Legal leaders warn AI outpaces governance, survey finds

Diligent Institute and Wilson Sonsini have released a survey showing legal leaders believe AI adoption is moving faster than governance, with low confidence in board oversight of AI risk.

According to the Q4 2026 GC Risk Index, nearly six in 10 legal leaders rated organisational risk at 7 out of 10 or higher. Regulatory change, AI-related risk and cyber threats ranked as their main concerns. The survey covered around 200 general counsel, chief legal officers and other legal leaders, with about 70% of respondents representing organisations based in North America.

One of the clearest findings was the gap between AI use and formal oversight. Some 59% of respondents said AI adoption was outpacing their organisation's ability to govern it, while 41% said they either had no formal AI governance approach or were still developing policies and guidelines.

Board preparedness scored poorly. Legal professionals rated their boards' readiness to oversee AI risk at an average of 2.9 out of 5, and only 26% believed their board was well prepared to oversee AI.

The data also pointed to limited reporting from legal teams into senior decision-making. Just 23% of respondents said their legal teams regularly brief the board or senior leadership on AI-related risks, even though legal departments are often involved in vendor reviews and assessments covering privacy, data, confidentiality and intellectual property issues.

Dottie Schindlinger, executive director of Diligent Institute, said the pace of AI adoption was creating its own governance problem. "Nearly six in 10 legal leaders say AI adoption is outpacing governance. That gap is a risk in itself: as AI spreads across an organization, it becomes harder to maintain clear visibility into how it is used, what data it touches and who is accountable," Schindlinger said.

She added: "Boards do not need every director to be an AI expert, but they do need enough fluency to challenge assumptions and ensure oversight keeps pace with adoption."

Risk priorities

Regulatory change was the most commonly cited risk in the study, named by 55% of respondents. AI-related risk followed at 49%, with cyber threats close behind at 47%.

The ranking marks a shift from the previous quarter. Since Q2, concern about geopolitical conflict fell sharply from 52% to 26%, while concern about regulatory change rose from 48% to 55%. AI-related risk increased from 39% to 49%, and cyber threats climbed from 39% to 47%.

Other issues remained on the agenda, though at lower levels. Workforce, culture and talent risks were cited by 34% of respondents, while supply-chain disruption was named by 24%.

Cyber concerns

The survey also highlighted pressure on organisations' cyber oversight and disclosure processes. Nearly three in 10 organisations reported experiencing a third-party cyber incident, yet only 34% said they were very confident their cyber disclosure protocols had been fully tested.

Cyber security has become a board-level issue in many sectors, particularly where companies rely heavily on external suppliers, software providers and other third parties. The survey suggests that while awareness of cyber risk is high, confidence in formal response arrangements is much lower.

The results also indicate that responsibility for AI governance is spread across several functions, including IT, security, and data or digital teams. While legal teams are involved in due diligence and compliance questions, the study suggests accountability can become harder to define when oversight is distributed.

Wilson Sonsini said legal departments have a broader role to play in connecting risks across the business. "As risks like AI and cybersecurity evolve at breakneck speed, boards need a clear understanding of their potential legal, regulatory and disclosure implications, and how management is responding," said Sachin Kohli, partner at Wilson Sonsini.

He added: "Legal leaders have a critical role to play in connecting these risks across the enterprise, working alongside risk, compliance and security to translate complex challenges into actionable insights. This means giving boards the visibility to anticipate emerging risks and prioritize oversight."

The survey respondents were split across private and public companies, with 51% representing private businesses and 28% representing publicly held companies.