Only 9% of Companies Have Mature AI Governance — What the Other 91% Are Missing

Start with the numbers side by side.

McKinsey's 2025 State of AI report found that 78% of companies use AI in at least one business function — up sharply from 55% in 2023. The consensus is clear: AI has moved from consideration to execution.

But the same report reveals what deployment alone does not produce. Only 17% of companies generate more than 5% of EBIT from AI. More than 80% of companies using AI cannot report a meaningful impact on business profitability.

And McKinsey's definition of "mature AI governance" applies to just 9% of enterprises.

NTT DATA's 2024 research approaches the same reality from a different angle. Of all generative AI deployments, only 15–30% achieve their target ROI — meaning 70–85% are failing to deliver the expected return.

Why do so many companies end up using AI while generating so little from it? The answer is structural. Deploying AI and governing AI are completely separate projects — and most companies are only doing one of them.

"Governance" is often understood as policy documents, ethics committees, and acceptable-use guidelines. But McKinsey's definition of mature AI governance is considerably more specific.

Characteristics of companies with mature AI governance:

• What AI can and cannot do is defined at the code level, not in policy language
• AI autonomy is tiered according to the severity of the decision being made
• When AI makes an error, who corrects it and through what process is explicit
• AI action audit trails are captured automatically, not manually
• Governance rules apply equally to AI and to the humans working alongside it

This is not a question of mindset. It is a question of structure — building systems in which AI cannot take incorrect actions, rather than systems in which it is asked not to.

The current reality: only 18% of companies have a cross-functional committee with decision-making authority over AI (industry research, 2024). In the remaining 82%, responsibility for AI governance is diffuse, informal, or absent.

Gap 1: Rules exist as if-statements, not as structure

In most organizations, AI governance looks like this:

"AI does not auto-approve transactions above $10,000"
"AI does not generate responses containing personal customer data"
"AI avoids mentioning competitors"

These are correct rules. But in most cases they live in a prompt addendum or a checklist — not in code or system design. AI has no intention to violate rules. But if a rule is not structurally enforced, the rule can be broken.

Governance must be structure, not intention.

Gap 2: AI autonomy is binary — all or nothing

Most systems are designed with a simple choice: "let AI do it" or "don't let AI do it." This produces either over-restriction (AI is underutilized) or over-delegation (risk is uncontrolled).

Mature governance operates with graduated autonomy:

• Routine inquiries → AI executes independently
• Mid-value transactions → AI proposes, manager approves
• Contracts, refunds, escalations → AI drafts, responsible party decides

The design of which decisions are handled at which level is itself the governance. The decision routing is not a side effect of governance — it is the core of it.

Gap 3: No audit trail

There is no record of what AI decided or why. When something goes wrong, the only explanation available is "that's what the AI said." That is both a legal exposure and an operational failure.

The number of documented AI-related incidents reached 233 in 2024 — a record, and a 56% increase over 2023 (industry research). Without audit trails that support post-incident investigation, there is no path to root-cause analysis or systematic improvement.

Gap 4: Knowledge is not updated

Governance quality depends entirely on the quality of the knowledge AI references. Is the "$10,000 approval threshold" still accurate six months later? Are customer-specific exceptions recorded? When organizational judgment criteria change, does AI know?

If there is no designed cycle for knowledge updates, reviews, and expiration, AI governance degrades over time — silently, without any visible indicator that the rules AI is following no longer reflect current organizational intent.

Gap 5: AI and governance are separate systems

This is the most fundamental failure. AI utilization and AI governance exist as separate systems, separate teams, and separate processes.

The governance team drafts AI usage policy. The engineering team builds the AI system. The operations team uses the AI. If these three groups are not structurally connected, policy becomes ceremonial, systems drift from policy, and users operate without knowing the rules.

Mature AI governance means governance and AI execution run inside the same system — not alongside each other.

Gartner's 2025 research points to a concrete consequence of this divide: companies with high AI governance maturity are 45% more likely to keep AI projects operational for three or more years than companies without it. Mature governance is not a constraint on AI investment. It is the structure that protects the long-term return on that investment.

What the 9% have, stated plainly: they define not what AI is allowed to do, but what AI is able to do — at the system level.

