There’s a pattern I see repeatedly.
A company shows me their AI governance framework. Glossy presentation. Ethical principles. Risk assessment templates. A committee that meets quarterly.
Then I ask three questions:
- When was the last time this framework stopped an AI deployment?
- Who has the authority to kill a model in production?
- What happened the last time an AI system produced a biased output?
Silence.
That’s not governance. That’s theater!
83% of companies use AI daily. 7% have a governance team. That gap reveals something deeper than a policy failure
The Numbers Tell the Story:
The gap between AI adoption and AI governance has become a canyon.
83% of companies now use AI daily. But only 13% have strong visibility into how it touches their data and just 7% have a dedicated AI governance team. That’s not a resource problem. That’s a recognition problem-most organizations don’t see AI governance as requiring dedicated attention.
McKinsey’s December 2025 research surfaced something more concerning: 66% of board directors admit to having “limited to no knowledge” of AI. Yet these same boards approve AI strategies, sign off on AI budgets, and assume liability for AI-related risk.
The NACD found that fewer than 25% of companies have board-approved, structured AI policies. Only 15% of boards receive AI-related metrics at all.
Meanwhile, MIT’s NANDA research shows 95% of enterprise AI pilots fail to achieve meaningful ROI. Not because the technology doesn’t work. Because the decisions surrounding that technology don’t work.
These facts aren’t coincidental. They’re connected.
What Governance “Theater” Looks Like:
Theater is easy to spot once you know the patterns:
The Policy Document on SharePoint: Fifty pages of principles nobody reads. Written by legal, approved by compliance, ignored by engineering. Last updated when it was created. Its existence satisfies an audit requirement. Its contents satisfy no one.
Annual AI Ethics Review: A once-a-year checkbox where a committee reviews “AI ethics” in the abstract. No connection to actual deployments. No authority to stop anything. Scheduled to coincide with compliance reporting, not with actual decisions.
AI Training “Completed” Badge: A 45-minute e-learning module covering AI basics. Click through. Pass the quiz. Back to work. No practical guidance for edge cases. No consequences for ignoring it. The badge exists to demonstrate due diligence, not to create competence.
The Governance Committee: Meets quarterly. Reviews PowerPoint decks. The models being discussed have been in production for months. Actual decisions happen in Slack, email, hallway conversations. The committee ratifies what’s already done.
Risk Assessment Templates: Forms designed to move projects forward. The answers are whatever gets approval. Nobody audits whether the assessment matched reality. Nobody asks why the “low risk” project caused the incident.
What Actual Governance Looks Like:
Substance requires authority, accountability, and ongoing attention:
Decision Audit on Every Deployment: Before any model reaches production, someone with authority reviews: What decisions will this system make? Who’s affected? What’s the failure mode? What’s the rollback plan? Not a form. A conversation with consequences.
Kill Switch with Clear Ownership: A named individual-not a committee-with the authority and mandate to shut down any AI system producing harm. They don’t need approval. They need information, access, and organizational backing.
Live Monitoring of Production Systems: Not quarterly reviews of aggregated metrics. Real-time monitoring for drift, bias, accuracy degradation, anomalies. Alerts that reach people who can act within hours, not quarters.
AI-Specific Incident Response: Traditional IT playbooks don’t cover AI failure modes. Biased outputs, hallucinations, prompt injection, training data leakage-these need dedicated response protocols, escalation paths, and post-mortems that actually drive change.
Board Receives AI Risk Metrics: Not a quarterly slide saying “AI is going well.” Dashboards showing: which systems are in production, what decisions they’re making, what incidents have occurred, what the trend lines look like. Only 15% of boards get this.
Why Theater Persists:
Theater isn’t irrational. Given typical organizational incentives, it makes sense:
Speed Pressure: Everyone’s racing to deploy AI. Governance slows things down. When the CEO asks why a competitor launched first, nobody wants to explain that your governance process actually works.
The irony: speed pressure creates the conditions for failure. The 95% pilot failure rate isn’t despite the rush-it’s because of it. Organizations skip the hard work of aligning AI to business problems because alignment takes time. Then they’re surprised when the technology doesn’t deliver value.
Accountability Diffusion: Real governance means someone can be blamed when things go wrong. Theater distributes responsibility so thin that nobody’s accountable. Committees don’t get fired. Frameworks don’t face consequences.
This is rational self-protection at the individual level. It’s organizational dysfunction at the system level. When nobody owns risk, nobody manages risk. When nobody manages risk, incidents become inevitable.
The Knowledge Gap: When 66% of board directors don’t understand AI, they can’t distinguish theater from substance. They see a framework and assume it governs. They ask if governance exists, not whether it functions.
This creates a dangerous dynamic: leadership believes they have AI governance because they’ve seen presentations about AI governance. The gap between perception and reality grows until an incident forces acknowledgment.
Vendor Incentives: AI vendors want deployment. They’ll help you build governance frameworks that satisfy compliance without slowing adoption. That’s not malicious-it’s aligned with their business model. The vendor succeeds when you deploy. Whether you succeed is your problem.
The Illusion of Control: Perhaps most fundamentally: theater persists because it feels like governance. Documents exist. Committees meet. Boxes get checked. The rituals of oversight happen even when oversight doesn’t.
This creates cognitive comfort. Leaders can tell themselves-and tell their boards-that AI risk is managed. The absence of visible problems confirms the belief. Until a problem becomes visible.
