AI Assurance · Whitepaper · 2026

From AI Governance to Evidence

Why policies and controls are only the beginning, and how organisations can demonstrate that AI is governed in practice.

Read Whitepaper

Executive Summary

Almost every organisation now says it has AI governance. Almost none can prove it on demand.

The American Arbitration Association's AAA-ICDR Institute, in a May 2026 benchmark survey of 500 senior legal and executive leaders at large US and Canadian organisations, found that 87% say their organisation has some form of AI governance in place, but only 22% say those systems are actually operating effectively. Pressed further, only 22% said they were very confident they could produce evidence of governance decisions for regulators or auditors if required. Only 33% have defined escalation pathways for when an AI system misbehaves, and only 35% report meaningful involvement from legal and compliance teams, against 80% who cite involvement from IT.

Grant Thornton's 2026 AI Impact Survey, drawing on responses from nearly 1,000 senior US business leaders in early 2026, found much the same gap from a different angle: 78% lack full confidence that their organisation could pass an independent AI governance audit within 90 days, even though three in four boards have approved major AI investment. ISACA's 2026 AI Pulse Poll, surveying more than 3,400 digital trust professionals globally, found that only 38% of organisations have a formal, comprehensive AI policy, up from 28% in 2025, while 25% report having no active AI policy at all.

The stakes of this gap are not abstract. In Mobley v. Workday, an ongoing federal collective action in the Northern District of California, a court has allowed discrimination claims against an AI hiring-screening tool to proceed on the theory that the vendor itself may bear direct liability for decisions its system made on a customer's behalf. Cases like this turn substantially on what documentation, testing and monitoring evidence actually exists behind an AI system, not merely on whether a policy document says the right things.

This whitepaper sets out why governance frameworks that cannot produce their own evidence are not yet governance at all, and what organisations need to build so that, when asked, they can show their AI decisions were made responsibly, not just claim it.

01 · The Governance-Practice Gap

Policies are being written. Ownership is being assigned. Very little of it is actually working day to day.

The AAA-ICDR Institute's benchmark study, "From Principles to Practice," surveyed 500 senior legal and executive leaders, 70% of them at organisations with $1 billion or more in revenue, across financial services, technology, healthcare, energy, manufacturing, professional services and legal sectors. Its headline finding is stark in its own right: 87% of organisations report some form of AI governance, yet only 22% say that governance actually operates effectively. The gap sits in three specific places. Only 33% have defined escalation pathways for when an AI system misbehaves, leaving most organisations without a consistent way to manage risk as it happens rather than after the fact. While 80% report that IT or technology teams contribute to AI governance, only 35% report meaningful involvement from legal and compliance functions, the functions best placed to know what a regulator or court will actually ask for. And despite citing accountability clarity as a top governance need, only 21% of CEOs report holding final AI deployment authority themselves, suggesting that ownership is frequently delegated downward rather than genuinely held at the top.

ISACA's 2026 AI Pulse Poll, drawing on more than 3,400 digital trust professionals worldwide, adds a formal-policy dimension to the same picture: 90% believe employees at their organisation are already using AI, yet only 38% have a formal, comprehensive AI policy in place, up from 28% the year before. A further 30% report only a limited policy, and 25% report no active AI policy at all. Adoption of AI inside organisations is, by every measure, running well ahead of the governance meant to contain it.

None of this describes organisations acting in bad faith. Frameworks are being built, policies are being drafted, and named owners are being assigned. What is missing is the connective tissue between the policy document sitting in a governance folder and what actually happens the next time an AI system makes a consequential decision.

02 · Why "We Have a Policy" Isn't Evidence

A governance document proves an organisation had good intentions. It says almost nothing about what actually happened.

Grant Thornton's 2026 AI Impact Survey found that 78% of nearly 1,000 senior US business leaders surveyed lack full confidence that their organisation could pass an independent AI governance audit within 90 days, despite three in four boards having approved major AI investment. Only 52% of those boards have set clear AI governance expectations, and only 54% have integrated AI risk and opportunity into ongoing board or committee oversight. Nearly half of leaders, 46%, said AI underperforms specifically because controls and compliance are not working as intended, yet only 11% said risk and compliance should be an organisation's top AI priority. Governance, in other words, is widely acknowledged as the actual constraint on AI value, and still not where the attention or investment goes.

The distinction that matters here is between a policy and evidence. A policy is a statement of intent: this is how we say we will govern AI. Evidence is the record that intent was carried out on a specific occasion, the testing that was run before a model went live, the log showing a particular decision and the reasoning behind it, the escalation that occurred when something went wrong and what was done about it, the board minute showing genuine scrutiny rather than a rubber-stamped approval. An organisation can have an excellent policy and still have no evidence whatsoever that the policy was followed on the one occasion a regulator, court or customer actually asks.