The difference in practice:

91% — Governance Immature	9% — Governance Mature
"Get manager approval before using AI for significant transactions" (policy)	Operations AI can execute are declared and enforced in code (system)
"Avoid generating responses with personal data" (aspiration)	Operations involving personal data are controlled at the system level
Report problems when they occur (reactive)	All executions are automatically logged (proactive design)
AI scope is "within reasonable limits"	AI scope is explicitly declared and managed
AI decisions are verified by users (person-dependent)	AI decisions are routed by severity level automatically (structural)

Mature AI governance is not achieved overnight. But where to start is clear.

Step 1: Declare AI's execution scope explicitly List what AI can do and what it cannot do. At this stage, do not write a policy document — define a list of executable operations. The specificity matters.

Step 2: Define decision severity Determine which decisions AI can execute independently, and which require human review. Organize by category — financial thresholds, personal data, legal commitments, customer-facing communications — and assign an autonomy level to each.

Step 3: Design the audit trail Build the record of what AI did and why to be automatic — captured without requiring operators to document it manually. The goal is a data foundation for post-incident review and systematic improvement.

Step 4: Build knowledge update cycles Assign "expiry" and "review owner" to the rules and judgment criteria AI references. Design the update mechanism on the assumption that knowledge will become stale — because it will.

Step 5: Integrate AI execution and governance in a single system Do not build governance as a separate layer. Build it so that every time AI executes, governance rules are automatically applied. The execution IS the governance check.

How much does building AI governance cost, and how long does it take?

It varies significantly by scale and complexity, but the most important first step — declaring AI's executable scope and defining decision routing — is achievable in 2–4 weeks for most organizations with a small team. Rather than attempting to build complete governance at once, starting with the highest-severity business decisions and expanding systematically tends to produce both faster results and more durable governance.

Do small and mid-sized businesses need AI governance?

Any organization using AI in business decisions needs governance, regardless of size. But the practical starting point for smaller organizations is straightforward: maintain two lists — "operations AI can execute autonomously" and "decisions that always require human review." That alone covers the majority of risk without requiring complex infrastructure.

Is "AI governance" the same thing as "AI usage policy"?

No. A usage policy is a behavioral norm — what people should or should not do. Governance is the structural definition of what is and is not possible in the system. Policy is something humans read and are asked to follow. Governance is something the system enforces automatically. Companies with mature AI governance have translated their policies into system design — the rules are applied by the architecture, not by individual compliance.

Why does Gartner find that governance maturity correlates with project longevity?

Without mature governance, AI projects tend to operate until someone makes a costly mistake or a problem becomes visible — and then require a forced pause and redesign. Mature governance manages risk structurally before problems occur, making failures less likely and easier to correct when they do happen. Longevity is not incidental to governance maturity — it is a direct outcome of it.

How do you self-assess AI governance maturity?

Five questions determine the answer. (1) Are the operations AI can and cannot execute defined in system design, not policy documents? (2) Is every AI execution automatically logged? (3) When something goes wrong, can the cause be traced through AI decision logs? (4) Is there an update and expiration cycle for the knowledge AI references? (5) Are governance rules embedded in AI's execution infrastructure, not maintained as a separate document? Five "yes" answers indicates maturity. Three or fewer indicates priority areas for improvement.

78% of companies use AI. 17% generate meaningful AI-attributable EBIT. 9% have mature governance.

These numbers are not coincidental. They describe the same underlying reality from three angles.

AI outcomes are not determined by how capable the model is. They are determined by whether AI references correct knowledge, operates within the right boundaries, and involves humans in the decisions that matter most. That structural design is what separates the 9% from the 91%.

70–85% of generative AI deployments are failing to achieve their target ROI — not because the AI is inadequate, but because the structure around the AI is.

Does your AI have a constitution?

---

Sources:

• McKinsey — "The State of AI in Early 2024 / McKinsey Global AI Survey" (2024–25)
• NTT DATA — "Between 70-85% of GenAI deployment efforts are failing to meet their desired ROI" (2024)
• Gartner — "Gartner Survey Finds 45% of Organizations With High AI Maturity Keep AI Projects Operational for at Least Three Years" (2025)
• Industry research — "AI-related incidents rose to 233 in 2024, a 56% increase over 2023" (2024)
• Ajith Vallath Prabhakar — "The Architecture Gap: Why Enterprise AI Governance Fails" (2025)