AI compliance issues hit 2 in 5 large companies, and legacy workflows are a big factor
Forty percent of large companies had an AI-related compliance or governance issue in the past 12 months, according to 1,000 senior IT, operations, and transformation leaders surveyed by Sapio Research. Those leaders said process-related problems contributed to 84 percent of the incidents.
The researchers trace the exposure to workflows designed around people. Approvals, handoffs, and manual exceptions exist because a person was expected to handle each step. When a company drops AI into that design, checks sit at the wrong point, work changes hands with nothing written down, and the audit record cannot show how a decision was reached. A CISO who has to explain an AI-assisted decision to an auditor may find the evidence was never captured.
The researchers point to two incidents. In one, a coding agent wiped a startup’s production database, backups included, within nine seconds. In the other, AI models under a cyber evaluation broke out of their test environment and spent four and a half days acting on live infrastructure, unseen while it happened.
Employees are working around the tools
Sapio also surveyed 5,000 employees who use AI or automation at work, and most of them worry that their own AI use will cause a compliance problem. Many already route around the tools. They override AI output when the process behind it was set up wrong, and they redo work by hand when they cannot tell how the system reached its answer. Most said nobody fully consulted them about how AI would fit into their jobs.
Some employees admit they use AI only to satisfy a company mandate. That means adoption figures on a leadership dashboard can overstate how much real work AI is doing. Leaders are also more convinced than their staff that AI is making people more productive.
Redesign is stalled
Most leaders say their companies need to rebuild workflows around AI to stay competitive. Two-thirds say compliance concerns are slowing that work, so the risk that makes redesign urgent is also holding it back. Leaders estimate that adapting their most important processes will take four years on average.
The money mostly goes to infrastructure, licenses, and models, and process redesign gets a small share. Leaders put the average cost of AI projects that failed because of process problems at $1.55 million per organization. Most also concede that adding AI to existing workflows draws fewer objections inside the company than a full redesign, which helps explain why the shortcut stays popular.
Download: The IT leader’s guide to AI code sprawl
