AI Governance Is a Hiring Problem

Most organisations have written the policy, but far fewer have the people to run it.

AI governance is becoming less about whether an organisation has a policy and more about whether it has the people and capability to put that policy into practice. As AI moves further into business-critical processes, organisations need people who can own controls, monitor risk, provide evidence, and adapt governance as technology and regulation change.

That makes AI governance a hiring and resourcing question as much as a policy question. For risk, security, data, and technology leaders, the question is increasingly whether the organisation has the right capability around AI, not simply whether the right document exists.

EY's September 2026 survey of 202 senior AI decision-makers at US public companies with at least $1bn in annual revenue found that 98% had formal AI governance policies in place, yet 69% were concerned about having enough internal expertise to evolve their governance controls. (EY)

What AI governance means in practice

AI governance is the framework an organisation uses to make sure AI is being developed and used responsibly, safely, and in line with its obligations.

In practice, that goes well beyond writing a policy.

Someone needs to own the controls. Teams need to know what is being monitored and what evidence needs to be retained. There needs to be a clear process for assessing new AI use cases, managing access and data, responding to incidents, and reviewing systems as they change. Governance also needs to keep pace with new forms of AI, including increasingly autonomous and agentic systems.

This is where the difference between having a governance framework and operating one becomes important. A policy can set out what should happen. People are needed to make sure it actually does.

The gap between policy and practice

Recent research points to a consistent gap between governance on paper and governance in operation, although the findings need to be considered in context.

ISACA's May 2026 AI Pulse Poll surveyed more than 3,400 digital trust professionals globally. It found that 38% of organisations had a formal, comprehensive AI policy, up from 28% in 2025. At the same time, 56% said they did not know how long it would take to halt an AI system following a security incident, and 39% did not know whether their organisation had a documented process for shutting down or overriding AI systems. (ISACA)

EY's research paints a different picture because its sample was much narrower: 202 senior AI decision-makers at US publicly traded companies generating at least $1bn in annual revenue. In that group, 98% reported having formal AI governance policies. Yet 47% said their organisation had previously bypassed its governance process for an urgent deployment, and 69% were concerned about a lack of internal expertise to evolve their controls. (EY)

Senior AI decision-makers at US public companies with $1bn+ revenue. Source: EY AI Risk and Governance Survey, September 2026.

The two studies are not directly comparable. One looks at a global population of digital trust professionals, while the other focuses on senior AI decision-makers at large US public companies.

What they do point towards is the same broader issue: governance frameworks are developing, but the capability needed to operate and evolve them is not always keeping pace.

That becomes even more important as organisations move from experimentation towards AI systems that can take actions with less human intervention. EY found that 91% of respondents said their organisation was using agentic AI in pilots or enterprise deployment and, among those organisations, 85% said at least some agentic systems were executing actions without real-time human involvement. (EY)

Does a later EU deadline change anything?

The timeline for parts of the EU AI Act has changed, but the need to build the right capability has not.

The EU AI Omnibus entered into force on 27 July 2026 and extended the application date for certain high-risk AI systems covered by Annex III to 2 December 2027. (European Commission)

For organisations affected by those requirements, that provides more time to prepare. It does not necessarily make preparation easier.

Hiring specialist people, developing internal expertise, and establishing effective operating models all take time. Waiting for a regulatory deadline before working out who owns AI risk, how controls will be operated, or where the capability gaps sit can leave organisations trying to build that expertise under pressure.

Where the work sits across the organisation

AI governance does not sit neatly within one team.

For ROC, the focus is on control ownership, governance, evidence, risk, and regulatory change. Security has a role in areas such as access, shadow AI, cyber risk, and incident response. Data brings the questions around data ownership, lineage, quality, and how information is being used by AI systems.

Engineering is responsible for building controls into the technology itself, while Change & Transformation has an important role in how new AI capabilities are introduced across the organisation and embedded into operating models.

That means the hiring requirement can look very different from one organisation to another. One business may need additional governance capability. Another may have the governance expertise but lack the security or data capability needed to support it. In some cases, the requirement may span several functions rather than sitting within one dedicated AI governance role.

The hiring question is bigger than one AI governance role

There is a temptation to treat AI governance as a new job title.

In reality, the capability required can sit across several existing functions and may change as an organisation's AI use matures.

A business introducing its first AI systems may need to establish ownership, controls, and processes before it needs a large permanent governance function. Another organisation already operating AI at scale may need deeper expertise across risk, security, data, or assurance.

The reporting line matters too. If nobody is clearly accountable for AI governance, adding another specialist can simply create another layer around an unclear operating model.

The starting point should therefore be understanding what the organisation is actually trying to govern, where responsibility currently sits, and where the gaps are.

What leaders should do now

A useful starting point is to map where AI is already being used across the organisation rather than looking only at formally approved projects.

From there, leaders can identify who owns each use case, where evidence and controls currently sit, and where there are gaps in capability. That gives a much clearer basis for deciding what needs to be built internally and where additional expertise is needed.

That expertise might come through permanent hiring, contract specialists, an embedded talent model, or consultancy, depending on the stage and scale of the requirement.

The important thing is that the resourcing decision follows the operating model rather than the other way around.

AI governance needs people behind it

AI governance is moving into a different phase. The question is increasingly less about whether organisations understand that governance is necessary and more about whether they have the people, structures, and expertise to operate it as AI becomes more embedded in the business.

For organisations building those capabilities now, the hiring plan needs to look beyond a single AI governance job description. Risk, security, data, engineering, and transformation all have a role to play, and the right mix will depend on how AI is actually being used.

The UK is also continuing to develop its wider resilience requirements. The Cyber Security and Resilience Bill is currently scheduled for Report Stage in the House of Lords on 26 October 2026, although future dates can be provisional. (UK Parliament)

As regulation develops and AI adoption continues, we'll be watching how organisations are adapting their teams and operating models alongside it.