AI governance gap leaves firms unable to prove decisions

Arctera has published research on AI governance in regulated organisations, finding that 78% of organisations using AI expect communications risk to rise.

Based on a survey of 500 compliance decision-makers and influencers across the Americas and EMEA, the report points to a gap between internal confidence and the controls needed to demonstrate what happened in AI-assisted work.

According to the findings, 55% of respondents said their organisations have core AI policies, training and review steps in place. Yet only 19% said they have the logging, retention, detection and scoring controls needed to prove how AI-generated communications or decisions were produced, reviewed and stored.

That gap matters in sectors such as finance, healthcare, and energy and utilities, where firms face regulatory scrutiny over records, decision-making and communications. The research suggests many organisations have begun to formalise AI governance, but far fewer have built the evidence trail needed for audits or investigations.

Nearly half of respondents, 45%, said AI is either core to or extensively used in regulated workflows. At the same time, 60% said compliance functions are primarily accountable for AI governance, placing more responsibility on compliance leaders, legal teams, Chief Information Officers and risk executives.

Policy gap

The survey also found a gap between perceived readiness and operational proof. While 71% of organisations using AI said they are very or extremely prepared to produce a defensible audit trail, that level of readiness depends on controls such as prompt and output monitoring, automated retention, policy detection and automated risk scoring.

The findings indicate that organisations are moving from broad policy frameworks to more detailed oversight of how AI tools are used in day-to-day business processes. In practice, that means retaining records of prompts and outputs, tracking human review and preserving evidence across multiple systems and channels.

That shift is also reflected in respondents' priorities. About 31% said AI oversight logging is a priority, while another 31% pointed to faster cross-channel search and reconstruction, suggesting firms want to trace AI-related activity after the event.

Archives also featured prominently in the research. Some 70% of respondents said archives are a major or critical asset for AI-driven innovation, indicating that older compliance and records systems are being reconsidered as part of AI governance strategies.

In regulated industries, archives can serve as source material for reviews, internal investigations and regulatory responses. They can also help reconstruct how information was created, modified, approved and distributed when AI tools are involved.

Soniya Bopache, Senior Vice President and General Manager at Arctera, said organisations need to go beyond policy statements and manual checks.

"Policies, training and human review remain essential, but they are no longer enough on their own. As AI becomes an integral part of day-to-day work, organisations operating in regulated industries must be able to reconstruct the evidence behind AI-assisted communications and decisions," Bopache said.

She said that evidence must be built into AI processes rather than assembled later.

"Moving from policy to proof means organisations must treat evidence as part of the AI workflow itself, not something to be recreated after the fact. This is the foundation of defensible AI governance," Bopache said.

Arctera was created from Veritas Technologies and operates as a business unit of Cloud Software Group. It sells compliance and governance software, and its platform captures data from more than 130 content sources and includes more than 280 AI policies.

The survey was conducted online in May and covered full-time professionals involved in compliance decisions. Respondents came from organisations in the Americas and EMEA across finance, healthcare, and energy and utilities.

Overall, fewer than one in five respondents, 19%, said their organisations have the controls needed to prove what happened in AI-assisted communications and decisions.