The AI Control Gap is already here

For the past two years, the AI conversation has largely been about adoption: who is experimenting, who is investing, who is building agents, and who will move first.

That conversation is now changing.

The harder question is no longer whether organisations will use AI. They already are.

The question is whether anyone can still see what is happening.

New global research from Dataiku and IBM makes this painfully clear. Dataiku’s 2026 CIO survey found that 84% of CIOs believe employees are creating AI agents and applications faster than IT can govern them. Eighty-one percent lack complete oversight of agents created outside approved systems or formal channels. IBM found the same pattern at greater scale: 70% of technology leaders say business teams deploy technology faster than IT can track, while 77% say AI adoption is already moving faster than governance capabilities.

That is the AI control gap.

It is not a future risk. It is already inside most large organisations.

The real problem is not AI adoption

I meet CIOs, compliance officers and public-sector leaders who believe they have a reasonably good handle on AI use in their organisation.

They know the approved tools. They know the sanctioned pilot projects. They know which vendors have been through procurement and security assessment.

Then we look more closely.

The number of AI tools actually being used is often three to five times higher than expected. Consumer tools. Personal accounts. AI assistants embedded in software that nobody has classified as AI. Models brought in through business units, consultants, developers or individual employees trying to get their work done faster.

Sensitive data is flowing into systems that IT, legal and security teams have never assessed.

This is what we call shadow AI. And it is no longer a fringe phenomenon.

Orbus Software’s 2026 survey of 500 CIOs found that 78% struggle with shadow AI and 98% lack visibility into its technical and business risks.

That should concern every organisation handling citizen data, patient records, financial information, trade secrets, defence-related material or critical infrastructure.

Because you cannot govern what you cannot see.

AI agents change the risk profile

Traditional software does what it is programmed to do. AI agents are different.

They can interpret instructions, access systems, retrieve information, make recommendations, trigger workflows and increasingly take actions across multiple systems. The risk is not merely that an employee enters information into the wrong chatbot. The risk is that an autonomous or semi-autonomous system acts on incomplete, incorrect or sensitive information at scale.

IBM reports that surveyed organisations experienced an average of 54 AI-agent incidents in the previous year. Of those incidents, 37% involved data exposure or security breaches, 33% caused cascading system failures, and 17% triggered compliance issues.

This is why the old governance model is not enough.

A policy document on an intranet does not show which tools are in use. A quarterly risk review does not detect an unsanctioned agent connected to a business workflow. A manual inventory does not stay current when teams can create and deploy AI tools in days.

AI governance has to become operational.

It must work continuously, across models, platforms, teams and data environments.

Visibility comes before governance

Many organisations respond to shadow AI by trying to lock everything down. Block public tools. Restrict access. Demand central approval for every experiment.

That is understandable. It is also rarely effective.

Employees use unauthorised AI because the approved alternative is too slow, too limited or unavailable. If the official route cannot meet a real business need, people will find another route.

The answer is not to ban AI. It is to make approved AI the easiest and most useful option.

Dataiku’s findings support this. Ninety-one percent of CIOs say the most effective strategy is not to centralise every application or agent, but to allow business teams to build within a governed environment. 

That is the right model: distributed innovation, governed execution.

But it only works if the organisation can answer basic questions in near real time:

• Which AI tools, models and agents are being used?
• Who owns them?
• What data do they access, process or send outside the organisation?
• Which systems can they connect to?
• What decisions or actions can they influence?
• Where is human oversight required?
• How are they monitored, changed, paused or retired?
• Can the organisation explain their business value and risk?

Without those answers, governance is simply assumption with better formatting.

Control has to be designed in

IBM’s research makes an important point that many leaders still miss: control and speed are not opposites.

Organisations that build control directly into AI systems report 25% fewer incidents than those relying on manual governance. IBM’s analysis also found that organisations with embedded control deploy 16 times more AI agents, achieve 18% higher operating margins and spend four times less of their AI budgets.

This is not surprising.

When teams have clear guardrails, known data boundaries, accessible approved models and a simple route to deployment, they can move faster. Security, governance and architecture become the foundations for scale, not obstacles to it.

At 2021.AI, this is the principle behind GRACE AI Security.

The objective is not to slow down AI adoption. It is to give organisations the visibility and controls needed to accelerate responsibly:

• AI Auto Registry identifies and maintains an inventory of AI systems, models and use cases.
• Gatekeeper Agent helps detect shadow AI and unapproved tools.
• Chat Guardian can prevent sensitive data from reaching unapproved models.
• AI Gateway enables controlled access to approved AI services and models.

The aim is straightforward: make the right route fast enough that people do not need to work around it.

The leadership test

The pressure on CIOs is now obvious. Dataiku found that 72% cannot consistently measure whether all their agents are delivering intended business outcomes. Seventy-six percent believe their role will be at risk if their company fails to show measurable AI gains by the end of 2027.

But this is not only a CIO issue.

It is a board issue. A CEO issue. A public-sector leadership issue.

Every organisation needs to decide whether it wants AI to spread organically through tools it cannot see, data it cannot control and agents it cannot stop, or whether it wants to create a governed environment where innovation can scale safely.

The first step is not another strategy presentation.

It is visibility.

You cannot reserve human judgment for the decisions that matter if you do not know where the machines have already taken over.