Artificial Intelligence
AI Governance in 2026: Why Decision Rights Must Keep Moving
Article
CK Editorial Team
6
min read
A formal AI governance policy is now close to universal among large enterprises, and a near-majority admit to routing around it. According to AI Risk and Governance Survey 2026, 98% of senior AI decision-makers report formal policies, yet 47% say their organisation has bypassed its governance process for an urgent deployment.
A policy that gives way under pressure is no longer governing the decision it was written for. The likelier explanation is that it was drafted for a level of capability that has since moved, and the decision rights it assigns have drifted out of alignment with what the systems can now do.
The Numbers Behind the AI Governance Gap
Governance failure is usually framed as an absence of policy, and the data points elsewhere. The figures below follow one sequence: how much decision-making authority is moving to agents, how far governance maturity trails that movement, and how much of existing policy is actually enforced.
Gartner projects that at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from none in 2024.
Against that trajectory, an enterprise survey finds only 21% of organisations have a mature governance model for autonomous agents, while 74% expect to use agentic AI at least moderately within two years.
Where policy does exist, enforcement lags a report on data breach found that only 34% of organisations with AI governance policies perform regular audits for unsanctioned AI.
Authority is being delegated faster than the structures meant to govern it can mature or be enforced. To see where those structures fall short, the starting point is what AI governance is formally meant to cover.
What AI Governance Covers
AI governance is the framework of policies, practices and processes that guides an AI system from first design to live operation. It can be read through three components: the principles it upholds, the lifecycle it spans, and the roles that own it.
Fairness: systems remain trustworthy and aligned with human values and organisational policy.
Accountability: responsibility for an error sits with a named person or process.
Transparency: the basis for a system’s conclusions can be explained, audited and trusted.
Safety and security: systems are protected against attack, compromise and interruption.
These principles apply across the lifecycle, from design and planning, through development and testing, to deployment and ongoing monitoring. Responsibility for upholding them typically sits with a Chief AI Officer, an AI safety team and an AI governance board.
Together, these form the structural layer most governance programmes share. What it leaves unspecified is how authority should change when a system’s capability does, and that gap is where a policy written once begins to fail.
A Framework of Autonomy Tiers and Decision Rights
If authority must move with capability, it needs a structure to move through. The following model ties each autonomy tier to a named decision owner and an explicit trigger for reassessment, extending the staged logic of the integration framework in the first article of this series.
A governance policy encodes the capability of its moment. An assistant that only retrieves and suggests can sit behind a single approval path, since a human acts on every output. An agent that executes cannot. Mature governance for agents requires clear boundaries on which decisions an agent may take independently and which need human approval, backed by real-time monitoring and audit trails. Because an agent’s permitted action space widens as its capability grows, those boundaries work best as tiers that are reassigned over time.
Review cadence follows the same logic. Monitoring remains largely periodic of about 59%, a rhythm suited to static systems. Agents whose behaviour shifts between checkpoints call for review triggered by change, and at least one national regulator already describes its agentic AI framework as a living document.
The design question that follows is who holds the right to move an agent up a tier, and on what evidence. The model below answers it, tying each autonomy tier to a named decision owner and an explicit review trigger, and extending the staged logic of the integration framework in the first article of this series.
The trigger column carries the weight, because it is the mechanism that moves authority. The clearest way to see it working is through a single agent.
How One Agent Moves Through the Tiers
Decision rights hold only when they are embedded in a repeatable process. In practice, this takes the form of an agent governance lifecycle comprising five phases, from initial proposal through to retirement.
Ideate and Plan
The process begins by confirming that an agent is the right solution, since some problems are better served by rules-based automation or search. Purpose, business owner, success metrics and risk profile are defined here, along with the agent’s authority boundaries and human approval points.
Build and Configure
The components that shape an agent’s behaviour (models, prompts, tools and data) are managed as versioned, reviewed and documented elements, because a change to any of them changes the agent. Access is limited to what its approved purpose requires.
Test and Evaluate
Testing extends beyond whether the software runs. Behaviour is evaluated across tasks and conditions, including security testing for prompt injection and data leakage, policy compliance checks and approval-flow testing, with red teaming for higher-risk cases.
Deploy and Provision
Release is controlled, with separate environments, phased rollout and rollback plans. Credentials and permissions are scoped to the agent’s approved role, and sensitive actions can carry approvals, rate limits or an emergency kill switch.
Monitor and Refine
Outputs, tool calls, error rates, policy violations and anomalous access are observed in production. When performance degrades or behaviour shifts, refinements pass through testing, approval and documentation again. At retirement, credentials are revoked and logs preserved.
Taken together, the five phases establish that governance cannot be treated as a launch-stage control. Each phase assigns accountability for a defined decision, and the monitoring phase returns the agent to review as its behaviour and operating context change.
What Enterprise Leaders Should Do Next
For enterprise leaders, sustaining effective oversight as agent capability advances rests on three operating principles, each drawn from the framework and lifecycle described above.
Assign authority by autonomy: Decision rights should follow what an agent may do, so systems with different action rights never share one approval path.
Define advancement criteria early: Every autonomy level needs a named owner and a reassessment trigger, defined in advance so authority moves on evidence.
Route every change through governance: Model updates, tool access changes and urgent deployments all re-enter the lifecycle. Where urgency may shorten a review, but never remove it.
Effective AI governance depends on keeping decision rights aligned with evolving capabilities, with accountability and oversight built into every stage. As enterprises move towards greater autonomy, integration, execution and governance must advance together. These three dimensions will be explored further in our forthcoming whitepaper on enterprise AI adoption.
