The 55-point gap between what executives believe about AI usage and what employees actually do
Executives report near-complete visibility into AI usage. Employees report something very different. The gap is now measurable, and it is the governance problem underneath most AI compliance failures.
The number that should concern every board
In May 2026, The Register reported a finding that deserves more attention than it received. Seventy-eight percent of executives said they had a clear picture of how AI was being used inside their organisation. When employees at those same organisations were surveyed, only twenty-three percent agreed that leadership understood what was actually happening.
That is a fifty-five point gap between belief and reality, and it is the distance between the governance posture a company describes in its board papers and the one it actually has.
Most compliance frameworks assume the people signing off on controls know what those controls are meant to cover. A gap this size breaks that assumption at the foundation. If leadership cannot describe which AI systems are in use, by whom, and against what data, every downstream control is being applied to an inventory that does not match the real one.
The detection data agrees with the employees
The gap is not only a matter of perception. Network telemetry tells the same story from a different direction. The Verizon 2026 Data Breach Investigations Report found that shadow AI detections quadrupled year on year, meaning AI tools reaching corporate data or networks without passing through any procurement, security review, or governance process. A fourfold increase in a single year is not gradual drift. It is a structural change in how work gets done, happening faster than the control environment can adapt.
Detections are also a floor rather than a ceiling. They capture only usage that crossed a monitored boundary. Activity on personal devices, personal accounts, or browser sessions that never touched a monitored egress point does not appear in the count at all.
Employees are candid about it when asked
The PagerDuty 2026 Shadow AI Survey put the question directly to office professionals. Sixty-six percent admitted using AI tools in ways that contravened their company's stated policy, and more than a third said they had entered customer data into public models.
A two-thirds breach rate is not a discipline problem or a training gap. When a rule is broken by two out of every three people subject to it, the rule has ceased to function as a control. The customer data finding carries the sharper regulatory edge: depending on jurisdiction and data type, that is potentially a disclosure to a third party without a lawful basis, a breach of contractual data handling commitments, and a transfer no data processing agreement covers. It happens in seconds and leaves no procurement trail.
Why the policy is not the control
Most AI governance programmes assume that writing the policy is the substantive act and that adherence follows. The 2026 data does not support it.
Governance is what your people actually do, not what your policy says they do. A policy contradicted by two thirds of the workforce documents an intention, not a control. When a regulator, an enterprise customer, or an insurer asks what governs AI use in your organisation, the honest answer is whatever your employees are doing this week, because that is the behaviour generating the risk.
The EU AI Act, ISO 42001, and NIST AI RMF all require organisations to know what AI systems they operate and in what context. An inventory built from a policy most of the organisation ignores will not survive scrutiny. One built from what is actually running will.
Visibility is the first control, and it has to be documented
The answer to a fifty-five point visibility gap is not a stricter policy, since the evidence suggests stricter policies are already being disregarded at scale. Nor is it a blanket prohibition, which historically drives usage further out of view rather than reducing it.
The answer is documented visibility. Establish what is actually in use, record it, and assess it against the frameworks that apply to your business. Every other control depends on this one. Access management, vendor review, data classification, human oversight, and incident response all require knowing which systems are in scope. Without that, they are applied to a fiction.
A board that can produce a current AI inventory with an assessment against EU AI Act, NIST AI RMF, ISO 42001, and SOC 2 requirements is demonstrating governance. A board that can produce only a policy is demonstrating intent, and the 2026 data makes clear how far intent sits from practice. The organisations that close this gap will not be the ones with the strongest policy language. They will be the ones that took an honest inventory first and built controls on top of what they found.