The Cost of Theater
What happens when governance is theater?
Shadow AI proliferates. When official processes are slow and meaningless, people route around them. 78% of employees now use personal AI tools at work-often without IT knowledge. The organization has no visibility into what AI is actually touching company data.
Incidents surprise leadership. Without real monitoring, problems become visible only when they become crises. By then, the damage is done-to customers, to reputation, to trust.
ROI never materializes. The 95% pilot failure rate isn’t random bad luck. It’s the predictable outcome of deploying technology without understanding the business problem, the decision context, or the success criteria. Theater doesn’t prevent this failure mode. It enables it.
Regulatory risk accumulates. As AI regulation expands globally-the EU AI Act, emerging US frameworks, sector-specific requirements-theater becomes legally dangerous. Regulators will eventually audit not just whether governance exists, but whether it functions.
Talent notices. The best AI practitioners want to work at organizations that take AI seriously. Theater signals to sophisticated candidates that this organization doesn’t actually understand what it’s doing. They go elsewhere.
What This Actually Reveals
Here’s where most analysis stops. The policy recommendations follow: create better frameworks, assign clearer accountability, educate your board.
All reasonable. All insufficient.
Because governance theater isn’t just a policy failure. It reveals something deeper about how organizations actually work.
Most companies don’t understand their own decision-making systems.
Not AI decision-making. Human decision-making. The information flows, the informal authority structures, the real versus stated criteria for approval. Who actually decides? What actually happens when something goes wrong? Where does accountability actually live?
Think about how a typical AI project gets approved. There’s a formal process-business case, technical review, maybe a governance checkpoint. That’s the stated process.
Then there’s what actually happens: a VP champions it, the CEO mentioned AI in the last town hall, there’s budget to spend before year-end, the team is excited, nobody wants to be the person who slowed things down. The formal process gets completed, but the real decision happened elsewhere.
Most organizations can’t accurately describe their own decision-making processes. They can describe the org chart. They can describe the approval workflows. But ask where a specific decision actually got made-who had the conversation, what criteria actually mattered, what would have changed the outcome-and clarity dissolves.
This isn’t dysfunction. It’s normal. Organizations are complex adaptive systems, not machines. Information flows through relationships, not reporting lines. Authority exists where it’s exercised, not where it’s documented. Accountability lives in culture, not in job descriptions.
AI governance fails because organizations build governance for the organization they think they are-hierarchical, process-driven, accountability-clear. Not for the organization they actually are-informal, relationship-driven, accountability-diffuse.
When 95% of AI pilots fail to show ROI, everyone blames the technology. But technology isn’t making decisions. People are. In systems they don’t understand, using processes they can’t accurately describe, under accountability structures that exist on paper but not in practice.
The gap between stated governance and actual behavior isn’t a bug. It’s the normal state of organizational life. AI just made it impossible to ignore.
Every failed AI pilot is a window into organizational cognition. Not just “we need better governance.”But” we don’t actually understand how we make decisions here.”
That’s the real finding. That’s what the 95% failure rate is actually telling us.
From Theater to Substance
You don’t need to rebuild everything. You need to add teeth to what exists.
Start with authority. Designate one person-not a committee-who owns AI risk. Give them real power: budget, veto authority, direct board access. Make them accountable for failures. Watch how fast governance becomes real when one person’s career depends on it.
Instrument your systems. You can’t govern what you can’t see. Implement monitoring for every production AI system. Track accuracy, drift, bias indicators, usage patterns. Make this data visible to people with authority.
Create consequences. When governance is violated, something has to happen. Not necessarily punishment-but documentation, review, required changes. If violations have no consequences, governance is optional. Everyone knows it.
Connect to value. Track which AI initiatives deliver ROI. Track which ones fail. Connect governance practices to outcomes. Use data to argue for resources. Show that governance correlates with success, not just compliance.
Educate your board. If 66% of directors don’t understand AI, address that. Not with a one-hour overview. With ongoing engagement, exposure to real systems, conversations with practitioners. Informed boards ask better questions.
The Question Worth Asking
Here’s the uncomfortable truth:
Most AI governance exists to protect the company from regulators and lawsuits-not to ensure AI systems work as intended.
That’s not governance. That’s liability theater.
Real governance asks different questions:
Is this AI system doing what we intended? Is it creating value? Is it avoiding harm? Would anyone notice if this governance didn’t exist?
Those questions require ongoing attention, real authority, genuine commitment.
They require understanding how decisions actually get made.
They require seeing organizational cognition clearly-not the org chart version, but the actual information flows, the real authority structures, the true accountability relationships.
Most organizations can’t see this clearly. AI just made the blindness visible.
The real question isn’t “how do we fix governance?”
It’s “what does this failure tell us about how decisions actually get made here?”
That’s the question worth asking → What’s the biggest governance gap you’ve seen? I’m curious what patterns others are experiencing.
Sources:
- McKinsey, “The State of AI in 2025,” December 2025
- McKinsey citing Deloitte, “Board AI Knowledge Survey,” December 2025
- McKinsey citing NACD, “Board AI Governance Survey,” August 2025
- Cybersecurity Insiders, “AI Governance Report,” December 2025
- MIT Sloan NANDA Lab, “The GenAI Divide: State of AI in Business 2025,” August 2025
- ISS-Corporate, “S&P 500 Board AI Expertise,” 2025