Most AI governance is theater (and what actually works)

I'll say the uncomfortable part out loud. Most of the AI policies I've seen aren't governance. They're theater.

They're written to look compliant, not to actually control anything. They satisfy an auditor, calm a board, and tick a box. Meanwhile the people who do the real work route around them every single day. The document sits in a shared drive. The behavior it was meant to shape never changes.

This isn't a people problem. Your team isn't reckless. They're trying to get their jobs done with the best tools available, and right now the best tools are an AI prompt away. The gap between what your policy says and what your people actually do is your real risk. And for most companies, that gap is enormous.

The policy nobody reads

Start with the numbers, because they're worse than most leaders think.

In ISACA's 2026 AI Pulse Poll of more than 3,400 digital trust professionals, 90% believe employees are already using AI in their organization. Only 38% say their company has a formal, comprehensive AI policy. A quarter have no active policy at all.

Read that again. Usage is already the norm. A real policy is still the exception.

It's not just a policy-on-paper problem either. In Microsoft's 2026 Work Trend Index, a survey of 20,000 knowledge workers across 10 countries, only one in four AI users surveyed (26%) say their leadership is clearly and consistently aligned on AI. When the rules are vague from the top, people fill the gap with whatever tool is fastest.

And the data is already moving. In Cyberhaven's 2026 AI Adoption and Risk Report, based on telemetry from 222 companies and roughly two million knowledge workers, 39.7% of all employee interactions with AI tools involve sensitive data. On average, that works out to once every three days per employee.

So the typical picture in 2026 is this: AI is embedded in daily work, formal policy is still missing or incomplete at most organizations, leadership alignment is thin, and sensitive data is already flowing into tools you may not have approved. A PDF in a shared drive isn't governance. It's a document that makes a board feel safe while the actual behavior runs unmanaged.

Why bans make it worse

The instinct, once a leader sees this, is to clamp down. Block the tools at the firewall. Send the stern email. Make an example of someone.

I understand the instinct. It's also the fastest way to lose the visibility you just gained.

When you ban a public tool, people don't go back to doing the work the slow way. They use their phone. A personal laptop. A quick paste at home. The usage doesn't disappear. Your ability to see it does. Cyberhaven's 2026 report found that about one-third of employees access AI tools through personal accounts, bypassing SSO, logging, and retention controls you thought were in place.

That's the trap with shadow AI. A ban feels like control. In practice it converts a visible, governable behavior into an invisible, ungovernable one. You've traded a problem you can manage for one you can't even see.

The goal was never zero AI. It's zero blind spots. And you don't get to zero blind spots by making honesty dangerous.

What actually works: discover before you govern

Here's the reframe I share with every security lead I talk to. You can't govern what you can't see, and you won't see anything if people think telling the truth gets them in trouble. So flip the usual order. Discovery first, policy last.

Real governance follows a simple arc.

Step 1 - Discover. Before you write a single rule, map how AI is actually being used. No names, no punishment, just a clear picture. Which tasks are people using AI for? What data gets pasted in? Which of that data is sensitive, proprietary, or regulated? Where does it go, and who can see it there? You're not hunting for someone to blame. You're looking for the two or three workflows where sensitive data is quietly walking out the door.

Step 2 - Secure. Now you can act on reality instead of guesswork. Set clear data boundaries with a simple red/amber/green list, the kind of thing a busy person can actually remember. Green is fine to use freely. Amber needs care. Red never goes into an external tool. Then stand up one sanctioned tool that's genuinely good, so people don't need the workaround in the first place. A short, clear list beats a 40-page policy nobody opens.

Step 3 - Govern. Only now do you write the lightweight rules. Name an owner, so it's somebody's job and not nobody's. Set outcome-based rules ("no client data in external tools") instead of brittle tool bans that are out of date the day you publish them. Review monthly, because the tools change monthly.

Notice the order. Most failed programs start at step 3, with a document. The ones that actually reduce risk start at step 1, with a map.

Run an amnesty, not a crackdown

The hardest part of discovery is human, not technical. People won't tell you how they really work if they think it'll get them disciplined.

So make a deal with them. Tell your team, plainly: "We know AI is being used here. We're not here to punish anyone. We want to understand how, so we can give you something safe and genuinely good to use." Then mean it.

When you run it as an amnesty, three things happen. People tell you the truth about how they actually work. You find the real risks instead of the imagined ones. And you build the trust you'll need later, when you do roll out guardrails. Fear drives behavior underground. Amnesty brings it into the light, where you can finally govern it.

You can't fix what people are afraid to admit.

The cost of getting it wrong

If this still sounds like a soft, nice-to-have exercise, look at what the invisible version costs.

Cyberhaven's 2026 telemetry found that 82% of the top 100 most-used GenAI apps in the workplace are classified as medium to critical risk. That is not a theoretical risk register. It is what your people are actually using while you are still debating the policy wording.

ISACA's 2026 poll adds another operational gap: 56% of digital trust professionals do not know how long it would take to halt an AI system after a security incident. If you cannot shut it down quickly, you cannot contain what leaked through it.

The reason this lands so hard is the same reason bans fail. When data moves through a tool nobody mapped, you don't know what left, where it went, or who can see it. You can't contain what you never mapped. The cheapest control here is also the most boring one: visibility. Find the usage, map the data, give people a safe path. That costs far less than cleaning up after the fact.

The honest version of AI governance

Stop writing documents nobody reads. Start mapping how work really gets done, then build guardrails around the real behavior instead of the behavior you wish you had.

That's the whole shift. Governance theater protects the board's feelings. Real governance protects the business. One is a PDF. The other is a habit: discover, secure, govern, and repeat as the tools change.

If you want a running start, I wrote up the no-blame discovery we use, including the seven questions to ask and the red/amber/green data list, as a free worksheet. You can grab it through our newsletter here.

And if you'd rather just talk it through, my DMs are open.