Challenges loom as AI governance struggles to keep pace

As artificial intelligence continues to be integrated into organisational frameworks, the gap between adoption and governance is becoming more evident. According to a recent study by ShareGate, 29% of organisations have unintentionally exposed sensitive data through the use of AI tools. At the same time, nearly 93% of IT and security leaders report confidence in their Microsoft 365 governance capabilities to manage AI responsibly. This raises questions about whether confidence levels align fully with existing governance realities and potential blind spots.

The types of data unintentionally exposed include customer records (36%), sensitive internal documents (31%), personal data and PII (30%), HR records (30%), financial data (25%), and proprietary intellectual property (21%). Despite these figures, only 51% of organisations have completed a comprehensive governance review since the introduction of tools such as Microsoft 365 Copilot.

Governance teams are also experiencing increased workload pressures. Over 70% report that AI has increased their governance responsibilities, while nearly 80% express moderate concern about AI accessing information that has not recently been reviewed for permissions. The pace of AI development relative to governance processes may increase the risk of exposure to sensitive information that is not fully monitored or controlled.

Rather than creating new governance challenges, AI tools such as Copilot are highlighting existing limitations within organisational systems. In many cases, they make it more visible when information management practices are inconsistent or when visibility over data access is limited.

From a financial perspective, AI-related costs are becoming a more significant part of IT budgets. Over 80% of respondents expect notable returns from their Microsoft 365 AI investments within the next 18 months. However, without effective governance structures, achieving these returns may be more difficult.

Governance activities such as permission audits, data cleanup, and lifecycle management are increasingly viewed as important to successful AI adoption. As a result, many organisations are exploring external support, with around eight in ten considering collaboration with third-party partners for AI governance assessments before expanding deployment.

Overall, organisations are operating in a period where innovation and security considerations must be balanced. This requires ongoing review of governance frameworks to ensure that the benefits of AI can be realised while maintaining appropriate oversight of data and systems.