AI Governance Risk Evaluation in Regulated Enterprises
Most enterprises facing AI governance audits have policies; that is not the problem. The problem is that they have no operational way to detect which agents are already running inside their business, let alone enforce any rule against them. Stanford HAI's 2026 AI Index recorded 362 AI-related incidents in 2025, a 55% increase from the year before. That number is not a forecast; it is the scoreboard for the adoption-governance gap, already in play — and like any scoreboard, it only tells you how badly you're losing after the clock has already run.
How the regulatory landscape compounds risk across jurisdictions and sectors
The regulatory environment stopped being theoretical some time ago. EU AI Act prohibitions on certain AI practices became enforceable in February 2025. High-risk AI obligations under Annex III, which explicitly covers LLM-based systems used in credit analysis or producing credit-related summaries that feed decisioning, become fully enforceable August 2, 2026, carrying penalties up to €35 million or 7% of global annual turnover. For context on what "global turnover" means applied to a large financial institution, stop and do the math.
In U.S. banking, SR 11-7 was replaced by SR 26-2 in April 2026. The updated guidance is more principles-based and, notably, explicitly excludes generative and agentic AI from its current scope. A forthcoming AI-specific Request for Information is expected to close that gap, but it has not closed yet. The operative word is "yet." Existing model risk management expectations still apply in the interim, and examiners are not waiting for new guidance to ask hard questions.
The SEC's examination posture deserves particular attention because it illuminates an operational distinction that policy documents cannot resolve. Examiners distinguish between governance evidence generated continuously throughout the year and evidence assembled in the weeks before an examination. One is a record; the other is a presentation. They are not interchangeable, and sophisticated examiners know the difference on sight — like telling a diary from a history book written last Tuesday.
Healthcare compounds the picture differently. The FDA finalized Predetermined Change Control Plan guidance in August 2025. ECRI ranked AI applications the top health technology hazard for 2025. A 2025 study found that 5.8% of FDA-cleared AI and ML devices had been recalled across 113 separate recall events. The 88%/18% split from a 2025 HFMA report captures the structural condition underneath these numbers: 88% of health systems report using AI, and only 18% have mature governance in place. That ratio is not a healthcare-specific anecdote; it is a concrete illustration of the adoption-governance gap at sector scale.
State-level obligations are accelerating the complexity. California's FEHA amendments addressing algorithmic discrimination took effect October 2025. Texas TRAIGA followed in January 2026. Colorado's AI Act arrives June 2026. A financial services firm operating across multiple states is not choosing which framework to follow. It is navigating all of them simultaneously, with no uniform standard to anchor against.
Singapore's IMDA released the first governance framework specifically designed for agentic AI in January 2026, introducing the concept of Agent Identity Cards for registered AI agents. Whether or not that specific mechanism travels to other jurisdictions, the framework signals where global standards are heading: toward agent-specific accountability structures, not extensions of tool-use policies.
The compounding effect is the point. A single AI deployment in financial services may simultaneously implicate EU AI Act Annex III, GDPR data minimization requirements, MiFID II suitability obligations, EBA and ESMA guidance on algorithmic systems, and state-level anti-bias rules, each governed separately and each enforced by a different authority. A governance evaluation that accounts for only one of those vectors is not a governance evaluation; it is an incomplete inventory of liability.
Dimension one: adoption visibility gaps and the shadow AI problem
The visibility problem is not at the margins. According to Gartner's 2025 data, 43% of organizations report they cannot audit or inventory the AI tools in use across their workforce. That is a majority problem dressed as an edge case. KPMG's 2025 findings add that 52% of organizations have no formal policy governing employee use of external AI tools, which means a substantial portion of the industry cannot enforce a rule it has not yet written.
Shadow AI, defined here as AI tools and agents operating inside the enterprise without formal approval or registration, is not fringe behavior. Optro's 2026 data characterizes it as pervasive or widespread in 35% of organizations, with another 45% describing it as moderate in prevalence. That leaves roughly 20% of organizations who either genuinely have it under control or have failed to look carefully enough to know that they do. The latter is more common.
Agentic AI makes the visibility problem structurally worse. Active agents in the Microsoft 365 ecosystem alone grew 15x year over year as of Microsoft's 2026 reporting. Gartner projects that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from under 5% in 2025. Those agents are not passive tools that require a human to activate them on each use. They carry credentials, call APIs, and write to systems of record. An unknown tool represents a policy gap; an unknown agent represents an operational exposure.
