Category Archives: Leadership

Your AI Rollout Will Be Won or Lost One Layer Below the Steering Committee.

Posted on by

Most artificial intelligence (AI) steering committees open with the same two questions: how many licences, and by when? Both have tidy answers. What decides the outcome is whether any team works differently by spring.

That answer sits one floor down, with the people who run the Monday stand-up, approve the overtime and decide what good looks like on a Tuesday afternoon.

 

The gap the dashboard cannot see

The Stanford Digital Economy Lab spent five months studying 51 enterprise AI deployments for its Enterprise AI Playbook, published in April. Some organisations changed how work got done within weeks. Others took years with the same technology and the same use cases. The authors’ conclusion fits in two sentences: “The difference was never the AI model. It was always the organization.”

The AI at Work 2026 survey from Boston Consulting Group (BCG), covering 11,749 workers in 14 markets, shows where the organisation gets in the way. Regular frontline use has climbed to 74 per cent, up 23 points in a year. Yet 66 per cent of those saving time with AI say they get limited or no guidance on what to do with it, and 47 per cent now spend more time managing and directing AI than doing the work itself. BCG does not name an owner for that gap. It lands on the line manager, because nobody else decides how a team’s week is spent.

International Data Corporation (IDC) saw the same pattern coming. Its 2026 chief information officer predictions forecast that 40 per cent of organisations in Asia would miss their AI goals this year, with implementation complexity first on the list of causes.

 

Why the middle decides

Gleb Tsipursky’s September article in Harvard Business Review argues that generative AI initiatives often stall “not because of the board, vendors, or training, but because middle managers determine how AI is translated into day-to-day work.”

A sponsor can mandate access. Only a manager can decide that the weekly status report is now drafted by a model and checked by a person, that the review step moves earlier, and where the hour it saves gets spent.

Tsipursky sorts managers into five profiles: AI sceptics, wait-and-see traditionalists, cautious implementers, enthusiastic experimenters and AI catalysts. One training programme and one mandate will reach the catalysts, who needed neither. It will bounce off the sceptics, and they still run teams.

 

The case for a firm mandate

Some executives will argue that a top-down mandate is faster, and BCG’s data gives them half a point. Respondents in organisations with a clear AI strategy are 25 percentage points more likely to report measurable business impact. Strategy is set at the top. Yet better tools without strategy and redesign shift that figure by about five points, and companies pursuing workflow redesign are 24 points more likely to see measurable improvement. The mandate sets direction. A manager makes it pay.

 

Plan from the management layer up

Start the rollout plan with a map of your managers, before anyone counts licences. Profile each one against the five types using evidence you already hold, such as how they handled the last process change. The map shows where adoption will compound and where it will stall.

Write managers’ decision rights over workflow redesign into the programme governance, with a project management office (PMO) checkpoint asking one question each month: which workflow changed?

Measure changed workflows per team. Login counts tell you the tool is live. A redesigned approval path, a retired spreadsheet or a shorter handover tells you it is working.

Budget manager time as its own line. Redesigning a team’s work takes hours nobody has spare in the fourth quarter, and a training seat does not create them.

Then tailor the support. Sceptics move on evidence from a peer team. Wait-and-see traditionalists need a deadline and a safe first use case. Cautious implementers want guardrails written down. Experimenters and catalysts need permission, a small budget and someone to stop them redesigning teams that are not theirs.

Bring a different number

Take a different figure into the next steering committee: how many of your managers have redesigned one piece of their team’s work this quarter. If that question has no clear owner, start with Nobody Owns AI in Your Organisation.

If nobody in the room knows the number, you have found the first gap in the rollout plan.

The Setting Was Wrong for Ten Years. 2.15 Million People Paid For It.

Posted on by

Cloud misconfiguration accounted for 14 per cent of confirmed breaches globally in the first quarter of 2026, up from 9 per cent in 2024, according to security analysis built on Verizon’s Data Breach Investigations Report (DBIR). It has not overtaken vulnerability exploitation as the leading cause of breaches overall, but it is the fastest-growing technical vector in the data, and the gap between how many organisations use multiple clouds and how many can actually secure them consistently is the reason why.

