Use of artificial intelligence (AI) is outpacing policy and governance in organizations. That’s according to new research from ISACA, an international professional association focused on IT governance
It found that while the majority (83 percent) of IT and business professionals in Europe believe employees in their organization are using AI, many are dragging their heels when it comes to implementing formal guidance and regulation for staff.
Only 31 percent of surveyed organizations have a formal, comprehensive AI policy in place.
Is AI being hampered by poor policy and governance?
It’s clear that the use of AI is becoming more prevalent within the workplace, and so regulating its use is best practice. However, there is a clear disparity between how often AI is used versus how closely it’s regulated in workplaces, ISACA warned.
AI is already having a positive impact on day-to-day business operations. For example, over half (56 percent) of respondents say it has boosted organizational productivity, with 71 percent reporting efficiency gains and time savings. What’s more, 62 percent are optimistic that AI will positively impact their organization in the next year.
Why is AI helpful?
The top five ways AI is being used in organizations are:
- To create written content (56 percent).
- To increase productivity (56 percent).
- To automate repetitive tasks (42 percent).
- Analyzing large amounts of data (39 percent).
- Customer service (33 percent).
Register for PEX Network’s All Access: AI in Business Transformation 2025 and learn how to future-proof your business with the right strategy and latest technology
AI risks are a major concern
However, the speed and scale make the technology a magnet for bad actors. Almost two-thirds (63 percent) of leaders are “extremely or very” concerned that generative AI could be turned against them, while 71 percent expect deepfakes to grow sharper and more widespread in the year ahead.
Despite this, only 18 percent of organizations are investing in deepfake-detection tools – signaling a significant security gap. Meanwhile, just 28 percent of respondents believe businesses are adequately addressing ethical concerns in relation to AI deployment such as data privacy, bias and accountability.
Without clear policies that mitigate risks, AI becomes a potential liability, ISACA warned. Robust, role-specific guidelines – covering everything from “when to use AI” to “how to spot a deepfake” – are needed to help businesses safely harness AI’s potential.
Responsible AI adoption needs to be a top priority for modern businesses, said Chris Dimitriadis, chief global strategy officer at ISACA? “While awareness is growing, many organizations are still falling behind when it comes to taking action and adopting it. At the same time, AI threats are evolving fast, from deepfakes to phishing, and without adequate training, investment and internal policy, businesses will struggle to keep up.”
Education gets the best from AI adoption
Policies are only as effective as the people who understand them and can confidently put them into practice, ISACA stated. As emerging technologies like AI continue to evolve, there is a need to upskill and gain new qualifications. However, only 28 percent of organizations provide AI training to all employees, with almost a third (29 percent) of respondents stating there is no AI training provided to any employees.
“Without guidance, rules or training in place on the extent to which AI can be used at work, employees might continue to use it in the wrong context or in an unsafe way. Equally, they might not be able to spot misinformation or deepfakes as easily as they might if they were equipped with the right knowledge and tools,” Dimitriadis said.
Upskilling can’t wait. AI training must be prioritized and properly budgeted for and, at the same time, workplaces must work to embed formal and comprehensive policies that are understood by all as employees continue to experiment with AI in their day-to-day.
“With more skilled employees, businesses will have a workforce with a better understanding of best practice,” Dimitriadis added. “These employees are more likely to champion the embedding of policies, making sure regulations are adhered to and upheld to a good standard.”
[inlinead-1]