AI Governance

The current version adds jurisdictional differences and third-party systems as concrete governance complications, but largely reinforces the previous account rather than changing its central interpretation.

The framing now highlights an accountability mismatch: CIOs and central IT may bear responsibility for AI risks while business units control purchasing and deployment. This sharpens the governance-lag story without changing its central direction.

The update adds more operational detail: governance responsibilities are distributed across business and control functions, and human-review coverage must extend across shifts. It also cautions that maturity survey figures are not directly comparable.

The update adds a caution about interpreting reported agent-evaluation incidents: they highlight configuration and tool-access risks but do not demonstrate spontaneous malicious autonomy. It also makes sector-specific pressure to prove operational controls more explicit.

EC-Council announced ADG 2.0, a new AI governance framework with more than 180 controls and crosswalks to over 90 instruments. This adds a concrete framework initiative to coverage otherwise reinforcing existing governance concerns.

Companies are expanding AI into consequential workflows and autonomous agents faster than many governance programs can establish clear owners, evidence, and intervention authority. The strongest operational shift is toward runtime and pre-execution safeguards, including agent identity, scoped permissions, monitoring, approval gates, and shutdown or rollback. Regulators and standards bodies are also pushing organizations toward auditable, lifecycle controls, though implementation and interoperability remain uneven.