AI is spreading through organisations faster than many leaders can govern it, a little like the way sand spreads throughout your shoes when you walk on the beach.
But of course that is partly the point. Generative AI gives employees direct access to capabilities that once required specialist teams and significant budgets – our 2025 report, AI: The race for a use case, found that 67% of IT and business leaders agreed that GenAI is democratising AI usage. However, easier access also means less control. The research also found that 44% believed at least one in ten employees were using non-sanctioned AI tools. More than half, 58%, said this was affecting their ability to maintain control over data compliance.
Confidence is no substitute for control
Recent events show how misplaced confidence can create very public problems. In 2026, KPMG withdrew a report about agentic AI after organisations including UBS, Transport for London and the NHS disputed AI success stories attributed to them. A report intended to demonstrate the power of AI had used AI to describe projects that did not exist. Misplaced assumptions can also have more immediate consequences: in another 2026 incident, a Meta employee reportedly asked an internal AI agent to organise her inbox, and the agent interpreted the instruction rather liberally, deleting emails without permission.
This shows how the challenge becomes more serious as AI begins to act, as opposed to simply advise. When AI agents can access systems, process information and complete tasks with limited human involvement, ‘common sense’ (that hard-to-define, and stubbornly human feature) can go out of the window.
Safeguards not optional
Healthcare offers an early warning (a worrying warning too, given the implications for patients). Research we conducted for Imprivata found that 72% of surveyed US healthcare organisations had AI tools or agents deployed without formal IT approval. Meanwhile, 88% expected agents to operate with at least some autonomy, but only 17% believed existing identity approaches were sufficient without adaptation. Traditional security models govern what people can access. Agentic AI introduces non-human identities that may use data and take actions on somebody else’s behalf. Organisations need to know which agents are active, who owns them, what they can access and where human approval is required.
And data controls present another weakness – poor data will not magically become reliable when an AI system is using it. Our research for Iron Mountain found that 48% of data and AI decision-makers strongly agree their organisation needed to improve the trustworthiness of its data.
Independent research can expose the gaps like these between executive confidence, employee behaviour and operational reality in your target market. If you want to understand how your market is approaching AI governance, agentic AI or another emerging technology challenge, talk to us about your insight needs.
And if this all sounds overly cautious, consider the AI agent that reportedly apologised for being “away all weekend” (and when reminded that AI agents do not have weekends, it merely responded that it would write that fact to memory). Artificial intelligence may have some way to go in various respects, but apparently it has already mastered the Monday morning excuse.