How Many Organisations Have an AI Governance Policy?
Eleven industry reports put the share between 18% and 44%. Most of that spread is not disagreement about the answer, it is disagreement about the question.
The short answer
About a third. Eleven industry reports published between April 2025 and May 2026 put the share of organisations with an AI policy somewhere between 18% and 44%. The median is 37%.
No single figure is the right one, and the 26 point spread is not survey noise. It is mostly a disagreement about what counts as having a policy at all.
Why the reports disagree
Sorted by how demanding the question was, the range stops looking random.
Whether a policy exists at all: 36% to 44%
Seven reports asked only whether the organisation has one. They cluster tightly.
- 44% SailPoint, AI agents: The new attack surface. A global survey of security, IT professionals and executives: “Only 44% of organizations report having policies in place to secure AI agents.”
- 41% OpenText & Ponemon Institute, Managing Risks and Optimizing the Value of AI, GenAI & Agentic AI: “Only 41% of organizations have AI-specific data privacy policies in place.”
- 41% Kroll, 2025 Global Business Sentiment Survey: Resilience, Risks, and Preparedness: “Only 41% of companies have AI policies and guidance in place, which relates to managing risks associated with AI.”
- 41% Mimecast, The State of Human Risk 2026: “41% of organizations have created specific AI usage policies.”
- 40% AI Pulse Survey, Nearly Half of Large Enterprises Lack Full Visibility Into AI Use by Employees, According to New Protiviti AI Pulse Survey: “Only 40% of organizations have a formal AI governance framework in place.”
- 37% IBM, Cost of a Data Breach Report 2025: “Only 37% of organisations have policies to manage AI or detect shadow AI.”
- 36% EisnerAmper, Artificial Intelligence In the Workplace: “Just 36% of companies indicate they have a formal AI policy in place.”
Whether it is comprehensive or enforced: 23% to 26%
Two reports raised the bar from having a policy to documenting and enforcing it. The share roughly halves.
- 26% SmartSheet, 2026 operational excellence report: “Only 26% of organizations have fully documented and enforced AI governance policies in 2025.”
- 23% Metomic, 2025 State of Data Security Report: Top Priorities, Challenges and Concerns for Today's CISOs.: “Only 23% of organizations surveyed have implemented comprehensive AI security policies.”
Whether it is mature: 18% to 20%
Two reports asked something stricter again.
- 20% EY, The AI landscape in cybersecurity: “20% of organizations have optimized their AI cybersecurity governance frameworks and embedded them into organizational culture.”
- 18% Checkmarx, The Future of AppSec in the Era of AI: “Only 18% of organisations have policies governing AI use.”
What to quote
If you need one number, 37% of organisations have an AI policy is the median of the eleven, and around 40% is the fair reading of the seven that asked the plain question.
Quote a lower figure only if you mean something more demanding than a policy existing, and say which. A great deal of the disagreement in AI governance statistics is people comparing 18% against 44% as though both answered the same question.
How this was put together
Every figure above is quoted as its publisher wrote it and linked to the report it came from. Each was matched to this question automatically and then checked by hand before being included.
One figure was set aside. Riskonnect reported that 23% of companies have a policy against using foreign AI models such as DeepSeek, which is a different subject to whether an organisation governs its own AI use.
Browse the full statistics database or get new figures weekly by email.