 

An Old Problem Getting Worse, Not Better

More than three quarters of organisations now run multiple cloud providers, and 66 per cent of them say maintaining consistent security controls across those environments is genuinely difficult. Nearly a third of cloud resources go unmonitored entirely, carrying an average of 115 unpatched vulnerabilities each, and the average configuration issue sits undetected for around 180 days before anyone finds it. Multi-cloud strategy has become standard practice faster than the tooling and staffing needed to secure it consistently, and 45 per cent of organisations admit they simply do not have adequate staff for the challenge.

 

What This Actually Looks Like

The consequences are not hypothetical. One documented incident exposed personal data and location details for 2.15 million connected vehicle users, left publicly accessible for nearly a decade because of a single unaddressed misconfiguration. Another exposed 38 million personal records, names, emails and phone numbers, across 47 separate organisations, including government agencies, through one configuration error in shared enterprise software. Neither incident required a sophisticated attacker. Both required someone to notice a setting that had been wrong for years.

 

A Global Technical Problem, Uneven Regulatory Response

This is not a story about one cloud provider or one region. AWS, Azure and Google Cloud environments all appear in the underlying breach data, and the DBIR’s own methodology draws on incidents reported by law enforcement agencies and computer emergency response teams worldwide. The regulatory response so far is patchier than the problem. The US has moved furthest, with Cybersecurity and Infrastructure Security Agency (CISA) mandating federal agencies secure their cloud environments to a defined standard, but most jurisdictions still treat cloud misconfiguration as a subset of general data protection obligations rather than a distinct, named risk category with its own enforcement expectations.

 

What a PMO Should Actually Check

A technology steering committee reviewing cloud risk should ask a narrower, more useful question than whether cloud security policies exist. It should ask what percentage of cloud resources are actively monitored right now, how long a misconfiguration typically sits before detection in this specific environment, and whether that number has ever been measured at all. A policy document proves intent. It does not prove that a setting exposing 2.15 million users has not been sitting open for years. Multi-cloud strategy delivered real flexibility. The security discipline to match it is still, for most organisations, a work in progress rather than a finished job.

Your Data Might Already Be Stolen. Nobody Can Read It Yet.

Posted on by

Somewhere right now, encrypted data belonging to your organisation is very possibly being copied and stored by someone who cannot read it yet. That is the entire premise of harvest now, decrypt later, and two governments have just put binding migration deadlines around the assumption that this is already happening.

 

The Threat Nobody Can See Happening

Harvest now, decrypt later works in three stages: an adversary intercepts and stores encrypted traffic today, holds onto it, and waits for quantum computing to mature enough to break the encryption later. The NSA, CISA and NIST have all warned that this is already happening rather than a future scenario, with government communications, healthcare and genomic records, financial transaction histories and long-lived proprietary research flagged as the categories of data most exposed, precisely because their value does not expire when the encryption eventually does. The unsettling part is that an organisation has no way of knowing whether its own traffic has already been harvested. There is no breach notification for data that was quietly copied rather than stolen outright, years before anyone could do anything with it.

 

Two Governments, Two Deadlines, One Shared Conclusion

The United States moved first. NIST finalised its first post-quantum cryptography standards in August 2024, and the NSA’s CNSA 2.0 framework now requires quantum-safe algorithms on all new national security systems from January 2027, full application migration by 2030, and complete infrastructure migration by 2035. The UK’s National Cyber Security Centre published its own roadmap in March 2025, structured differently but arriving at the same endpoint: identify and plan by 2028, execute high-priority upgrades between 2028 and 2031, and complete migration across all systems, services and products by 2035. Two governments, working independently, converged on the same twenty-year horizon and the same conclusion that this cannot be left until quantum computers actually arrive.

 

Why the Slow Timeline Is the Argument, Not the Excuse

It would be easy to read a 2035 deadline as a reason to defer this for years. That reading gets the risk backwards. Cryptographic migration across a large organisation’s systems, vendors and data stores typically takes five to ten years to execute properly, which means an organisation starting its inventory and planning today is already working to a tight schedule against either government’s timeline, rather than a comfortable one. Industry analysts project the post-quantum cryptography market will exceed 15 billion dollars by 2030, and enterprises are being advised to allocate 2 to 5 per cent of annual security spend to migration over a four-year window. The bottleneck was never algorithm development. NIST has already published the standards. The bottleneck is inventory, sequencing and the unglamorous, multi-year discipline of finding every system that needs to change.

