For most of 2025 and early 2026, the question boards asked about agentic AI was largely about pace: how fast could the organization deploy autonomous agents into procurement, finance, customer service, and IT operations before competitors did. EY's newly released AI Risk and Governance Survey, published September 15, 2026, answers that question decisively — 91% of senior AI executives at large, publicly traded organizations report their organization already uses agentic AI, through either active pilots or full enterprise deployment. The pace question is settled. A different, harder question has taken its place: can anyone prove that governance kept up.
The survey's own numbers say it mostly hasn't. Among organizations already running agentic AI, 49% say their existing AI governance framework has not been specifically updated to address agentic AI's risks and requirements — meaning close to half of enterprises with agents already executing real actions inside their systems are governing those agents against a framework written for an earlier, less autonomous generation of AI. That's not a hypothetical gap. EY found that 85% of agentic AI adopters admit at least a handful of their agents already execute actions — from detecting cybersecurity threats to running code — without real-time human involvement.
This is precisely the territory Crest.Digital's Agentic Risk & Continuous Assurance practice was built to address, and it extends directly from the governance-and-accountability questions already covered in who is accountable for an AI agent's decision and why AI agents need audit trails. What EY's fresh, large-sample data adds is a quantified picture of how wide the gap has become between how fast agentic AI is being deployed and how fast the controls meant to govern it are actually being updated, tested, and evidenced.
Crest.Digital's Agentic Risk & Continuous Assurance practice builds the agent inventory, risk-tiering, and continuous control testing that turns an AI governance policy from a document into something demonstrably enforced, agent by agent, every day.
Explore Agentic GRC91% Adoption, 49% Ungoverned: Reading EY's 2026 Survey
EY's AI Risk and Governance Survey drew on 202 senior AI decision-makers — board members, C-suite, and VP-plus leaders holding direct oversight of AI systems, governance, or audit — at organizations generating at least $1 billion in annual revenue, fielded between late May and mid-June 2026. The headline finding isn't that governance is absent: 98% of respondents report having formal AI governance policies in place. The finding is that policy existence and policy enforcement have come apart. 47% of respondents admitted their organization has previously not followed its own AI governance process for urgent deployments — meaning the exception has become common enough that nearly half of surveyed organizations have a documented instance of it.
The expertise gap behind that pattern is explicit in the data. Roughly two-thirds of senior AI executives expressed concern over a lack of internal expertise to effectively evolve (69%), implement (63%), or design (63%) AI governance controls at their organization. That's not a junior-staffing problem — these are senior AI decision-makers describing their own organization's capability gap in building and running the controls their policies already require. And the consequences aren't abstract: 36% of leaders surveyed report their organization has already experienced an AI incident or failure causing material negative impact, including data loss, financial damage, brand damage, and operational disruption.
EY's own leadership framed the risk in structural terms rather than as a compliance shortfall. Richard Jackson, EY Americas Assurance Chief Technology Officer and EY Global and Americas Assurance AI Leader, put it directly: organizations are "applying yesterday's governance rules to today's interactions with AI." John McLain, EY Americas Assurance Technology Risk AI Leader, went further on agentic AI specifically: "the biggest agentic AI risk is that human oversight hasn't evolved accordingly." That framing matters for how internal audit should scope its work — the gap isn't a missing policy clause, it's an operating model built for AI that waits for a human decision, now running AI that frequently doesn't.
The Shadow Agent Problem: You Can't Govern What You Can't See
The single most consequential number in EY's survey, for audit and risk functions specifically, is this one: among organizations already using agentic AI, 26% admit they cannot reliably detect unauthorized AI agents operating inside their own environment. This is shadow AI at the agent level rather than the application level — not an employee using an unsanctioned chatbot, but an autonomous agent with the ability to take action, running somewhere in the enterprise, outside whatever inventory the governance function believes is complete.
This isn't a theoretical concern that formal review processes would catch anyway. EY found that among organizations that conducted a formal AI assurance review — and 98% say they conduct one at least annually — shadow AI was one of the most common issues surfaced, appearing in 39% of reviews, behind only data quality problems (57%) and AI model drift (48%). Put together: nearly all organizations believe they're reviewing their AI estate annually, and roughly two in five of those reviews still turn up agents or systems nobody had accounted for. An annual cadence is also, on its face, a poor match for a population of agents that can be spun up, modified, or retired far faster than any yearly review cycle covers — which is precisely the argument for continuous rather than periodic testing, covered further in Crest's work on continuous controls monitoring.
Gartner's own research reinforces why a single, uniform governance response doesn't close this gap. In a May 2026 analysis, Gartner warned that applying uniform governance across all AI agents will lead to enterprise AI agent failure, predicting that over 40% of agentic AI projects will be cancelled by the end of 2027 due to escalating costs, unclear business value, and inadequate risk controls — failures Gartner traces specifically to organizations that don't distinguish between an agent's ability to act and the scope of access it's actually been granted. An inventory that treats every agent identically is, in that sense, barely better than no inventory at all: it can confirm an agent exists without answering the one question that determines whether it's a risk — what, specifically, is this agent authorized to do, and does its actual behavior stay inside that boundary.
