On May 14, the American Arbitration Association released a benchmark of AI governance at large organizations. The research firm iResearch surveyed 500 senior legal and executive leaders in the United States and Canada for it. Seventy percent of their organizations had revenue of $1 billion or more, across financial services, technology, healthcare, energy, manufacturing, and professional and legal services.
- 87 percent said their organization has some form of AI governance. 22 percent said those systems operate effectively.
- 33 percent have defined escalation paths for when an AI system misbehaves.
- 22 percent were very confident they could produce evidence of governance decisions for a regulator or auditor.
- 80 percent said IT or technology teams contribute to AI governance. 35 percent reported involvement from legal and compliance.
These are senior leaders describing their own organizations, so treat the figures as directional. The release doesn’t publish field dates or question wording. The association is a nonprofit dispute-resolution provider, and AI governance standards are part of its public agenda.
Most of these organizations have a policy. Few could prove it works.
The gap is in the plumbing
A governance policy says what’s allowed. The two weakest numbers are about what happens after that. One is escalation: when a system misbehaves, who decides what happens next? The other is evidence: when a regulator or a court asks, can the organization show who approved what, and why?
The ownership numbers point the same way. Governance that sits mostly with IT tends to cover tools and access. Accountability for decisions sits with legal, compliance, and the business. California’s new No Robo Bosses Act is one example of a law that will ask for exactly that kind of evidence.
A short test for your own governance
- If an AI system gave a harmful answer today, who would get the call, and who has the authority to switch it off?
- Could you produce, within a week, the record of who approved your three most-used AI tools and why?
- Does legal or compliance sign off on new AI uses, or only IT?
- Is there a current list of the AI tools in use, and does someone own it?
- When did anyone last check whether the policy matches what people actually do?
A governance framework is a document. Governance is what happens when something breaks.
Sources