AI adoption isn’t slowing down. It’s accelerating, quietly, unevenly, and often outside formal control.

To separate assumption from reality, CultureAI commissioned an independent research study of 

300 senior technology, security, and risk leaders across North America and Europe

. Respondents included CISOs, CIOs, CTOs, Data Protection Officers, and senior IT and security leaders across finance, healthcare, technology, legal, and professional services.

What we found is clear: most organisations are operating on outdated assumptions about AI usage. And those assumptions are creating risk.

Below are the five biggest myths exposed by the data.

 AI adoption is slowing — there's time to prepare.

AI usage is increasing, not plateauing. Over 

 of organisations expect AI adoption to grow in the next 12 months, with 

 anticipating significant growth. AI is expanding across departments and embedding itself into everyday SaaS workflows.

Risk scales with usage. Governance programmes that move slowly while adoption accelerates create widening exposure gaps. Waiting to “finalise policy” before implementing operational controls allows sensitive data to flow into AI tools without oversight.

 of organisations report widespread AI use across teams, while only

 describe it as highly restricted or banned. The majority of enterprises are well past experimentation.

Heavy restrictions often drive usage underground. Employees adopt personal accounts or unsanctioned tools, reducing visibility rather than reducing risk. The challenge is no longer whether to allow AI — it is how to enable it safely and measurably.

The highest levels of AI usage are in data analysis, software development, and customer support — functions that routinely handle sensitive customer data, proprietary code, and strategic information.

AI risk is embedded in high-impact workflows. The exposure includes intellectual property, regulated data, and business-critical insight. As AI becomes integral to production environments, the potential blast radius increases.

 We already have strong visibility and controls.

 of leaders claim full visibility into AI usage, 

 have identified shadow AI within their organisations. Embedded AI features, personal accounts, and long-tail SaaS tools remain difficult to monitor with traditional controls.

Approved application lists and proxy logs do not equate to true AI usage visibility. Traditional DLP and CASB solutions were not designed to interpret prompts or behavioural intent. Blind spots persist — and incidents typically originate in those blind spots.

Compliance and privacy are top concerns, and most organisations express confidence in their regulatory posture. However, many acknowledge that policies are not actively enforced, and detection of sensitive data leakage is only partial.

Governance documentation alone does not constitute control. Regulators and customers increasingly expect demonstrable enforcement, auditability, and measurable oversight. Confidence without operational proof creates regulatory and reputational risk.

Across all findings, adoption is advancing faster than enforcement maturity. AI is widespread, embedded, and growing - yet visibility remains fragmented and controls are inconsistent.

The next phase of enterprise AI is not about debating adoption. It is about operationalising governance through measurable, real-time oversight.

book

In March 2026, CultureAI releases new research: 

The State of Enterprise AI Usage Control — and the Illusion of Control.

300 senior leaders in regulated industries

, this report explores enforcement maturity, sector-specific trends, and regulatory readiness in greater depth. 

 AI usage is already happening at scale. The question is whether it is visible, controlled, and provably compliant.

CultureAI commissioned an independent research study of 300 senior technology, security, and risk leaders across North America and Europe. Respondents included CISOs, CIOs, CTOs, Data Protection Officers, and senior IT and security leaders across finance, healthcare, technology, legal, and professional services.

Below are the five biggest myths exposed by the data.

5 AI Myths Exposing the Governance Gap

Recommended for you

But Control Over Data and IP Is Still Catching Up

Why Legal AI Governance Must Operate at the Point of Use

The Beginning of a New Norm