Crest.Digital's agent identity and access-governance capability extends the same continuous, non-human-identity monitoring discipline used for privileged human accounts to every autonomous agent operating in your environment.
What the Standards Already Require, Even Without New AI-Specific Rules
Internal audit doesn't need to wait for an agentic-AI-specific standard to begin testing this gap — the existing professional and control frameworks already reach it. The IIA's Global Internal Audit Standards, effective since January 2025, require internal audit to evaluate the adequacy and effectiveness of governance and risk-management processes across the organization — a mandate that squarely covers a governance framework an organization itself admits hasn't been updated for the technology it's actively deploying. COSO's Internal Control–Integrated Framework treats monitoring activities and information-and-communication as distinct, coequal components of internal control, which is exactly the distinction EY's data exposes: having a policy (information) is not the same as having a mechanism that confirms every agent complies with it in practice (monitoring).
ISACA's COBIT framework is, if anything, more directly on point: COBIT positions continuous assurance as a governance objective in its own right, built on the premise that control monitoring performed close to the process — continuously, not at the next scheduled review — is what makes assurance genuinely continuous rather than periodic assurance wearing a different label. Read against EY's finding that 98% of organizations already run a formal annual AI assurance review, and that those very reviews keep surfacing shadow AI and model drift anyway, COBIT's argument for continuous over periodic monitoring stops being theoretical and starts looking like the specific gap EY quantified.
None of this is a jurisdiction-specific problem, and the framing here is deliberately global-first. A US financial-services firm running loan-underwriting agents, a European manufacturer running agentic procurement approval, and an India-based global capability centre running agentic customer-service triage all face the identical structural exposure EY's survey describes — governance policies that predate the agents they're meant to cover, reviewed on a cycle too slow to catch what those agents are doing between reviews. The standards that already require better monitoring don't change by geography; what changes is only which regulator eventually asks the question first.
An 8-Point Framework for Testing Agentic AI Governance
None of the eight points below require an organization to have already solved agentic AI governance perfectly. They're a testing sequence — a way for internal audit, risk, and compliance to establish, with evidence rather than a policy citation, exactly where their organization sits on the gap EY's data describes.
Agent Inventory & Discovery
Build and continuously refresh a complete inventory of every agent operating in the environment, using independent technical discovery rather than relying solely on self-reported deployment logs — the method that catches the 26% shadow-agent gap.
Owner Assignment
Confirm every inventoried agent has a named, accountable business or technical owner — not a project team that has since moved on, but someone who answers for that agent's behavior today.
Risk Tiering
Classify each agent by the materiality of what it can affect and its degree of autonomy, rather than governing every agent under one uniform policy — the specific failure mode Gartner's research warns drives agentic AI project cancellations.
Permission & Access Scoping
Test what each agent is actually entitled to access and act on against what its risk tier and business purpose justify, treating over-permissioned agents as a control failure in their own right.
Control Mapping to Agent Actions
Map existing financial, operational, and IT controls to the specific actions each agent can take, and flag any action an agent can perform that no existing control currently tests.
Human-in-the-Loop Approval Thresholds
Define, by risk tier, exactly which agent actions require real-time human sign-off before execution — directly addressing the 85% of adopters who admit agents already act without it in at least some cases.
Continuous Testing & Exception Management
Replace the annual assurance-review cadence with continuous testing of agent behavior against its authorized scope, routing every threshold breach or anomaly to the accountable owner as an exception, not a footnote in next year's review.
Audit-Ready Evidence Trail
Log every agent action, exception, and human approval decision centrally and immutably, so audit, risk, and compliance can demonstrate — not merely assert — that governance was actually enforced.
Point one is the precondition for everything after it. A control-mapping exercise, a permission review, or a continuous testing programme built against an incomplete agent inventory only ever governs the agents the organization already knew about — which is exactly the population EY's survey suggests is not the whole story for roughly a quarter of adopters.
Closing the Gap: A Six-Step Delivery Playbook
Crest.Digital delivers this as a configurable "Risk Automation Pod" rather than a bespoke software build — a reusable stack of identity and access connectors, an agent-risk-scoring engine, a workflow and approval-routing layer, and an evidence repository, customized around which agents, systems, and risk tiers a given organization needs to bring under continuous testing first.
The Discover → Design → Connect → Deploy → Validate → Transfer Model
- Discover: Inventory every AI agent currently operating in the environment, including agents deployed outside the formal AI governance process, and identify which systems, data, and actions each one can reach.
- Design: Define risk tiers, ownership, permission boundaries, human-approval thresholds, and the specific control tests each agent's risk tier requires.
- Connect: Integrate with the identity, access-management, orchestration, and logging systems that generate ground-truth evidence of what each agent actually did, not just what it was authorized to do.
- Deploy: Run continuous testing against the highest-risk agents first, routing exceptions and threshold breaches to a named accountable owner in real time.
