EY survey analysis: 98% policies, 47% skip, 26% miss agents

An AI governance policy is very good at sitting in a folder. It is less useful when an urgent deployment walks around it, which is apparently not a rare sport. Techstrong.ai reported that EY's inaugural US AI Risk and Governance Survey found 98% of respondents said their organizations have formal AI governance policies, while 47% said governance had been skipped during urgent AI deployments. Among organizations using agentic AI, Techstrong.ai reported that 26% could not detect unauthorized AI agents operating internally, which is the part where the folder begins to look ornamental.

The policy exists. The gate does not

Techstrong.ai reported that EY surveyed 202 senior AI decision-makers at US publicly traded companies with at least $1 billion in annual revenue. That sample matters because these are not hobby projects run on a spare laptop under a desk, charming as that compliance defense would be. BigDATAwire, carrying the EY announcement, said the survey examined how leaders govern AI, including how quickly governance frameworks are adapting to agentic AI and the extent and impact of AI-related risk. EY's own release framed the problem plainly: autonomous AI implementation is outpacing oversight.

The practical reading is simple. A policy that can be skipped during urgency is not a control, it is a suggestion with letterhead. For builders, the useful question is not whether the organization has an AI governance document, but whether release workflows make it difficult to ship without an owner, approved use case, risk review, and logging plan. If the answer depends on someone remembering to email legal, the answer is no.

Agentic AI turns shadow use into an operations problem

Techstrong.ai reported that among organizations using agentic AI, 49% had not updated governance frameworks for agentic systems and 26% could not detect unauthorized AI agents operating internally. That pairing is the real compliance headache. Agentic systems are not merely chat windows with better branding; they can be connected to tools, workflows, data stores, and internal permissions. If the inventory is incomplete, the organization cannot reliably say what is acting, on whose authority, or against which data.

The plain obligation, even before a regulator asks awkward questions, is visibility. Teams need an agent register that captures owner, purpose, connected tools, data categories, permission scope, model or provider, and production status. They also need logs that show actions taken by the agent, not just prompts typed by the user. Unauthorized internal agents are hard to govern for the same reason untracked vendors are hard to audit: nobody can review a system they cannot find.

Governance has to move into the deployment path

Techstrong.ai reported that EY recommends clearer accountability, controls built into deployment workflows, greater visibility into AI systems, and recurring verification that agents behave as intended. Translated out of consultant dialect, that means governance has to become part of shipping. The approval record should live where deployment decisions happen, not in a slide deck presented after launch. A production agent should not move forward unless a named owner, permitted use, escalation route, and monitoring requirement are already attached.

This is where policy becomes engineering work. Procurement should block unapproved AI services, internal platforms should require registration before access to sensitive systems, and deployment pipelines should preserve evidence that reviews actually happened. Recurring verification is not a ceremonial quarterly meeting. It means testing whether agents still stay within their assigned task, whether permissions have drifted, and whether logs remain useful when something goes wrong.

The next audit will ask for evidence, not intent

BigDATAwire described the survey as showing that processes and controls are not keeping pace despite reputational, cybersecurity, and shadow AI risk. That is the part worth taking seriously without turning it into theater. Written governance is still useful, but only as the map for enforceable steps: inventory, approval gates, telemetry, escalation, and periodic checks. The law rarely rewards a company for having meant well in a PDF.

For readers building or buying autonomous AI, the next move is modest and concrete. Pick one agentic workflow and trace it from request to deployment to monitoring, then identify every point where governance depends on memory instead of a system gate. Watch next for whether vendors start offering usable agent inventories and audit trails, because those will matter more than another policy template with a tasteful cover page.