Grant Thornton's survey also found that fewer than one in five organisations piloting, scaling or running autonomous AI has tested a response plan for when that AI fails, even though nearly three in four organisations fall into one of those categories. Most companies have incident playbooks. Few have adapted them for AI, and that gap is exactly what turns a difficult moment into one an organisation cannot explain.

03 · The Mobley v. Workday Signal

A federal court is currently testing exactly how much evidence an AI vendor needs to be able to produce.

Derek Mobley, over 40, African American and disabled, brought a class and collective action alleging that Workday's AI-driven applicant-screening tools discriminated against him and other candidates on the basis of race, age and disability, despite his being qualified for the roles he applied to. In May 2025, Judge Rita Lin of the US District Court for the Northern District of California granted preliminary certification of a nationwide collective action on the plaintiffs' age-discrimination claim. Significantly, the court also allowed the claims to proceed on the theory that Workday itself could be directly liable as an "agent" of its customers, reasoning that it was plausible Workday's customers had delegated their traditional hiring functions, reviewing, ranking and rejecting candidates, to Workday's AI.

The case remains in the discovery and fact-finding stage as of this writing, and no final verdict on liability has been reached. What makes it instructive here is not its outcome but its structure: the central factual questions concern what testing, validation and monitoring evidence exists behind the screening model's decisions, and whether that evidence shows the kind of ongoing oversight a governance policy would promise on paper. A written non-discrimination commitment is not what a court examines in a case like this. What gets examined is whatever record exists of how the system actually behaved.

Every organisation deploying or buying AI for a consequential decision, hiring, lending, insurance, healthcare triage, should read Mobley v. Workday as a preview of the question it will eventually be asked, whether by a regulator, a court or a customer: not "do you have a policy," but "show us what happened, and show us you were watching."

The Evidence Gap

Organisations have governance frameworks. Few can prove they work.

Independent surveys converge on the same finding: the gap in AI governance is no longer whether a policy exists, but whether an organisation can demonstrate it was followed.

Governance That Works in Practice

Of organisations say their AI governance systems are operating effectively, despite 87% claiming some form of governance exists.

AAA-ICDR Institute, AI Governance Benchmark Study, 2026

Confident in Audit Readiness

Say they are very confident they could produce evidence of governance decisions for regulators or auditors if required.

AAA-ICDR Institute, AI Governance Benchmark Study, 2026

Lack Confidence in a 90-Day Audit

Of senior leaders lack full confidence their organisation could pass an independent AI governance audit within 90 days.

Grant Thornton, 2026 AI Impact Survey

Together, these figures show that the AI governance gap is no longer primarily about writing policy. It is about being able to prove, on request, that the policy was followed.

04 · What Actually Counts as Evidence

Two established frameworks already describe what evidence looks like. Most organisations are not yet producing it.

The NIST AI Risk Management Framework, released in January 2023 and now the most widely adopted AI governance standard in the United States, structures responsible AI governance around four functions: Govern, Map, Measure and Manage. Its Govern function sits at the centre of the framework, and its documentation requirement is explicit: AI risk-related information, including incidents, decisions and mitigations, must be systematically recorded and maintained for accountability and traceability. That is a direct description of evidence, not policy, a durable record of what happened, not a statement of what should happen.

ISO/IEC 42001, the world's first international standard for AI management systems, extends the same logic into a certifiable structure. It is gaining traction quickly: Fortune 500 companies are increasingly requiring vendors to hold certification or show a credible roadmap toward it, and adoption now spans foundation-model providers, SaaS companies, legal firms, medical device manufacturers and professional services firms. Certification itself is a form of externally verified evidence, proof, assessed by an independent body, that a management system for governing AI actually exists and operates, rather than a self-description an organisation has written about itself.

In practice, the evidence both frameworks point toward takes a consistent shape: testing and validation records showing a model was assessed before deployment and after material updates; decision logs that tie specific automated or AI-assisted outcomes back to the reasoning behind them; escalation records that show not just that a channel existed but how a specific issue was raised, handled and closed; version histories that record when an underlying model changed and what reassessment followed; and board or committee minutes that show substantive scrutiny of AI risk rather than a single line of approval. None of this is exotic. All of it is achievable. Very little of it currently exists inside the 87% of organisations that report having governance in place.

05 · Building Evidence Into the Operating Model

Evidence has to be generated as AI operates, not reconstructed after someone asks for it.

Treat evidence generation as a standing requirement of the AI lifecycle rather than a scramble triggered by an audit notice or a subpoena. That means testing results, monitoring logs and escalation records are captured as a normal by-product of operating a system, in the same way financial controls generate an audit trail simply by being followed, rather than being assembled retroactively from memory and scattered files.