 

What a PMO Should Do With This Now

Post-quantum migration belongs on a technology roadmap as its own workstream, rather than folded quietly into general infrastructure refresh budgets where it will lose priority against anything more visible. The first deliverable is not a pilot project. It is an inventory: which systems, vendors and data categories carry encryption that needs to survive into the 2030s, ranked by how long that data needs to stay confidential. Anything meant to remain secret beyond 2030 is already, by definition, running on borrowed time.

98% Have an AI Governance Policy. Forty-Seven Per Cent Admit They Ignore It.

Posted on by

Ninety-eight per cent of large US companies now have a formal AI governance policy. Forty-seven per cent admit they have bypassed it anyway, whenever a deployment deadline mattered more than the process built to slow it down. That is not two different populations, careful firms and reckless ones. It is the same organisations, doing both, inside the same year.

The Survey Behind the Number

EY’s own research, published this month, surveyed 202 senior AI decision-makers, board members, C-suite executives and vice presidents, at US companies with revenue above one billion dollars. Alongside the 47% bypass figure, 91% of these organisations are already running agentic AI in pilots or full deployment, yet 49% have not updated their governance frameworks to address what autonomous agents actually do differently from the AI systems those frameworks were originally written for. Richard Jackson, EY Americas Assurance CTO, put the mismatch plainly to Dark Reading: organisations are applying yesterday’s governance rules to today’s interactions with AI.

 

The Number That Should Worry a Board More Than 47%

Thirty-nine per cent of companies using agentic AI have no defined owner for monitoring what those agents do once they are live. Eighty-five per cent admit their agentic systems take actions without real-time human oversight at all. Put those two figures together and the picture is a policy built for a slower, more supervised kind of AI, applied to a faster and more autonomous one it was never designed to cover, rather than a policy occasionally skipped through carelessness. Eighty-nine per cent encountered an AI-related risk in the past year, and 36% experienced an incident with material damage, lost data, financial cost or reputational harm.

 

Why the Bypass Keeps Happening

The instinct is to read a 47% bypass rate as a discipline problem and fix it with a stricter policy. EY’s John McLain, Americas Assurance Technology Risk AI Leader, frames the actual failure differently: the biggest agentic AI risk is that human oversight has not evolved at the same pace as the technology it is meant to supervise. Sixty-nine per cent of respondents say they lack the internal expertise to evolve their own governance controls, and 63% lack the capacity to implement or design them at all. A team asked to enforce a framework it does not have the expertise to update will eventually stop enforcing it, quietly, under deadline pressure, exactly as this survey found.

 

What a PMO Actually Owns Here

This is not a problem legal or a chief AI officer can solve by writing a better document. A policy nobody has the capacity to update, monitor or enforce at the point of decision is not governance, it is a filing exercise that happens to be 98% complete on paper. The PMO’s real job in this gap is smaller and more concrete than “AI governance”: name an owner for every agent already in production, build the bypass itself into the reporting line instead of pretending it does not happen, and treat the 39% accountability gap as a delivery risk to close this quarter, not a policy debate to revisit next year. Ninety-eight per cent of organisations already have the document. Almost half of them have already shown you it is not enough.

A Handbook in Washington, a Law in Singapore: The Governance Gap PMOs Actually Fill

Posted on by

Two documents delivered in 2026 that both claim to tell a board how to govern cyber risk. One is a handbook. The other is law. The distance between the two is where most PMOs currently sit, translating voluntary best practice into something a director can actually be held to.

The Handbook: Comprehensive, Voluntary, US-Focused

In April 2026, the National Association of Corporate Directors and the Internet Security Alliance released the fifth edition of the Director’s Handbook on Cyber-Risk Oversight. It is thorough. Six principles cover treating cyber security as a strategic risk, monitoring legal and disclosure exposure, building board oversight structures, adopting an enterprise risk framework, guiding measurement and reporting, and encouraging systemic resilience. It cites more than 600 million tracked cyberattacks a day and projected annual cybercrime losses approaching 20 trillion dollars globally. What it does not do, because it is guidance rather than statute, is compel a single board anywhere to act on any of it.