The financial consequence of that distinction is concrete. IBM's 2025 breach data found that shadow AI added $670,000 in average breach cost and extended containment time by ten days. That figure reflects not just the breach itself but the time required to reconstruct what an unregistered agent did, when, and to what data, without any pre-existing inventory to work from. Shadow AI, it turns out, casts a very long shadow.
Legal Nodes reported that approximately 78% of organizations had not taken meaningful steps toward EU AI Act compliance as of mid-2026. The most charitable explanation for that number is scope uncertainty. And you cannot scope compliance work against systems you cannot see.
A governance risk evaluation of adoption visibility needs to answer specific operational questions: which agents are currently running, and which of those were approved through a formal process? Which departments introduced them, and under whose credentials do they operate? Are newly deployed agents discovered automatically, or only when someone manually discloses them? Is the inventory continuous, or a point-in-time snapshot that begins aging the moment it is produced?
The difference between those last two answers is the difference between a governance program and a governance gesture.
Dimension two: how access and permission models built for humans fail for agents
Human access control was engineered around a behavioral assumption that almost no one stated explicitly: people ignore most of the permissions they have. Employees use a small fraction of their entitled access on any given day. The permissions they technically hold but rarely exercise create theoretical exposure, not operational exposure. Auditors have known this for years and have calibrated risk assessments accordingly.
Agents invalidate that assumption by design. An agent will use every permission available to it in pursuit of its objective. It will not hesitate, second-guess, or stop to ask whether accessing a particular dataset is really necessary. The human access model was built for a principal that exercises a fraction of its entitlements with judgment — not for one that exercises all of them without it. If human employees are like weekend drivers who take the scenic route, agents are like freight trains: they go exactly where the tracks point, at full speed, without stopping to admire the view.
The specific failure modes that surface in agentic deployments follow a predictable pattern. An agent deployed for customer query support inherits the API credentials of the employee who configured it, including access to systems that employee rarely touched but technically could reach. The agent's scope expands over time as it is assigned new tasks, but its permissions were set at provisioning and were never revisited. In multi-agent orchestration workflows, permissions compound across handoffs: each agent in a chain may operate within its own authorized scope while the combined effective access of the chain far exceeds what any human reviewer approved. No single actor approved the aggregate.
The OWASP Top 10 for Agentic Applications, released in December 2025 with input from over 100 industry experts, classified agent goal hijacking and rogue agents operating within authorized scope while pursuing adversarial objectives as primary risk categories. The access model is what makes these attacks viable at scale. An agent that has been granted broad permissions because no one implemented least-privilege controls at the agent level is a structurally attractive target, and also a structurally attractive vector for unintentional policy violations that look identical to intentional ones in the audit log.
The EU AI Act's Annex III requirements for high-risk systems include meaningful human oversight mechanisms. An agent operating under unreviewed, inherited permissions from a human account, with no task-scoped constraint on what it can access, is structurally incompatible with that requirement. Not argumentatively incompatible. Structurally.
A rigorous evaluation of this dimension asks: are agent identities distinct from human identities in the identity provider, or are agents simply operating as human accounts? Are permissions scoped to the task the agent performs, or inherited from the configuring user? Is there any mechanism to enforce least-privilege at runtime rather than at provisioning? What happens to agent credentials when the human employee who configured them leaves the organization or changes roles?
That last question, in particular, tends to generate a long pause in the room.
Dimension three: runtime behavior controls and the limits of pre-deployment review
Pre-deployment review is where most governance investment concentrates: risk assessments, conformity evaluations, policy approvals, vendor due diligence. All of it happens before the agent runs. The structural problem is that agent behavior in production regularly diverges from behavior observed in testing, because agents respond to live data, live inputs, and live system states that were not present during the review. What the governance program evaluated and what the agent is actually doing in production are often materially different things.
A May-to-June 2025 Gartner survey of 360 IT leaders found that only 23% expressed confidence in their organization's ability to manage security and governance components related to AI. That is a substantial majority lacking confidence, and it almost certainly reflects this runtime blind spot rather than dissatisfaction with their policy documents. Deloitte's 2026 data sharpens the operational implication: 35% of organizations admit they could not shut down a rogue AI agent if one emerged, and 36% have no formal plan for deploying AI agents at all. The inability to respond to a runtime violation is itself a governance failure, distinct from and additional to whatever policy gaps produced the violation.
