What are the biggest AI governance challenges, and how do we address them?

The most common AI governance challenge is not a regulatory one, it is a visibility one. Employees adopt AI tools through personal accounts, vendors embed AI features into existing software without flagging it, and departments subscribe to tools outside procurement's normal review. Every governance activity that follows, from risk classification to regulatory mapping, depends on first knowing what AI systems are actually in use.

Discovery has to combine multiple methods because no single one is complete. A vendor contract review catches AI features embedded in approved software. An employee survey, ideally offering amnesty for undisclosed tool use, surfaces adoption that never went through procurement. A network-level audit for outbound traffic to known model provider API endpoints catches what neither of the first two methods will admit to. Programs that skip this step end up governing a fraction of their actual AI footprint.

A second recurring challenge is the gap between documented controls and enforced ones. A human-oversight checkpoint that a bug or a misconfiguration can bypass is not a control, it is a description of intent. Real incidents illustrate this precisely: a content-moderation system whose human-review step could be technically skipped let automated bans reach thousands of users before anyone caught it, and a pre-production approval gate that existed procedurally but was not backed by documented accuracy thresholds let an inventory system reach production before its failure modes were understood.

The fix is to audit control enforcement, not just control documentation. For every control listed in a governance policy, ask whether the system can currently operate as if that control did not exist, and if so, treat that as an active gap rather than a paper compliance item.

No single AI law covers all obligations for most organizations. The EU AI Act, a growing list of US state statutes, sector-specific guidance, and international voluntary frameworks all apply differently depending on where users are located, what sector the system operates in, and what kind of decisions it makes. Treating one framework as sufficient coverage is a common and consequential mistake.

The practical response is a jurisdictional applicability matrix: for every AI system, document which regulations plausibly apply based on user geography and use case, then track that mapping as both your system inventory and the regulatory landscape change. This turns an abstract "the law keeps changing" problem into a concrete, maintainable document.

AI governance without a clear owner defaults to no governance. When responsibility is split across Legal, Risk, and IT without an explicit division of labor, risk assessments do not happen, vendor reviews get skipped, and no one owns the decision to pause a deployment when something looks wrong. Resourcing compounds this: many compliance teams are being asked to govern AI without the technical literacy to evaluate what a model is actually doing, which pushes governance toward policy work disconnected from the systems it is meant to control.

Neither problem has a universal fix, but both need to be named explicitly rather than left implicit. Document which function owns which governance activity, and treat technical AI literacy as a training investment for the compliance function itself, not something outsourced entirely to engineering.

AI capabilities, deployment patterns, and the regulatory response to both are moving faster than most governance programs can fully absorb. A control set that was adequate for last year's AI deployments may not address agentic systems that take autonomous action, and a compliance posture that was defensible six months ago may have gaps today simply because a new enforcement action redefined what "adequate" oversight looks like.

Programs that treat their control set as a living document, revisited on a recurring cadence rather than set once and left alone, handle this better than programs that wait for a mature, finished framework before acting. Waiting for certainty is itself a governance risk in a domain that has not stopped moving.