 

The Law: Narrower, Binding, and Personal

Singapore closed that gap for its own critical infrastructure operators in 2026 with an updated Cybersecurity Code of Practice. Boards of operators across eleven sectors, energy, telecommunications, water, healthcare, banking, aviation, maritime, government and more, must now maintain a documented resilience framework covering risk tolerance, mitigation, transfer and recovery, reviewed at least annually. Certification deadlines follow in December 2026 and December 2027. Directors can face personal liability where a company fails to prevent or properly respond to an incident because of a lack of the skill, care or diligence the role required. That is a materially different proposition from reading a handbook. It converts board oversight from a best-practice expectation into a standard a director can be judged against.

 

The Gap Between Them Is Where PMOs Live

Most organisations operating internationally will encounter both models at once, comprehensive American guidance describing what good oversight looks like, and a narrower but binding Asian regulatory standard describing what oversight is legally required to look like. Neither one, on its own, tells a PMO what to actually build. The handbook is too broad to implement directly. The code is too sector-specific to generalise from. The practical work, translating six abstract principles into a working reporting cadence, a named accountable owner, and evidence a board can point to if asked, sits squarely inside the PMO’s remit rather than the CISO’s alone or the board’s alone.

 

What a PMO Should Build From Both

A credible cyber governance structure borrows the handbook’s breadth and the code’s specificity. That means a documented framework reviewed at a fixed interval, not an annual slide nobody revisits, a named board-level owner who can answer for the organisation’s posture in plain language, and evidence, tested and dated, that oversight was real rather than assumed. Boards do not need another handbook to read. They need proof that what the last one said actually happened.

Four Countries, Four Health Systems, the Same Cyber Risk Tier

Posted on by

By August 2026, four European countries, Poland, the UK, France and Germany, had entered the critical tier of a healthcare cyber risk index covering 30 nations. France was still rebuilding more than 1,000 workstations and roughly 200 applications, five months after an October 2025 attack hit eight sites. Germany’s Unimed incident had disrupted care for more than 135,000 people across connected institutions. Every one of these countries has invested heavily in hospital cyber security. None of that investment, on its own, has been enough.

 

The Diagnosis Is Cultural, Not Technical

Research published by King’s College London in March 2026 offers a specific explanation for why. Reviewing NHS Trust cyber resilience, the researchers concluded that ransomware remains the most acute threat facing hospitals not primarily because of a technology gap, but because of inconsistent governance maturity and, more pointedly, a cultural rather than technical or financial constraint. Trusts with comparable budgets and comparable tooling still show wildly different resilience outcomes, which points toward leadership and accountability structures as the actual variable rather than the size of the security budget.

 

A Framework Built Around Ownership, Not Just Controls

The KCL research proposes what it calls a Cyber Leadership Framework, built on board-level ownership of cyber risk, an empowered CIO or CISO with real authority rather than a title, and a deliberate effort to connect technical controls to what actually happens in a ward or a clinic rather than treating cyber security as a parallel IT concern. Its most structurally significant recommendation is greater centralisation of core cyber capabilities and shared services across otherwise fragmented Trusts, replacing dozens of individually under-resourced security functions with fewer, better-resourced shared ones.

 

The Same Fragmentation Problem Shows Up Across Borders

That fragmentation is not a uniquely British problem. The Black Book Europe-30 Healthcare Cyber Risk Pressure Index, measuring attack pressure, clinical digital dependence, supplier concentration and recovery friction across 30 countries, found 13 of them sitting in the two highest risk bands, with Poland, the UK, France and Germany specifically flagged as critical. Each of these health systems is organised differently, some more centralised than the NHS, some more fragmented, and all four still ended up in the same risk category. Centralisation on its own is not a guaranteed fix. What the KCL research adds is the missing piece, shared capability paired with genuine board-level accountability, rather than shared capability alone.