Fix accountability so it produces a record rather than an assumption. With only 21% of CEOs currently holding final AI deployment authority, most organisations need a named, senior owner whose sign-off is itself logged for each significant AI system, not a diffuse sense that "governance" collectively covers it. Build escalation pathways that log outcomes, not merely intentions: given that only 33% of organisations currently have defined escalation processes, the priority is not simply creating a channel but ensuring every escalation produces a timestamped record of what was raised, what was decided, and why.

Involve legal and compliance as a standing requirement rather than an occasional consultation, closing the gap between the 80% of organisations where IT drives governance and the 35% where legal and compliance are genuinely involved, since it is legal and compliance who best understand what a regulator or court will eventually ask to see. And treat every material model update as an event that requires fresh evidence of its own: a new version is, in evidentiary terms, a new system, and the assessment that justified the old one does not automatically transfer.

None of this requires slowing AI adoption. It requires building the habit of keeping the receipts, because Mobley v. Workday shows exactly what happens when an organisation is asked for them and does not have them ready.

06 · What Moving From Governance to Evidence Demands of Leadership

The evidence points toward five practical changes in how organisations should operationalise AI governance.

Ask "can we prove it," not just "do we have a policy." With only 22% of organisations confident they could produce governance evidence for a regulator or auditor, treat that question as the real measure of governance maturity, not the existence of a policy document.

Give accountability a paper trail. Only 21% of CEOs currently hold final AI deployment authority; name a senior owner for each significant AI system whose decisions are logged, not just assumed.

Make escalation produce a record, not just a channel. Fewer than one in three organisations has a defined escalation pathway today; every escalation should generate a timestamped account of what happened and how it was resolved.

Put legal and compliance inside the governance loop, not outside it. Closing the gap between 80% IT involvement and 35% legal and compliance involvement means the people who understand what a court or regulator will ask for are actually shaping what gets recorded.

Treat every material model change as a new evidentiary event. A model that has changed is not the model that was originally assessed, and the record needs to reflect that, as frameworks like NIST's AI RMF and ISO/IEC 42001 already require.

Conclusion

Governance that cannot produce evidence of itself is not yet governance. It is an intention, waiting to be tested.

Eighty-seven percent of organisations say they have AI governance. Only 22% say it actually works, and only 22% are confident they could prove it to a regulator tomorrow. Three-quarters of senior leaders doubt their organisation could survive an independent AI audit within 90 days. And in a federal courtroom right now, a case is testing precisely what evidence an AI system's operator needs to be able to produce when a consequential decision is challenged. These are not four unrelated data points. They are the same gap, measured from four different directions.

What closes that gap is not a better-written policy. It is building the habit of generating evidence as AI operates: named accountability that leaves a record, escalation that logs its own outcomes, legal and compliance embedded in the process rather than consulted after the fact, and every material model change treated as a fresh event requiring its own proof.

The organisations that move from governance to evidence will not be the ones with the most polished policy documents. They will be the ones that, when finally asked to show their work, actually can.

References & Sources

Research and evidence informing this whitepaper.

This whitepaper draws on governance benchmark surveys, established frameworks and active litigation. Statistics and case details are attributed to their originating source wherever directly cited.

AAA-ICDR Institute. From Principles to Practice: A Benchmark Study in AI Governance. May 2026.

Referenced for findings on the gap between AI governance policy and practice, audit-readiness confidence, escalation pathways and legal involvement.

View source

Grant Thornton. 2026 AI Impact Survey: A Widening "AI Proof Gap" Is Emerging. April 2026.

Referenced for findings on audit-readiness confidence, board governance oversight, and the correlation between AI governance maturity and reported revenue growth.

View source

ISACA. 2026 AI Pulse Poll.

Referenced for findings on formal AI policy adoption and the gap between AI usage and governance ROI confidence.

View source

Akin Gump Strauss Hauer & Feld. Court Allows Discrimination Claims Against AI Hiring Tool to Proceed: Mobley v. Workday, Inc.

Referenced for the status and legal theory of the ongoing Mobley v. Workday litigation in the US District Court for the Northern District of California.

View source

NIST. AI Risk Management Framework (AI RMF).

Referenced for the Govern function's documentation and traceability requirements underpinning what constitutes AI governance evidence.

View source

ISO. ISO/IEC 42001 Explained: What It Is.

Referenced for the scope and adoption context of the world's first international AI management system standard.

View source

Research sources were reviewed for relevance to the themes examined in this whitepaper. Survey findings reflect the populations, methodologies and reporting periods of their respective source publications. Details of Mobley v. Workday reflect its status as ongoing litigation at the time of writing; no final judgment on the merits has been reached, and readers should consult primary legal sources for current case status. This whitepaper is provided for general informational purposes and does not constitute legal advice.

Scroll