Opinion: The AI Governance Gap Won't Close by Slowing AI Down

Enterprises are deploying AI faster than they can govern it, and most of them know it. That is the plain reading of a study Smarsh released on Tuesday, and it should change how executives think about governance. The gap will not close by slowing AI down. It will close only when governance is built as infrastructure that moves at the same speed as deployment.

What did the Smarsh study find?

According to Smarsh's 2026 Enterprise AI Trends Study, conducted by FTI Consulting, 55% of enterprises are actively deploying AI, but only 26% say their governance frameworks are fully keeping pace, MarTech Series reported. Only 30% report comprehensive ability to detect and manage shadow AI, meaning tools employees use outside approved workflows.

Investment priorities point the same way. Sixty-two percent are investing in AI and machine learning, 53% in data quality and enrichment, and 51% in modernizing their archives. Smarsh sells compliance software and the summary omits the sample size, so the study is not definitive. But it matches what practitioners tell us at AI Connect events.

James Condon of FTI Consulting summed it up: "AI readiness is no longer just a technology challenge."

Why can't governance keep up with AI adoption?

Because most governance was designed for a world of slow, centralized projects. A model went through a review board, got approved and ran for years. Today, AI arrives through dozens of doors at once: features switched on inside software a company already licenses, agents built by business teams, browser tools employees adopt on their own, and services partners deploying at scale.

This week offered a reminder of the speed. Cognizant announced plans to put Google's Gemini Enterprise in the hands of 100,000 of its own employees this year, scaling toward 200,000, according to its announcement. No committee reviewing use cases one at a time can match that pace.

Is shadow AI really a new problem?

Not really, and that is good news. "Shadow AI is nothing different from shadow IT," Dave Horton, VP of solutions and engineering at Airia, said in a AI Connect webinar on detecting shadow AI and offering sanctioned alternatives. The lesson from shadow IT was that bans fail and better approved options win. Employees reach for unsanctioned tools because they find them useful, which is a signal about demand.

The 30% figure for shadow AI detection is the most worrying number in the study for that reason. Most enterprises cannot see what employees are already using, so they cannot learn from it, secure it or replace it with something better.

What does governance as infrastructure look like?

Our position is that governance should be treated like a platform, not a checkpoint. In practice that means:

• Automated controls in the pipeline. Testing, access policies and monitoring built into how AI gets deployed, so compliance happens by default.
• Data governance first. Most AI risk starts with data: who can see it, how fresh it is and whether it can be trusted. Smarsh's respondents seem to agree, with more than half investing in data quality.
• Visibility before restriction. Inventory what employees and agents are actually using before writing rules about it.
• Risk tiers. Light review for low-risk tools, deep review for anything touching customer data, production code or regulated decisions.

None of this is theoretical. At COLLIDE 2025, a generative AI scaling lead at ADP said the company's "number one thing is governance by design," meaning clear direction for developers, automated testing and proactive monitoring before production, as described in our report on AI data governance at speed. On the same panel, Susan Laine of Quest Software described the opposite pattern among companies in a hurry: "Our clients are skipping the metadata. They're skipping the governance."

Skipping those steps does not save time. It moves the cost to later. Our coverage of the hidden costs of poor data quality shows how quickly that bill grows.

What about the case for moving fast?

The opposing argument deserves a fair hearing. Many leaders worry that governance teams become the place where AI projects go to die, and that competitors who move faster will win. They note that perfect governance is impossible when models change every few months.

They are partly right. Governance that requires a committee meeting for every prompt template will be ignored, which creates exactly the shadow AI problem it was meant to prevent. A governance program that cannot say yes quickly is not doing its job.

But the evidence this week suggests the bigger risk is the other way. KPMG's latest Global AI Pulse found that almost half of businesses have paused or scaled back AI projects because costs outweighed value, IT Brief UK reported. Moving fast without visibility did not produce speed. It produced reversals.

What should leaders do this quarter?

Start with an inventory of every AI tool and agent in use, sanctioned or not. Assign governance an owner outside IT. Fund data quality as part of every AI budget, not as a separate project. And measure the governance team by how quickly it approves safe uses, not by how many it blocks.

The companies that close the gap will not be the ones that slow down. They will be the ones whose governance runs as fast as their AI.

Frequently asked questions

What did the Smarsh AI study find?

55% of enterprises are actively deploying AI, 26% say governance is fully aligned with that pace, and 30% can comprehensively detect and manage shadow AI.

What is shadow AI?

AI tools employees use outside approved workflows; practitioners compare it to shadow IT and recommend better sanctioned alternatives over bans.

How can governance keep up with AI adoption?

Build automated controls into deployment pipelines, start with data governance, inventory actual usage first and apply review in proportion to risk.

Opinion pieces reflect the views of The AI Enterprise Magazine Team.

Filed under: AI Governance & Trust, Security & Fraud, Observability & Data Quality