 

What This Means for Healthcare Programme Governance

A healthcare PMO reviewing cyber resilience investment should treat the KCL framework as a diagnostic tool rather than an NHS-specific recommendation. The practical test is straightforward: can a board member currently name who owns cyber risk for their organisation, describe what shared capability actually exists beyond their own site, and point to when that capability was last tested under real pressure rather than reviewed on paper. France’s five-month rebuild and Germany’s 135,000-person incident both suggest that answering those questions honestly, before an attack rather than after one, is the entire point of the exercise.

One Token, Three Tools Deep, 2,500 Companies Across Five Continents

Posted on by

One leaked automation token. Three tools deep. Over 2,500 organisations across five continents exposed. That is the entire anatomy of 2026’s largest AI supply chain breach, and it took roughly forty minutes to happen.

How a Security Scanner Became the Weapon

In March 2026, a threat group tracked as TeamPCP compromised Trivy, a widely used open-source security scanner, through a leaked automation token. From there the attackers force-pushed malicious code into Trivy’s own version tags. When LiteLLM, a popular AI gateway that routes traffic between applications and model providers, pulled the poisoned scanner into its build pipeline, it published two compromised releases to PyPI, versions 1.82.7 and 1.82.8. A hidden file inside those packages executed automatically the moment Python started, no import required, harvesting cloud keys, repository tokens, SSH credentials, Kubernetes secrets and AI provider API keys from anyone who installed it. The malicious packages were live for roughly forty minutes before removal. That was enough.

 

A Genuinely Global Exposure List

CloudSEK’s analysis, later corroborated by an FBI advisory in July, identified more than 2,500 affected organisations and 434,000 exposed CI/CD pipelines. The named companies span the world rather than one region: AWS, Nvidia, Salesforce and Airbus’s US Space and Defense division from the US, Samsung Electronics and MediaTek from Asia, Siemens, Volkswagen and Munich Re from Germany, Thales and Orange from France, Roche from Switzerland, Philips from the Netherlands, Vodafone and the London Stock Exchange Group from the UK, and Thomson Reuters from Canada, alongside Cisco, FedEx, Deloitte and dozens more. This was never a story about one country’s technology sector. It was a demonstration of how deeply a single open-source dependency now sits underneath enterprise infrastructure everywhere.

 

The Same Argument, a Different Layer

This publication has already made the case that The September AI Outage Had Two Real Causes. Almost Everyone Reported One. LiteLLM extends that argument one layer deeper, into the software supply chain feeding the infrastructure itself. A vendor risk register that lists which cloud provider or model vendor an organisation depends on is no longer sufficient. It also needs to account for the open-source scanners, build tools and CI pipelines every one of those vendors quietly depends on, tools most procurement processes never ask about because nobody signed a contract for them.

 

What a PMO Should Actually Check

Three questions belong on every technology steering committee agenda this quarter. First, does anyone in the organisation maintain a current list of the open-source build and security tooling embedded in critical CI/CD pipelines, not just the paid vendors. Second, when was a leaked or rotated credential last tested as an actual incident scenario, rather than a line item in a policy document. Third, if a dependency three layers removed from a primary vendor were compromised tomorrow, how long would it take anyone to notice. The organisations named in the LiteLLM breach were not careless. They were exposed by a dependency most of them did not know they had, which is precisely the risk a vendor register built only around visible, contracted suppliers will always miss.

The September AI Outage Had Two Real Causes. Almost Everyone Reported One.

Posted on by

On the morning of 3 September 2026, ChatGPT, Claude and Grok all failed within roughly ninety minutes of each other. Within hours, most coverage had settled on a single explanation: a shared Microsoft Azure failure had taken down three competing AI platforms at once. The postmortems that actually exist tell a different story, and the difference matters more than the outage itself.

 

What Each Company Actually Said

SpaceXAI was the most direct. The company confirmed a failure at its Memphis compute facility, apologising to what it called its “impacted compute partners,” language that implies other organisations lease capacity in the same facility. Grok was down for roughly three and a half hours. OpenAI gave its own, separate explanation: an engineer identifying as the incident commander stated on Hacker News that the cause was a routing error inside OpenAI’s own infrastructure, surfacing roughly ninety minutes after SpaceXAI’s Memphis failure and unconnected to the GPT-6 Astra launch that followed the next day. Anthropic never published a technical cause at all. It confirmed elevated errors across several Claude models starting around 9:26am ET and reported the issue resolved, but the actual mechanism behind it was never disclosed.

