Use-case visibility: one product may support several purposes with different data, impacts and owners.
- Strategy visibility: pilots and purchases may proceed without a clear link to an organisational objective or measure of success.
The 2026 AICD and HTI guide identifies both embedded AI and employee-led shadow use as board-level visibility concerns. It also recommends a stocktake or mapping exercise before an organisation develops and implements its AI strategy.
Govern opportunity as well as risk
A weak governance process can slow good ideas as easily as it overlooks risky ones. When every proposal follows the same long review, low-impact experimentation becomes frustrating. When there is no review, higher-impact use can move ahead without the right evidence or ownership.
A proportionate model gives leaders a portfolio view. It helps them prioritise AI uses that support strategy, move lower-impact work efficiently, and direct specialist attention to uses with greater impact or uncertainty.
A practical response for management
- Set direction. Agree what the organisation wants from AI, where it will focus and where its risk appetite is lower.
- Build a baseline. Run structured discovery across business units and create a register for each distinct AI use.
- Assign accountability. Name an overall governance owner and a business owner for each use.
- Assess proportionately. Match questions, controls and review depth to the purpose, impact and uncertainty of the use.
- Track delivery and value. Link initiatives and use cases to strategic objectives and agreed measures.
- Report what changed. Give management and the board a regular view of progress, exceptions, incidents, overdue work and decisions required.
What the board should receive
The AICD and HTI recommend that boards agree the indicators and reporting cadence they expect. Reporting should show where AI is used, how it is performing, where risk is changing, and whether the portfolio remains aligned with strategy and risk appetite. It should be written in business language rather than unnecessary technical language.
It gives leaders a current view of AI use, strategy, ownership, evidence, decisions and progress. It also makes gaps visible, including business units that have not responded or supplier information that remains unknown.
Sources and further reading
- Governance Institute of Australia, AI is in the boardroom. Its governance isn't yet
- AICD and Human Technology Institute, A Director's Guide to AI Governance, Version 2
- National AI Centre, Guidance for AI adoption: foundations
- ASIC Report 798, Beware the gap
This article summarises general governance research and practice. Organisations should adapt their approach to their sector, obligations, stakeholders and risk profile.