AI transformation is a problem of governance is an argument you now see in many business articles. It says that companies struggle with AI not because the models are weak, but because they lack clear rules, owners, data policies, and oversight. There is real support for part of this idea, and also good reasons not to treat it as the whole story. This guide explains what the claim means, what the sources behind it say, which statistics are cited and by whom, what a practical governance setup looks like, and where the argument has limits. Many of the articles that make this claim are written by companies that sell AI services, so we flag that bias and mark which numbers come from outside research as cited, not independently checked by us.
What “Governance” Means Here
Governance means the rules and responsibilities that guide how an organization uses a technology. For AI, it covers questions such as who may use which tools, what data may be entered, who approves new AI projects, how risks are rated, how outputs are checked, and who is accountable when something goes wrong.
It is not the same as technology. A company can have excellent models and still have no clear policy on customer data. It can also have a clear policy but weak tools. The governance claim says the first problem is more common and more damaging than people admit.
The Argument in One Article
Evgeny Lupanov, chief technology officer of Akveo, published an article on July 23, 2026, arguing that AI pilots often stall before production because organizations lack rules for data, risk, and operational control, not because the models or infrastructure are weak. He describes governance as the brakes on a sports car: a way to move faster safely. He says scaling AI without guardrails scales legal and financial risk. You can read it in Akveo’s article on AI transformation and governance.
Akveo is a software development company that sells AI development and consulting, and the article promotes its own approach, so its recommendations also serve its business. Still, the risks it describes are real and widely discussed.
The Risks Named
The article lists several risks. Employees may send proprietary code or customer records to unmonitored outside services. Businesses, not model vendors, bear the responsibility for harmful outputs such as invented advice or wrong prices. Costs that look small in testing can grow fast under real traffic. Models can degrade over time while still running without errors. And in systems that chain several AI agents, small errors can compound.
It also notes that the European Union’s AI Act adds obligations for risk management, transparency, human oversight, and documentation, depending on the risk level of the system. Rules vary by country, so check the law that applies to you.
Statistics Cited, and Their Limits
The Akveo article cites a few numbers from outside sources. It says McKinsey’s 2026 trust research found average responsible AI maturity rose from 2.0 in 2025 to 2.3 in 2026, and that 55 percent of organizations have mature data and technology practices while only 35 percent have comparable maturity in baseline governance. It cites a KnowBe4 report saying about 51 percent of employees use unapproved apps or AI tools outside policy.
A second article, published by CTO Magazine without a clear date, cites Deloitte’s 2026 AI report as saying that 74 percent of companies plan to deploy agentic AI within two years, while 21 percent report a mature governance model for autonomous agents. It gives no methodology. We did not read the original reports, so treat these figures as claims we have traced to their citations, not as verified facts. That second argument is CTO Magazine’s piece on enterprise AI governance.
A Public Framework: NIST
For a neutral reference, the U.S. National Institute of Standards and Technology released its AI Risk Management Framework on January 26, 2023. NIST says the framework helps organizations manage risks to individuals, organizations, and society from AI, and is meant to help build trustworthiness into how AI products and systems are designed, developed, used, and evaluated. It is intended for voluntary use. On July 26, 2024, NIST released a generative AI profile to help organizations identify risks unique to generative AI. The page also says the framework is being revised as part of the White House AI Action Plan. See NIST’s AI Risk Management Framework page.
The framework names four functions, Govern, Map, Measure, and Manage, though the page we read did not describe them in detail. The fact that “Govern” is one of them supports the view that governance is part of the core of managing AI risk.
What Good Governance Looks Like in Practice
The Akveo article offers a simple approach. First, find out what AI tools people already use, for example through a short anonymous survey. Second, create a data policy with three levels, like a traffic light: green for public material that can be used with any public tool, yellow for internal data that should go only into vetted tools, and red for source code, health, financial, and personal data that should never go into public commercial models. Third, give people an approved tool so they do not turn to personal accounts. Fourth, add technical controls such as logging, output checks, rate limits, and monitoring for model drift.
The CTO Magazine article proposes a longer list of pillars, including data governance, fairness, transparency, risk classification, security, human oversight, monitoring, legal compliance, and auditability. It also suggests classifying systems as low, medium, or high risk and keeping humans involved in critical decisions.