 

Why the Azure Theory Doesn’t Hold Up

The Azure theory spread fast because it was the simplest explanation available in the first few hours, and it fit an existing assumption that most enterprise AI risk registers already carry: if these vendors compete, their infrastructure probably doesn’t overlap. It did not hold up. Microsoft logged no Azure incident for that window, and Cloudflare said in a statement that it was not experiencing any significant service disruptions. The timeline argues against one shared trigger too, SpaceXAI’s and Anthropic’s incidents began four minutes apart from each other, and OpenAI’s followed roughly ninety minutes later, a pattern that fits three separate incidents more comfortably than one shared one.

 

The Question Nobody Answered

The part worth noticing is not that the Azure story was wrong. It is that the two companies which did give an explanation gave two different ones, and the one that stayed quiet is the one whose incident opened four minutes before SpaceXAI’s, the tightest timing overlap of the three. Nobody, including Anthropic, ever confirmed or ruled out whether Claude’s infrastructure touches the same Memphis facility SpaceXAI apologised to its partners about. A vendor risk register cannot verify a question its own vendor never answers.

None of this means multi-vendor AI strategy is worthless. It means the diversification most risk registers assume is rarely something a customer can actually verify from the outside, and the one moment it gets tested, a real outage, is also the moment vendors are least likely to disclose the detail that would let you check. Two of three companies gave a specific, different cause. One gave none. Whichever of those a programme is depending on, the honest entry in a vendor risk register reads “unconfirmed,” not “diversified.”

Three Regulators, Three Continents, One 72-Hour Deadline Nobody Is Ready For

Posted on by

Three regulators, on three different continents, converged on almost the same number this year, entirely independently. Washington set 72 hours. Brussels set 72 hours, after an initial 24-hour early warning. Abu Dhabi’s own financial free zones set 24 to 72 hours, depending on which one is asking. None of them coordinated on this. All three concluded, at roughly the same time, that a cyber incident report cannot wait for an organisation to feel ready to send it.

 

What Each Regime Actually Requires

In the United States, the Cyber Incident Reporting for Critical Infrastructure Act, CIRCIA, is expected to be finalised this month. It will require covered entities across 16 critical infrastructure sectors, an estimated 300,000 organisations in total, to report a significant cyber incident within 72 hours and a ransomware payment within 24. In the European Union, the NIS2 Directive is already live. Essential entities, those with 250 or more staff or turnover above 50 million euros, across energy, healthcare, banking, water and digital infrastructure, must send an early warning within 24 hours, a full assessment within 72, and a final report within a month. In the UAE, the pattern repeats at the free zone level. Firms regulated by Abu Dhabi Global Market must report a material cyber incident to the regulator within 24 hours, weekends and public holidays included. Firms in the Dubai International Financial Centre generally work to a 72-hour window. Three jurisdictions, three legal systems, the same rough number.

 

Why This Is a Delivery Problem, Not a Legal One

Most organisations have handed this requirement to legal or compliance to interpret, which is the wrong owner. A 72-hour reporting deadline is not primarily a question of what the law says. It is a question of whether an organisation can detect an incident, assess its materiality, assemble the right people, and produce an accurate report, all inside three days, under pressure, without the benefit of hindsight. That is a programme capability, not a policy position. Legal can tell you what the deadline is. Legal cannot build the operating rhythm that hits it.

 

The Capability Most Organisations Are Missing

The gap rarely shows up in the reporting template. It shows up upstream, in whether anyone can say, inside the first few hours, what actually happened. A US hospital system’s own social media accounts were hijacked by the ransomware group that had already breached it, which posted ransom demands directly to the public before the organisation regained control, a case study in how quickly a slow, uncoordinated response becomes the story itself. A reporting deadline assumes an organisation already knows what it is looking at. Most of the work that determines whether a report is accurate, or even possible, happens before anyone opens the compliance template.

