AI Governance Institute
← News
Research2026-05-06

AI Governance Gaps Persist Across Global Enterprises, Cloud Security Alliance and Google Find

Source

The State of AI Security and Governance

Cloud Security Alliance

What happened

The Cloud Security Alliance published The State of AI Security and Governance on May 5, 2026, commissioned by Google. The report draws on data from enterprise respondents globally and examines the maturity of AI governance programs, security integration practices, and data exposure risks arising from generative and agentic AI deployments. Among its central findings, the report documents that governance frameworks within most organizations lag behind the pace of AI adoption, leaving measurable gaps between actual AI use and formal oversight structures. It further identifies that multi-model AI strategies remain concentrated among a small number of dominant foundation model vendors, creating dependency and concentration risks that governance teams have not yet fully addressed. Security teams are noted as among the earliest enterprise adopters of AI in operational workflows, yet formal AI security policies governing those same tools are frequently absent or underdeveloped.

Why it matters

  • ·Regulatory exposure: Organizations operating under frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001 face heightened scrutiny where governance structures are established retroactively rather than alongside deployment, a pattern the report identifies as prevalent across global enterprises.
  • ·Operational impact: Concentration of multi-model AI strategies among a small number of foundation model providers creates systemic dependency risk, meaning a disruption or compliance failure at one vendor can simultaneously affect multiple AI-dependent workflows across an organization.
  • ·Organizational risk: The absence of formal AI security policies in security teams that are already using AI tools for threat detection and incident response creates an accountability gap, leaving organizations exposed to undocumented failure modes including prompt injection and unintended data exposure.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

BRD-005AI Governance Maturity AssessmentPRC-009AI Vendor Concentration Risk AssessmentBRD-009Unified Multi-Framework AI Risk RegisterSEC-001Prompt Injection PreventionSEC-003Sensitive Data Handling in AI Pipelines

What to do now

  • ☐Benchmark your organization's current AI governance maturity against the report's findings and document identified gaps for executive and board reporting.
  • ☐Review third-party AI vendor due diligence processes to confirm they cover foundation model providers and assess concentration risk where multiple workflows depend on a small number of vendors.
  • ☐Audit data classification and access control policies to verify they have been updated to address inputs to generative AI systems, particularly in agentic configurations with broader data access.
  • ☐Coordinate legal and security teams to determine whether existing incident response plans explicitly cover AI-specific failure modes such as model misbehavior, prompt injection, and unintended data exposure.
  • ☐Assess whether formal AI security policies have been documented for security team AI tools already in operational use, including those applied to threat detection and incident response workflows.

What to watch next

Compliance teams should monitor the Cloud Security Alliance for follow-on guidance or updated benchmarks that operationalize the report's findings into specific control requirements. Pending regulatory developments in major jurisdictions, including EU AI Act implementation acts and forthcoming NIST AI RMF profiles, may reference or align with the governance gaps this report identifies, increasing the likelihood that documented deficiencies become enforceable compliance obligations. Teams should also watch for Google or other major foundation model providers issuing complementary governance tooling or contractual requirements that respond to concentration risk findings surfaced in this research.

Related Coverage

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.

Corporate Policy2026-11-04

Google's AI Bundling Threat to Schools Exposes Coercive Adoption Risk

Google told K-12 schools they would lose Google Search access unless they opted in to AI features. This bundled essential service access with Gemini adoption. The plan drew antitrust criticism from lawmakers and former Federal Trade Commission Chair Lina Khan, who cited existing court findings of Google's monopoly liability. Following swift backlash, Google revised the plan so that Gemini, Gemini Notebook, and Search would each be off by default and independently switchable.

Research2026-11-02

Prompt Injection Techniques Leaked PII and Ran Unauthorized Code in AI Agents

Adversa AI's October 2026 security roundup documented prompt injection techniques that caused AI agents to leak personal data, execute unauthorized code, and expose information across customer boundaries. The failures traced to excessive agent privileges, weak isolation of what agents can access and do, and insufficient validation of the commands agents execute. Compliance teams at enterprises running AI agents face direct exposure if these structural controls are not in place.