OneTrust and EY both found enterprise AI use moving faster than the controls meant to govern it: OneTrust says 74% of organizations already have departmental or scaled adoption, while EY says nearly one-quarter cannot detect unauthorized AI agents inside the enterprise.
The gap is not lack of paperwork. Many organizations already have human-in-the-loop rules, training, inventories, and vendor reviews, but those controls do not guarantee they can spot an agent running in the background or know who owns it once deployment starts. In EY’s reporting, many respondents said no single group oversaw agents after deployment and that their frameworks had not been updated for agent-specific risk.
For security, risk, audit, and AI governance teams, the lesson is where the exposure lives: if a copilot or agent can read internal data or take actions under normal business permissions, policy on its own does not show whether an unauthorized agent is already operating. The remaining question is operational visibility, not adoption.