On September 15, EY published the inaugural edition of its AI Risk and Governance Survey. It covers 202 senior AI decision-makers, from board members to vice presidents, at US publicly traded companies with at least a billion dollars in annual revenue, and it was fielded between May 28 and June 15, with a margin of error of seven percentage points. Two caveats belong next to it: EY sells assurance and advisory services, so it has an interest in the case for stronger governance, and these are large listed companies, not the typical small or mid-sized business.
The two headline figures are the useful part. Ninety-eight per cent of respondents say their organization has formal AI governance policies in place, and forty-seven per cent say it has bypassed its own governance process for urgent deployments. Both can be true at once, and the second one is the one that matters.
The figures on agents point the same way. Among respondents whose organizations use agentic AI, forty-nine per cent say their governance frameworks have not been updated for it, and twenty-six per cent say their organization cannot detect unauthorized AI agents operating internally. CIO Dive, which covered the survey the next day, framed the whole thing as a widening gap between policy and practice.
Why the shortcut wins
This is our reading rather than a finding of the survey. When the only route to launch is a slow review, the urgent case does not wait for it; it goes around. A process that is skipped whenever there is a deadline does not protect the cases with a deadline, and those are the ones with the least time to spot a mistake.
What EY itself concludes
In coverage of the survey, the chief technology officer of EY's assurance practice in the Americas argues that speed and governance are not opposed, and that good governance is what lets an organization move quickly without losing control. We agree, with one condition: it only holds if the governed route is fast enough to be the easiest one.
Four ways to build a fast lane
- Sort uses by risk and give the low-risk ones a one-day route. For example, an agent that only reads internal material, touches no personal data, takes no action outside the company and has its output read by a person can be approved by one named person against a short checklist. Everything else gets the full review.
- Put a clock on the review. Agree how many working days the reviewer has to answer, and what happens when the time runs out, so that waiting is never the reason someone goes around.
- Record every exception. If an urgent launch skips a step, write down which step, who allowed it and by when the gap will be closed. The survey does not say how many of those forty-seven per cent were recorded; the point is that in your company all of them should be.
- Keep a register of the agents that are running. One line each: what it does, what it can access, who owns it. Without the list of authorized agents there is no way to spot an unauthorized one, which is the situation the twenty-six per cent describe.
For our part, each agent we deploy has a named supervisor and a written list of what it may read and do, and we would rather keep that list short and current than long and ignored.