 

What a Real Programme Looks Like

A credible response to any of these three regimes looks less like a legal memo and more like a programme: a named incident commander, a materiality assessment framework agreed before an incident rather than during one, a communications protocol that assumes attackers may control channels an organisation thinks are its own, and a rehearsal cadence, not a policy filed away and never tested. None of that is jurisdiction-specific. An organisation that builds this properly for NIS2 has, with minor adjustment, built it for CIRCIA and for ADGM as well.

The interesting part of this story is not which country moved first. Three regulators, working independently on three continents, arrived at the same conclusion, that organisations cannot be trusted to disclose on their own timeline, so a timeline was imposed. Whichever regime applies, the question worth asking this quarter is simple. Could the organisation hit the deadline today, if the incident happened this afternoon?

Your AI Steering Committee Meets Monthly. Your AI Ships Weekly.

Posted on by

Most AI governance committees meet on a monthly or quarterly cadence. Most AI systems do not wait for them.

Anthropic’s own release notes tell the story in a single scroll. Opus 5 launched in late July 2026, a step-change release over Opus 4.8, which was barely two months old at the time. Sonnet 5 landed a month before that, at the end of June. Opus 4.8 before that, in late May. Opus 4.7 before that, in April, with breaking API changes attached. Opus 4.5 in November 2025. Sonnet 4.5 in September. Six major model versions inside ten months, with incremental API and feature changes logged in between on a near-weekly basis. That is one vendor’s changelog. Most enterprises are running several.

 

The Governance Side Has Not Kept Pace

Deloitte’s 2026 State of AI in the Enterprise survey, covering 3,235 business and IT leaders across 24 countries, found that only 21% of organisations have a mature governance model in place for agentic AI. Meanwhile, 74% of the same leaders expect their organisation to be using AI agents at least moderately by 2027, with 23% expecting extensive use and 5% expecting full integration.

That is not a small gap closing gradually. It is deployment intent running well ahead of the governance capable of managing it, at the exact moment agentic systems are gaining the authority to act rather than just draft.

 

People Have Already Stopped Waiting

The gap does not sit quietly while committees catch up. A Cybernews survey of more than 1,000 US employees found that 59% use AI tools their employer never approved. Among executives and senior managers specifically, the same survey found 93% do the same. The people who would sit on the steering committee approving AI use are, by a wide margin, the people going around it.

That is the quiet part of this problem. The people with the authority to slow things down are the ones setting the pace of the tools rather than the pace of the committee.

 

What Happens When the Gap Surfaces

Gartner’s prediction for next year is specific: 40% of enterprises will have their autonomous AI efforts partly derailed by governance gaps discovered only after a production incident, not before one. Sanchit Vir Gogia of Greyhound Research, commenting on the same data, put the mechanism plainly: “the real governance problem is not model intelligence. It is delegated operational authority moving across trust boundaries faster than enterprises can instrument, constrain, or audit it.” His own warning, in his words: “Do not scale agents faster than you can govern their authority. A small number of well-governed agents will create more enterprise value than a sprawling estate of clever, fragile, over-permissioned digital apprentices.”

 

What Governance Cadence Actually Needs to Look Like

The fix is not more meetings. A committee that reviews AI deployment quarterly cannot govern a system that changes weekly, no matter how thorough each quarterly review is. What changes the equation is moving from periodic review to continuous, tiered oversight: automatic flags for any new agent or capability change above an agreed risk threshold, standing authority delegated to a smaller operational group empowered to act between full committee meetings, and a real audit trail that lets the full committee review what was approved at pace, after the fact, rather than approving everything before the fact and creating the exact bottleneck this problem describes.

Keeping oversight in place does not mean keeping the quarterly cadence that was designed for a technology that no longer exists.

 

The Question Worth Asking Before the Next Steering Committee Meeting

Ask what actually changed in your AI environment since the last meeting, specifically, not generally. If nobody in the room can answer that with real detail, the governance structure is reviewing a snapshot that was already out of date the moment the meeting started.

The organisations that get this right are not the ones meeting more often. They are the ones who redesigned what needs a meeting at all, and gave someone standing authority to handle everything else in between.