Runtime behavior controls are not a monitoring dashboard added after the fact. They constitute a specific operational capability with distinct components. Continuous monitoring means evaluating agent actions against a defined policy as they occur, not reviewing logs at the end of the week. Anomaly detection means identifying when an agent's behavior deviates from its established baseline: unusual query volume, access to data outside its normal operational scope, API calls it has never made before. Policy enforcement at runtime means the ability to block or constrain an action before it completes, not issue an alert after the data has already moved. And alert and escalation paths mean there is a named person who is notified within a defined timeframe, not a ticket that enters a queue.
The SEC's distinction between continuously generated evidence and pre-exam assemblies applies with particular force here. Runtime monitoring that produces timestamped records of every agent action is what makes it possible to answer the question an examiner will actually ask: what was this agent doing on this date, under whose authority, and did it comply with your stated policy at the time? A policy document cannot answer that question; only a continuous operational record can.
NIST AI RMF's MEASURE and MANAGE functions map directly to this dimension, and while the framework remains voluntary at the federal level, sector regulators including the CFPB, FDA, and SEC are incorporating it by reference in their deployment expectations. Voluntary, in regulatory practice, often has a shorter half-life than the word implies.
Gartner recorded a 1,445% surge in multi-agent system inquiries between Q1 2024 and Q2 2025. That volume reflects enterprises urgently trying to understand runtime governance for systems they have already deployed. The sequence is not ideal.
Dimension four: audit completeness and what examiners actually look for
Audit completeness is downstream of everything else. If adoption visibility is incomplete, the audit trail will not cover all agents. If access and permissions are uncontrolled, the audit trail will not accurately reflect what each agent was entitled to do. If runtime monitoring is absent, the audit trail will not reflect what each agent actually did. The gaps in the other three dimensions flow directly into this one, and examiners with experience in AI governance know where to probe.
The SEC's 2025 examination posture makes the operative distinction explicit. Institutions that generate governance evidence continuously can produce records dated months before the examination arrived. Institutions that assemble evidence for the examination cannot. This is not a presentation problem or a formatting problem; it is a production problem. You either have the record or you do not, and the date stamps on the records tell examiners which situation they are in within the first hour.
A complete audit trail for AI agents covers four categories of events. Every agent action must be timestamped and attributed to a specific agent identity, not to the human account the agent inherited. Every access event must record what data or system the agent touched, when, and under what permission. Every policy check must document whether a governance rule was evaluated, what it was evaluated against, and what the outcome was. Every anomaly or violation must record what was detected, when, how it was escalated, and how it was resolved, including whether the resolution was manual or automated.
ISO/IEC 42001, published in December 2023 and broadly adopted through 2025 and 2026, structures auditability as a management system requirement analogous to ISO 27001 for information security. For enterprises operating in regulated supply chains, certification against ISO/IEC 42001 is increasingly a procurement requirement, not a voluntary differentiator. The enterprises discovering this late are discovering it during vendor qualification, which is an uncomfortable moment to learn.
The financial dimension of audit incompleteness is not abstract. IBM's 2025 Cost of a Data Breach report found that organizations without AI security automation paid $5.52 million per breach on average, compared to $3.62 million for organizations that deployed it extensively. The $1.9 million gap is substantially a function of the time required to reconstruct what happened without continuous records. Reconstruction is expensive, slow, and frequently incomplete in ways that compound regulatory exposure.
The evaluation questions for this dimension are binary in character. Are audit logs generated automatically as a byproduct of normal operations, or compiled manually by someone who knows an exam is coming? Do logs cover agent actions specifically, or only human-initiated events in the same systems? Can the organization produce a complete record of what a specific agent did on a specific date without manual reconstruction? Are logs tamper-evident and retained for the period required by every applicable regulation the deployment touches?
Binary questions are useful. The answers tend to be unambiguous.
How the four dimensions compound, and where most governance programs leave gaps
The compounding dynamic follows a logical chain that is almost elegant in how thoroughly it defeats fragmented governance programs. A gap in adoption visibility means unknown agents exist. Unknown agents cannot be assigned correct permissions, because permission assignment requires knowing the agent exists. Agents operating under unconstrained or inherited permissions cannot be monitored against a meaningful policy baseline, because no one has defined what the agent was supposed to be permitted to do. Without that baseline, the audit trail is structurally incomplete regardless of how well the logging infrastructure functions. Each gap sets up the next, and the combined exposure is larger than any individual gap evaluated in isolation.
