Ask an executive whether their organisation could pass an AI compliance audit tomorrow and most will say yes. Ask whether the AI governance programme is mature and most will pause. That gap between confidence and maturity is the most useful finding in the 2026 State of AI Governance report from Schellman, a technology assurance and certification firm, based on a survey of more than 500 US enterprise leaders. The report was first published in July 2026 and the accompanying write-up was refreshed this week.
This article reads those numbers the way an internal auditor would: what they say, why a confident answer is not the same as an evidenced one, and what a practical audit-readiness plan looks like when AI agents are already running in production. It builds on our earlier pieces on AI compliance moving from documentation to evidence and on why an ISO 42001 certificate does not mean an organisation is AI-governed.
Crest.Digital’s Agentic GRC links AI policies to controls, tests, and evidence so that governance can be demonstrated between audits.
Explore Agentic GRCWhat the 2026 State of AI Governance Survey Found
The headline numbers, from Schellman’s published summary, only make sense when read together. About 90% of organisations have allocated funding for AI governance. Yet only 57% have a formal AI governance policy and only 44% have documented incident response procedures for AI-specific issues. Just 27% describe their AI governance programmes as fully mature, while 74% believe they could pass an AI compliance audit today.
Regulation is not hypothetical for these respondents. Some 94% operate under AI-related regulatory requirements that are already in effect, but only 29% say they have prepared for the EU AI Act and 12% for requirements in Asia-Pacific. Accountability is also concentrated: 42% assign AI purchasing and adoption decisions to a single executive, typically the CIO or head of IT, and only 36% of boards regularly discuss third-party AI risk.
A note on reading the data. Schellman is an audit and certification firm with an interest in the topic, the sample is US-based, and we have worked from the published summary rather than the full report, which also includes a framework for human review of agent actions. Treat the figures as a useful benchmark of senior-leader sentiment, not as an independent census, and check the full report before quoting a percentage in a board paper.
Why Audit Confidence Runs Ahead of Audit Evidence
Three structural reasons explain why 74% can feel ready while only 27% call their programme mature. They are the same patterns we see in controls programmes outside AI.
1. Readiness is judged by intent, not by testing. Funding, a steering committee and a draft policy create a feeling of progress. An audit asks different questions: is the policy approved and current, who is accountable for each AI system, what controls implement it, and what evidence shows those controls ran last quarter? The ISO/IEC 42001 management-system standard is built around that chain, from policy to operation to monitoring and review.
2. The inventory is incomplete. An organisation cannot evidence governance of AI it does not know it has. Shadow use, embedded AI inside SaaS products and models consumed through suppliers all sit outside many registers, a problem we explore in why the AI inventory starts with the vendor inventory.
3. Incident readiness is the weakest link. With fewer than half of organisations holding documented AI incident procedures, many would be improvising on the day a model produces a harmful output, leaks data or is manipulated. Regulators and auditors treat the absence of a rehearsed procedure as a control gap in itself.
The Agentic AI Twist: Governance Is Now a Deployment Accelerator
The survey’s most striking agentic AI finding is that 46% of organisations already have AI agents live in production and 86% have at least tested them. More interesting still, organisations with mature governance run agents in production at 78%, against 22% for those still building their programmes. Governance, on this evidence, is not what slows AI down. It is what lets organisations trust it enough to deploy.
That matters for internal audit and risk leaders, because an agent is not a static model. It takes actions, uses credentials and touches systems of record. An audit-ready agent estate needs an identity for every agent, least-privilege access, human approval for consequential actions and a log that lets someone reconstruct what happened. We cover these controls in why AI agents need audit trails and in the argument that an AI policy is not an internal control until someone tests it. The COSO internal control framework still applies; what changes is the evidence source.
A Six-Step Plan to Make AI Audit Readiness Real
We deliver continuous assurance as a configurable pod rather than a bespoke build: reusable connectors, orchestration, an evidence repository and an audit trail, with client-specific effort focused on data mapping, control logic, approvals and reporting. The same Discover, Design, Connect, Deploy, Validate, Transfer sequence applies to AI governance.
Discover Every AI System, Agent and AI-Enabled Supplier
Build one inventory covering internally built models, agents, embedded AI in business applications and third-party AI services. Record the business owner, data used, decisions influenced and risk tier for each.
