Protiviti's AI Governance Guide Surfaces a Structural Gap: Most Enterprises Still Lack Formal Intake, Inventory, and Committee Controls

What happened

Why it matters

• ·Regulatory exposure: US federal and state regulators, including the FTC and emerging state-level frameworks in Colorado, Texas, and California, are increasingly scrutinizing whether organizations can demonstrate structured AI oversight, making the absence of a formal governance committee or model inventory a documented liability.
• ·Operational impact: Without a scalable AI intake and model inventory process, compliance teams cannot answer basic audit questions about which AI systems are in use, who approved them, or what risks they carry, creating material gaps in any compliance program.
• ·Organizational risk: Diffuse executive accountability for AI outcomes, where no named leader or committee owns AI governance, leaves organizations unable to escalate incidents, enforce policy, or demonstrate board-level oversight to auditors, investors, or regulators.

Governance controls affected

What to do now

• ☐Audit whether your organization has a formally chartered AI governance committee with documented decision rights, membership, and escalation paths, and close any gaps against the committee structure Protiviti recommends.
• ☐Review your current AI model intake process to confirm it captures all deployed models, including third-party and shadow AI tools, and assigns a risk classification to each at the point of intake.
• ☐Confirm that a named executive or senior leadership function holds documented accountability for AI governance outcomes, separate from IT or legal ownership alone.
• ☐Map your existing AI inventory against your ethics and acceptable use policies to identify models or use cases that have never been formally reviewed against those standards.
• ☐Use the guide's committee and intake framework as a baseline for a maturity gap assessment, then prioritize the three or four structural controls most likely to be requested by regulators or auditors in the next 12 months.

What to watch next

Compliance teams should monitor how state-level AI governance requirements in Colorado, Texas, and California begin to prescribe specific committee structures, inventory obligations, or executive accountability standards, since voluntary frameworks like this one often anticipate what becomes mandatory. The FTC's continued AI enforcement activity and the SEC's evolving expectations for AI risk disclosure to investors are also likely to create pressure for the exact structural controls Protiviti describes. Practitioners building governance programs should track whether ISO 42001 certification begins to emerge as a de facto audit benchmark that regulators or procurement counterparties reference, which would raise the stakes for organizations that have not yet formalized their committee and intake controls.