Most governance programs address dimension one at deployment time through policy documentation and risk assessment, and dimension four through log retention infrastructure. Dimensions two and three, the access model and runtime monitoring, are largely unaddressed as operational capabilities. The policy says least-privilege should be enforced. No one has built the mechanism that enforces it. The policy says anomalous agent behavior should be detected. There is no system doing the detecting.
Deloitte's 2026 data is instructive on where the maturity gap concentrates: close to three-quarters of companies plan to deploy agentic AI within two years, and only 21% report a mature governance model for agent oversight. The organizations without mature governance are not, in the main, lacking policies; they are lacking the operational infrastructure to implement those policies against agents running in production.
The Gartner forecast that AI governance spending will reach $492 million in 2026 and surpass $1 billion by 2030 reflects genuine market recognition of the problem. Budget, however, is not the same as operational maturity. Money directed at policy development or compliance consulting does not automatically produce runtime monitoring capability. The investment and the gap can coexist, and currently do, across a substantial portion of the market.
PwC's finding that 74% of AI-generated economic value is captured by 20% of organizations, and that those organizations invest in governance infrastructure at significantly higher rates, reframes the governance conversation in terms that boards tend to find more motivating than regulatory penalty schedules. Governance maturity is correlated with the ability to capture AI value, not merely with the ability to avoid fines. The organizations treating governance as a competitive capability rather than a compliance cost are, by the available data, correct.
The practical implication for anyone conducting a risk evaluation: do not score each dimension independently and average the results. Map the dependencies. An organization with strong policy documentation and poor runtime monitoring is not a medium-risk organization; it is a high-risk organization with good paperwork.
Running a structured AI governance risk evaluation against the four dimensions
A structured evaluation begins with scope, and scope begins with adoption visibility. Before assessing governance quality, you need an accurate count of what is being governed. This means running a discovery process that goes beyond what the IT asset inventory contains, because agents introduced by business units are often absent from that inventory. The discovery effort should cover SaaS integrations, API keys issued to non-human accounts, workflow automation tools, and any Microsoft 365, Salesforce, or similar ecosystem agents enabled by end users without a formal approval process. If the discovery process produces a number that surprises the CISO, that is not a methodology problem; that is the adoption visibility gap in real time.
Once the inventory is closer to complete, the evaluation moves to access and permissions. For each identified agent, the evaluation asks whether the agent operates under its own distinct identity, what permissions that identity carries, whether those permissions are scoped to the agent's actual task or inherited from a broader account, and whether there is any mechanism to enforce constraint at runtime rather than trusting the agent to stay within bounds. The practical test is simple: if the agent's configuring user were terminated tomorrow, what would happen to the agent's credentials and active sessions? The answer to that question tells you more about the access model than any policy document will.
Runtime behavior controls are evaluated against operational evidence rather than architectural intent. The question is not whether the organization has committed to monitoring agent behavior, but whether monitoring is actually occurring, at what granularity, with what latency between event and detection, and with what enforcement capability. An evaluation here should ask to see a specific example: an agent action that was flagged, how it was detected, who was notified, and what the resolution was. If that example cannot be produced, the runtime control is a policy commitment, not an operational capability.
Audit completeness is the final dimension and the hardest to improve quickly, because the audit trail reflects the operational state of the preceding dimensions over time. An organization that has had weak adoption visibility, poor access controls, and no runtime monitoring for the past eighteen months does not have an audit gap; it has eighteen months of compounding gaps that the audit trail accurately reflects, and no retroactive process will fill them. The evaluation here asks whether the organization can produce a continuous, timestamped record of agent behavior for a specified period without manual reconstruction, and whether that record is tamper-evident and retained for the applicable regulatory window across every jurisdiction the deployment touches.
The evaluation's output should not be a numerical score or a percentage of dimensions addressed. It should be a map of dependencies: where gaps in early dimensions are producing downstream exposure in later ones, which regulatory obligations are most immediately implicated, and which operational capabilities would close the most compounding risk with the most efficient intervention. The organizations that govern AI well are not the ones that scored highest on a checklist; they are the ones that understood the chain, found where it was weakest, and fixed that link first.