Design Policy Into Testable Controls
Translate each policy statement into a control with an owner, a frequency and an evidence requirement. If a policy line cannot be tested, rewrite it until it can. Map controls to the frameworks you answer to, such as ISO/IEC 42001 and the EU AI Act.
Connect Evidence Sources to the Control Library
Link model registries, access logs, change tickets, approval records and vendor files to the controls they support, so evidence is captured as work happens rather than reconstructed before the audit.
Deploy Monitoring and a Rehearsed Incident Procedure
Run automated checks on the highest-risk systems first: unapproved models, agents with excess privilege, missing human approvals. Document the AI incident procedure and rehearse it with a tabletop exercise.
Validate With an Independent Mock Audit
Have internal audit or an external assessor test a sample of controls end to end. Compare the result with the self-assessed confidence. The difference is your real readiness gap.
Transfer Ownership and Report to the Board
Hand day-to-day operation to named owners, or run it as a managed service, and give the board a short, current view of inventory coverage, control exceptions, incidents and third-party AI exposure.
Step five is where credibility is built. The Institute of Internal Auditors expects internal audit to provide independent assurance on governance and risk management, and AI is now squarely inside that remit. Our article on an independent assurance layer for AI agent testing sets out what that testing can look like in practice.
Crest.Digital’s vendor intelligence platform identifies which suppliers embed AI, assesses their governance and monitors changes continuously across the industries we cover.
The Board Blind Spot: Third-Party AI Risk
Only 36% of boards regularly discuss third-party AI risk, and that is the number we would put on the audit committee agenda. Most enterprises consume far more AI than they build: foundation models behind SaaS tools, AI features switched on by a vendor update, analytics partners that train on shared data. Each is a third party whose governance affects your own audit outcome. The EU AI Act assigns obligations along the AI value chain, so “the vendor does that” is not a defence a regulator will accept.
Practical third-party AI governance means asking suppliers which models they use, where data flows, whether they hold an AI management-system certification and what its scope covers, and how they will notify you of material change. AI agents can run that outreach and evidence collection at scale, compare responses with public signals and flag drift, while risk owners decide what to accept. We discuss the vendor-selection angle in which vendors, not which framework.
Your Turn: Would You Pass an AI Audit Today?
- Funded and intending: There is budget and a committee, but the policy is draft, the inventory partial and incident procedures undocumented.
- Documented: Approved policies and an inventory exist, but control evidence is assembled by hand and nobody has tested it independently.
- Evidenced: Policies map to controls, evidence is captured continuously, incidents are rehearsed, and an independent test has confirmed the result.
Which describes your organisation? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
Being audit-ready means an organisation can show, on request, that its AI governance policies are approved and current, that every AI system and agent is inventoried and risk-tiered, that controls implement the policies, and that evidence shows those controls operated over the relevant period. It also means there is a documented and rehearsed AI incident procedure and a named accountable owner for each system. Readiness is demonstrated by evidence and independent testing, not by funding or intent.
Leaders often equate visible activity with control: budget approved, committee formed, policy drafted. Auditors test specific artefacts instead, such as an approved policy, a complete inventory, control evidence and incident procedures. Shadow AI and embedded vendor AI also sit outside many inventories. The 2026 State of AI Governance survey illustrates the gap, with 74% believing they could pass an AI audit while only 27% call their programme fully mature and 44% have documented AI incident procedures.
ISO/IEC 42001 specifies requirements for an AI management system, covering policy, roles, risk and impact assessment, operational controls, monitoring and continual improvement. Working towards it gives structure to audit readiness, and certification can be a useful signal. However, certification covers a defined scope, so it does not prove that every AI system, agent or supplier in an enterprise is governed. Always read the scope statement and map it against your own inventory.
Treat each agent as a non-human user. Give it a unique identity, grant least-privilege access, define which actions need human approval, log inputs, decisions and actions so they can be reconstructed, and test controls on a schedule. Add monitoring for unapproved agents and excess permissions, and require an owner for every agent. Mature governance does not slow adoption; the survey found that organisations with mature governance were far more likely to run agents in production.
Most enterprise AI exposure arrives through suppliers: models embedded in SaaS products, vendor features enabled by update and partners that process company data. Regulators, including under the EU AI Act, assign obligations across the AI value chain, so outsourcing the technology does not outsource the accountability. With only about one in three boards regularly discussing third-party AI risk, a standing agenda item covering supplier AI inventory, due diligence and change notifications is a practical first step.