- Validate: Run parallel testing against a manual review sample, confirm continuous testing catches what a manual assurance review would have found, and calibrate accuracy thresholds before scaling coverage.
- Transfer or manage: Hand the continuous testing programme to internal audit, risk, and compliance to operate jointly, or continue it as a Crest.Digital-managed service as the agent population and its risk profile keep changing.
Starting with the highest-autonomy, highest-materiality agents — the ones already executing actions without real-time human review, the population EY found at 85% of adopters — gives the validate step a clean, high-stakes comparison against manual review before continuous testing extends to lower-risk agents where the cost of a missed exception is smaller.
Where the Agent Stops and Judgment Stays Human
Continuous testing of agentic AI governance is strong at three things: discovering agents a manual, self-reported inventory would miss; testing every agent's actual behavior against its authorized scope continuously rather than once a year; and generating the audit-ready evidence trail that turns "we have a governance policy" into something demonstrable. It is not a substitute for the judgment calls that remain squarely human — deciding what an agent's risk tier should be in the first place, deciding whether a novel exception represents acceptable risk or a genuine control failure, and providing the independent assurance opinion that a board or audit committee ultimately relies on. Those calls stay with risk, compliance, and internal audit leadership; continuous testing's job is to make sure they have complete, current evidence when they make them, rather than a self-reported inventory and an annual review that — per EY's own data — still misses shadow agents more than a third of the time.
This practice also connects directly to two adjacent pieces of Crest's Agentic Risk & Continuous Assurance work. The inventory-first discipline described here is the same one covered in why AI governance has to start with AI inventory, extended specifically to agents that can act rather than just models that predict. And once continuous testing surfaces a governance exception — an agent operating outside its permission scope, or a control gap no existing test covers — it feeds directly into the same regulatory and remediation lifecycle covered in Crest's work on regulatory compliance agents for AI governance. Detection, testing, and remediation are three stages of one practice, not three separate initiatives competing for the same budget.
EY's Richard Jackson made the closing point of the survey's own release worth repeating directly: "the fact that reviews so consistently uncover issues and lead to modifications, pauses, or cancellations shows that AI governance and assurance work when implemented." The evidence in EY's own data backs that claim — organizations that run a formal review do find and fix problems. The remaining question, for any audit or risk leader reading this, is whether their review happens often enough, and looks broadly enough, to find the agent nobody told them about before it becomes the incident 36% of respondents already reported.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
EY's September 2026 AI Risk and Governance Survey found that 91% of senior AI executives report their organization uses agentic AI, either through active pilots or full enterprise deployment, while only about half of those organizations have updated their AI governance framework to specifically address agentic AI's risks and requirements. The gap is the space between deployment speed and governance speed: agents are already executing actions inside enterprise systems — 85% of adopters admit at least a handful of their agents act without real-time human involvement — while the policies, controls, and testing regimes meant to oversee them are still built around an earlier, less autonomous generation of AI.
In EY's survey, among organizations already using agentic AI, 26% admitted they cannot reliably detect AI agents operating inside their environment without authorization — a shadow AI problem at the agent level rather than just the application level. This matters because an agent that isn't inventoried is also not risk-tiered, not permission-scoped, and not covered by whatever control testing the organization believes it's performing. Separately, among organizations that ran a formal AI assurance review, 39% found shadow AI as one of the issues surfaced — meaning agent inventories built from self-reported deployments are demonstrably incomplete without independent discovery.
Not reliably. EY found that 98% of surveyed organizations have formal AI governance policies in place, yet 47% admitted their organization has previously not followed its own AI governance process for urgent deployments, and 49% of agentic AI users say their governance framework hasn't been specifically updated for agentic AI's risks. A policy document establishes intent; it doesn't establish that every agent in production is inventoried, risk-tiered, permission-scoped, and subject to continuous testing. The distinction internal audit needs to test for is between governance that exists on paper and governance that is demonstrably operating against every agent currently running.
Traditional AI model governance testing tends to focus on a relatively static artifact — a model's training data, its documented intended use, and periodic validation of its outputs. Agentic AI adds a layer that static model governance doesn't cover: an agent that can plan a sequence of actions, call tools or other systems, and execute decisions autonomously, often without a single human touchpoint per action. Testing has to extend beyond the model itself to the agent's permission scope, the specific actions it's authorized to take, the human-approval thresholds that apply to those actions, and whether the agent's actual behavior in production matches what its design and risk tier assumed — tested continuously, since an agent's effective behavior can drift as the systems and data around it change.
No. Crest.Digital's Agentic Risk & Continuous Assurance practice builds the operational layer that tests whether an existing AI governance policy is actually being followed by every agent in production — the agent inventory, the continuous permission and control testing, the human-approval enforcement, and the audit-ready evidence trail. The organization's AI governance policy, its risk taxonomy, and its GRC platform of record remain the system of intent and the system of record; Crest's agents and continuous controls monitoring are the mechanism that closes the gap between what the policy says should happen and what agents are actually doing, every day rather than at the next scheduled review.