Start Small
Many organizations do not need a large program on day one. A short policy, a named owner, a list of approved tools, and a simple review process can cover the biggest risks. Then you can add more as your use of AI grows.
Write the rules in plain words. A policy that no one can understand will not be followed. Train staff with real examples, such as what to do if a chatbot gives a wrong answer to a customer.
Data Protection Basics
Most AI risk starts with data. Decide what staff may paste into AI tools, and make sure they know the difference between public and confidential information. Check the privacy terms of any vendor, including whether your data is stored or used for training. Limit access to sensitive information, and keep logs.
For simple habits that help every employee, read this guide on staying private online. Training on these habits costs little and prevents many mistakes.
Cost Control Is Also Governance
A less obvious part of governance is cost. The Akveo article notes that token costs that look small in testing can grow quickly in production without limits or caching. Set a clear budget for AI projects, track spending by team, and review it monthly. Decide who can approve new subscriptions.
Without this, a company can end up with dozens of overlapping tools and unexpected bills.
Accountability and Human Oversight
When an AI system gives a harmful answer, people want to know who is responsible. Governance assigns that role in advance. A named owner for each system, a review process before launch, and a path for customers to report problems all help.
For decisions that affect people’s rights, money, health, or safety, keep a human in the loop who can understand and override the system. Keep records of how the system was tested and how it performed.
Where the Argument Has Limits
The governance claim is useful, but it can be overstated. The CTO Magazine piece attributes AI failures to governance and dismisses technical limits without evidence, relies mainly on one cited report, and includes an unsupported statement about a specific chatbot. Real projects fail for many reasons, including poor data quality, unclear goals, weak skills, high costs, and models that simply do not work well enough for the task.
Governance also has costs. Too many approvals can slow teams and push them toward unapproved tools, which the cited survey suggests already happens. The best approach balances safety with speed, and tests whether the rules help people do their jobs.
Questions Leaders Can Ask
Do we know which AI tools our staff use? Do we have a written policy on data? Who owns each AI system, and who is accountable? How do we test accuracy and fairness before launch? How do we monitor performance after launch? What do we do if the system fails or causes harm? Which laws apply to us? How much are we spending, and what value are we getting?
If these questions have no clear answers, governance is a good place to start.
The Wider Business Context
Investors and executives who follow the wider market often hear big promises about AI. Governance helps separate real progress from hype by asking for evidence, ownership, and controls. We do not predict outcomes or give investment advice.
What We Could Not Verify
We did not read the original McKinsey, KnowBe4, or Deloitte reports and relied on how two articles cited them. One article is from a company that sells AI services, and the other has no clear date or disclosed interests. We did not verify EU AI Act details beyond how the article describes them. The NIST page we read did not describe the four functions. We did not test any governance tool, and we cannot say which approach works best for a given company.
Conclusion
AI transformation is a problem of governance is a useful argument with real support: data exposure, unclear accountability, rising costs, and drifting models are all risks that rules and oversight can reduce. Articles cite surveys showing that governance maturity lags behind technology and adoption, and NIST’s framework puts governance at the core of AI risk management. But the claim is not the whole story, since many projects also fail for technical, data, and skills reasons, and many of the people making the argument sell related services.
A practical path is to start with a short policy, an owner, an approved toolset, and a risk review, then improve as you learn. Good governance should help people use AI safely, not stop them from using it at all.
Frequently Asked Questions
1. What does “AI governance” mean?
It means the rules, roles, and oversight that guide how an organization uses AI, including data, risk, and accountability.
2. Why do some say AI transformation is a governance problem?
They argue that projects stall or create risk because organizations lack clear policies and ownership, even when the technology works.
3. Is governance the only reason AI projects fail?
No. Poor data, unclear goals, weak skills, costs, and technical limits also matter.
4. What is the NIST AI Risk Management Framework?
It is a voluntary framework released on January 26, 2023 to help organizations manage AI risks, with a generative AI profile added in July 2024.
5. Where should a company start?
Find out which AI tools are in use, write a simple data policy, name owners, provide approved tools, and add monitoring.
