Insufficient AI policies Increase AI Governance Gaps

The divide between AI use and organizational control has created big AI governance gaps. AI governance has weakened at breached organizations while AI-related exposure has escalated, Complex Discovery writes in a recent article. IBM’s Cost of a Data Breach Report found that 68% of breached organizations lacked an AI governance policy, while incidents involving shadow AI more than doubled. 

For legal teams, the findings connect security, records, compliance, and discovery. Only 32% of breached organizations have reported a completed AI policy and 35% report having no AI policy. Approval processes, governance frameworks, training, and audits for unauthorized AI use all saw lower adoption. 

Meanwhile, AI exposure has increased. AI-related incidents rose to 21% of breaches, and 92% of organizations experiencing an AI-related breach lacked proper AI access controls. Shadow AI incidents reached 43%, up from 20% the prior year, and averaged $5.39 million. AI-driven malicious attacks increased, with the breach lifecycle now 247 days.

The key issue with electronically stored information (ESI) is less visible. Prompts, model outputs, retrieval logs, metadata, and agent histories may become business records or discoverable ESI. It all depends on content, relevance, retention requirements, and control. When employees use unapproved AI systems, identifying and preserving that information becomes much harder.

The challenge extends to information governance. Retention schedules may not address materials stored in vector databases or other AI-related systems. With only 46% of organizations reporting controls for non-human identities in AI workflows, organizations may struggle with under-reviewed data access.

As AI adoption expands, AI governance gaps are becoming preservation gaps. Legal teams will need clearer answers about which systems are approved, what information they handle, where outputs reside, and how those materials can be preserved when specific legal preservation obligations arise.