6 Minutes - Read Now 
A startup’s entire database vanished in seconds, deleted by an AI agent running on Claude. The first read was that the technology had gone rogue. The real story was smaller and more familiar: insufficient controls, insufficient permissions, and no one in the loop at the moment it mattered. This is a governance failure, not a technology one, and it’s becoming the defining one of this moment.
Eighteen months ago, the hardest AI governance problem most ethics and compliance teams faced was employees quietly experimenting with ChatGPT. The response was a policy, maybe some training, and an effort to stay ahead of the curve. That curve has moved. Organizations are now deploying AI agents that take real actions in real systems: scheduling, executing, deleting, deciding with minimal human involvement. Boards that once watched AI cautiously from the sidelines are now mandating its adoption outright. A new population of employees, many of whom had avoided AI until told to use it, are implementing tools they don’t yet understand. The gap between how AI governance was designed and how AI is actually being used is where things go wrong. AI agent governance has to catch up, and the distance it has to cover is larger than most organizations realize.
The Framework Built 18 Months Ago Wasn’t Built for This
Early AI governance efforts anchored themselves to frameworks like NIST or the EU AI Act, in much the same way organizations scrambled to figure out GDPR in its early days. There was recognition that AI was coming. There was little recognition of how fast it would move. A Deloitte survey conducted between May and July 2024 found that 79% of boards reported limited to no AI knowledge. By early 2025, that number had dropped to 66%, an improvement, but nowhere close to keeping pace with AI itself. Fewer than 25% of AI policies and ethical-use statements in place 18 months ago had board-level approval, even as chief compliance officers and chief information security officers understood something significant was underway.
Four gaps defined that earlier period. Governance existed on paper as org charts rather than as operations, so asking an organization what its AI governance program looked like often produced a chart, not a process. Third-party risk management programs were maturing, but not with AI in mind, even though more than half of AI failures now originate with third-party tools and roughly 80% of organizations use them. Agentic AI carried almost no compliance attention at all, despite being the one area that makes people visibly uneasy, since no one wants the conversation that starts with “who made that decision” and ends with “our AI agent did.” And organizations hadn’t yet reckoned with a regulatory landscape that, while sparse, is already inconsistent across jurisdictions.
Those four gaps haven’t closed. They’ve matured. Third-party risk management has become the clearest sign of that maturity: organizations are now building it out specifically because they’re worried about AI entering the organization, not simply because their broader governance, risk, and compliance processes needed modernizing.
Boards Are Mandating AI Faster Than Employees Can Learn It
The earlier hype cycle put ethics and compliance teams up against employees enthusiastically adopting a tool without understanding its risks. The current phase is different and, in some ways, harder. Boards are now pushing AI adoption to cut costs and gain efficiency, while simultaneously worrying about the same employee use they’re mandating. That contradiction has forced a new posture. Shadow AI, the use of AI tools without regard for an organization’s policies or approval processes, is now widespread: about 80% of employees use shadow AI tools, and fewer than 10% of them receive any real training on how to use AI responsibly. Most AI activity inside a given organization is happening without rules or oversight, which is exactly the condition under which data gets exposed. Employees are feeding confidential information into public AI tools, not out of malice but out of habit. IBM’s 2025 Cost of a Data Breach Report found that breaches involving shadow AI cost organizations about $670,000 more than the average non-AI breach.
Organizations that are actually operating at governance 2.0 tend to be working on three things at once. The first is culture: less committee-and-policy top-down thinking, more effort to embed governance into how people actually behave, since culture outside an organization tends to mirror culture inside it. The second is process: a shift away from a flat “no” toward a defined path, because a flat “no” simply pushed employees toward using tools anyway. A structured process, even an imperfect one, gives employees who are anxious about falling behind on technology somewhere to go instead of around the rules. The third is literacy. Everyone, including the most technically fluent employees and the people running the company, is dealing with a knowledge gap that reopens every few months as AI changes underneath them. Closing it has to be continuous, not a training module completed once and filed away.
Agentic AI Is Moving Faster Than Governance Can Track
The database deletion mentioned earlier is a preview, not an isolated incident. As agentic AI takes on more consequential, less supervised work, the space between what AI can do and what governance can verify keeps widening. Research from McKinsey on AI trust makes the point bluntly: enterprises can build agents faster than they can build accountability for them.
Two governance failure patterns show up again and again in organizations trying to close that gap. The first is a straightforward accountability problem: no one is clearly responsible for a given AI decision, and the org-chart questions multiply from there. Should cyber, privacy, and AI committees be separate or combined? Who sits on which one? That question alone has occupied a disproportionate share of governance conversations over the past few months, even as it becomes clear that defining responsibility, while still essential, is no longer sufficient on its own. The second failure pattern belongs to organizations that have already done that work. They know who owns what. Their governance model, built a month ago and considered solid, is already obsolete, overtaken by the pace at which new AI capabilities reach production.
The fix isn’t a better quarterly review, it’s continuous governance: ongoing risk assessment, real-time visibility, and lightweight intervention in place of periodic checks. In practice, that increasingly means using AI itself to govern AI, trading a reactive posture for a proactive one in a way traditional compliance monitoring never quite achieved.
There’s a wider version of this argument worth sitting with. Some organizations, Neuralink among them, have started framing their AI work around symbiosis: ensuring that humans aren’t surpassed by the systems they build. That’s not a statement about governance programs. It’s a statement about people. It’s also the clearest reason to take AI agent governance seriously now, while there’s still room to shape how this plays out, rather than after the fact.
Watch the full conversation: Laura Jacobus joined the Ethicast to discuss how AI governance frameworks need to evolve alongside agentic AI. Watch “Is Your AI Governance Keeping Pace with Your AI?”
Author Bio
Laura Jacobus | Vice President, Strategic Advisory Services, Mitratech, Guest Contributor
As the leader of the Strategic Advisory Services team at Mitratech, I leverage my diverse high-tech background to help clients build resilient compliance and risk programs. My unique expertise, developed through legal and business leadership roles, allows me to deliver innovative and impactful solutions tailored to each client's needs.
