Policy · 45 days ago
OneTrust and EY both found enterprise AI use moving faster than the controls meant to govern it: OneTrust says 74% of organizations already have departmental or scaled adoption, while EY says nearly one-quarter cannot detect unauthorized AI agents inside the enterprise.
The gap is not lack of paperwork. Many organizations already have human-in-the-loop rules, training, inventories, and vendor reviews, but those controls do not guarantee they can spot an agent running in the background or know who owns it once deployment starts. In EY’s reporting, many respondents said no single group oversaw agents after deployment and that their frameworks had not been updated for agent-specific risk.
For security, risk, audit, and AI governance teams, the lesson is where the exposure lives: if a copilot or agent can read internal data or take actions under normal business permissions, policy on its own does not show whether an unauthorized agent is already operating. The remaining question is operational visibility, not adoption.
2 sources covering this story
Companies’ AI strategies don’t account for agentic tools
Businesses are taking AI governance seriously, but their plans lag behind the technology they’re using, according to an EY survey.
Your employees are already using AI tools you never approved - Help Net Security
Enterprise AI governance trends show rising agent adoption, fragmented oversight, growing risk workloads and higher budgets ahead.
Part of the PlainSec briefing for 2026-09-16