Is Your AI Governance Tool Actually Governance?

AI governance is the set of decisions about who is accountable for AI, which uses are acceptable, and how much risk an organization is prepared to carry. AI controls are the technical mechanisms that enforce those decisions. The gap between the two is real: 63% of breached organizations in IBM’s 2025 research had no AI governance policies in place.¹

I raise this because of what I keep seeing in the market.

What the Market Is Calling “Governance”

Every few weeks, another product launches under the AI governance label. That momentum reflects real demand. Gartner projects spending on AI governance platforms to reach $492 million in 2026 and pass $1 billion by 2030.² Organizations are taking AI risk seriously, and builders are responding.

When I look closely at many of these products, a pattern shows up. You describe what you want the controls to do. Some tools let you upload your existing AI policy so it can be translated into rules. The tool then monitors, flags, blocks, or logs activity against those rules.

That capability is useful, and I want to be clear about that. This is not a critique of any vendor or product. It is an observation about language. What many of these tools deliver is AI controls, and controls are not the same thing as governance.

Two Different Jobs, Two Different Owners

Governance sets strategic direction, defines policy, and assigns accountability. Controls enforce and operationalize those decisions inside systems.⁷ One answers who, why, and what. The other answers how.

Neither column replaces the other. Governance without controls is a document on a shelf. Controls without governance run without business context, which tends to produce either access so restrictive that people work around it, or a growing pile of exceptions nobody can explain later.⁷

The Assumption Built Into Every Policy Upload

This is the part I think buyers should understand. When a tool asks you to write in what you want the controls to do, or to upload your AI policy, it assumes the governance work has already happened. It assumes:

• Your AI policy reflects real decisions, not a borrowed template.
• A named person owns that policy and keeps it current.
• Leadership has defined and agreed on a risk appetite for AI.
• Accountability is assigned across legal, security, privacy, data, and the business.
• There is a clear process for deciding when a flagged issue is acceptable and when it is not.

If those foundations exist, a controls tool can accelerate a program in a meaningful way. If they do not, the tool enforces whatever it is given. A controls tool can faithfully enforce the wrong decisions.

The analysts tracking this category make a similar point. Gartner advises organizations adopting AI governance platforms to reassess their governance and compliance processes, identify gaps, and clarify roles and responsibilities along the way.²

Why the Distinction Matters Now

The breach data shows two separate gaps

IBM’s 2025 Cost of a Data Breach research found that 97% of organizations reporting an AI-related breach lacked proper AI access controls, and 63% of breached organizations had no AI governance policies.¹ Those are two different findings. One is a controls gap. The other is a governance gap. Closing one does not close the other.

High levels of shadow AI added an estimated $670,000 to the average breach cost in the same study.¹ Shadow AI is, at its root, a governance question: which tools are permitted, who approves them, and what happens when someone goes around the process.

Boards are still getting oriented

Deloitte’s 2025 global survey of board members and executives found that 31% say AI is not on the board agenda, and 66% say their boards have limited to no knowledge or experience with AI.³ A controls dashboard does not answer the questions a board needs answered: what the organization is trying to achieve with AI, what it is prepared to risk, and who is accountable.

Regulation expects decisions, not only tooling

The EU AI Act timeline shifted this year. The Digital Omnibus, enacted as Regulation (EU) 2026/1744, moved obligations for stand-alone high-risk systems to December 2027.⁴ The obligations were deferred, not removed. The Act’s high-risk requirements include classifying systems by risk and assigning human oversight to people with the competence and authority to act. Those are governance decisions before they are technical ones.

NIST Put “Govern” at the Center for a Reason

The NIST AI Risk Management Framework organizes AI risk work into four functions: Govern, Map, Measure, and Manage.⁵ Govern is the cross-cutting function. It establishes the policies, accountability structures, and culture the other three depend on. A few of its categories make the difference from controls concrete:

• GOVERN 1: policies, processes, and practices for AI risk are in place, documented, and embedded in the organization.
• GOVERN 2: accountability structures exist, and teams are trained and empowered to carry out AI risk responsibilities.
• GOVERN 6: risks from third parties, including AI supply chains, are addressed by organizational policy.

Many AI controls tools do strong work in Measure and Manage: monitoring, testing, tracking, and responding. That work matters. It also depends on Govern being done first, by people.

ISO/IEC 42001 takes a similar view. It sets requirements for an AI management system that begins with leadership commitment, defined roles, and objectives before it reaches operational controls.⁶

Where Governance Ends and Controls Begin

Questions governance answers

• Which AI use cases are permitted, restricted, or prohibited?
• Who is accountable when an AI system produces a harmful or incorrect outcome?
• How are use cases tiered by risk, and does oversight scale with the tier?
• Who reviews and approves exceptions?
• When should a model or use case be reviewed, changed, or retired?

What controls do

• Log prompts and outputs for audit.
• Block sensitive data from leaving the organization.
• Restrict access to approved models and tools.
• Filter or flag outputs that break defined rules, and monitor models for drift.

The bridge between them

Classification connects the two. When governance defines how data and AI use cases are tiered by sensitivity and risk, controls can map directly to those tiers.⁷ A high-risk use case gets tighter oversight. A low-risk one moves faster. The strategic decision flows cleanly into a technical action.

Five Questions to Ask Before You Buy

These are not a test a vendor has to pass. They are a way to know which job you are hiring the tool to do.

1. Does it help us make governance decisions, or enforce decisions we have already made? Both are legitimate. Know which one it is.
2. Where do the rules come from, and who owns them? If the answer is “whoever configures the tool,” governance has not happened yet.
3. What happens after something is flagged? Look for a defined decision path, a named owner, and a record of the outcome.
4. Does it connect AI risk to our broader risk, privacy, compliance, and data programs? AI risk rarely stays in one lane.
5. How does its output reach leadership and the board? A dashboard for analysts is not the same as a reporting line for directors.