• Only 18% of organisations have a fully implemented AI governance framework despite near-universal adoption.
• Almost a quarter of firms admit they have little or no understanding of what AI tools their staff are using.
• Over 70% of HR, finance and legal teams already use AI, yet most teams lack formal governance procedures.
• Almost 70% of organisations don’t require formal approval for all AI tools. 
   

New research from LEGALFLY, the secure AI associate for in-house legal teams, has revealed that artificial intelligence is rapidly reshaping business operations, but most organisations lack the rules and oversight to manage its risks. 

The AI Governance Gap Report surveyed 154 general counsel across the UK, France and Germany and found that while 90% of organisations already use AI, only 18% have fully implemented governance frameworks - exposing businesses to compliance failures, reputational risks, and regulatory scrutiny.

Almost a quarter (24%) of firms admit they have little or no understanding of which AI tools are being used internally.

The absence of formal governance has fuelled the rise of “shadow AI” - this is where employees adopt AI tools without approval, oversight or safeguards. The report found that nearly 70% of organisations don’t require staff to seek formal approval for all AI tools, leaving companies exposed to a host of risks.

Without controls in place, confidential data can be entered into publicly available tools like ChatGPT, creating the potential for sensitive information to leak outside the organisation. Equally concerning, employees may rely on inaccurate or biased outputs, embedding misinformation into business processes and decision-making. In effect, businesses are embracing AI’s speed without securing the guardrails to keep it safe - or choosing the correct AI tools for their needs and security.

AI Use by Business Function

Only 15% of leaders know which AI tools their companies are using

Despite AI’s rapid spread, senior leadership visibility is low. Only 15% of leaders have meaningful oversight of which AI tools are in use - however, 69% believe AI is critical to deliver a positive customer experience and 62% view it as a driver of innovation.

This gap between enthusiasm and oversight is fuelling uneven and often risky rollouts, with AI being treated as a quick-fix or behind the scenes tool, rather than a strategically governed capability.

As adoption has surged, governance has often been left fragmented and inconsistent. In nearly half of organisations, responsibility for oversight is pushed down to departments, and in 14% of cases even to individual employees. Even where policies exist, they frequently miss critical safeguards — almost 30% of firms with AI policies fail to explicitly protect client data, and only 24% say usage rules are always followed. This bottom-up adoption leaves firms exposed to data leakage, unvetted tools, and regulatory breaches. With the EU AI Act  and similar legislation on the horizon, companies risk being caught unprepared.

Ruben Miessen, CEO & Co-Founder of LEGALFLY, said: “This report shows just how quickly AI has become embedded in every corner of business - from HR to procurement to legal, yet the rules to govern it are significantly lagging behind. We’ve entered an era where teams are turning to general-purpose AI tools for everything from emails and creative ideation, to more serious tasks such as drafting contracts or compliance checks. That mismatch creates real risks: data leaks, misinformation, and regulatory blind spots.

That’s exactly why we built LEGALFLY - to give legal, compliance and procurement teams a secure, purpose-built AI associate they can trust. Our mission is to help companies harness AI’s speed and efficiency while keeping sensitive data safe and ensuring that governance is embedded at the heart of adoption.”

The research shows that even when governance exists on paper, it is often too limited to provide real protection. While 82% of companies report having some form of AI policy, most stop at broad principles like ethics or privacy, with fewer than 41% including sections on vendor guidelines, system deployment, or performance monitoring. Smaller firms are especially exposed: among those with 200–499 employees, 29% admit they have no clear understanding of what tools are being used. With regulation on the horizon and adoption racing ahead, the next big challenge for businesses will be building the knowledge and frameworks to use AI responsibly.

Download the full LEGALFLY AI Governance Gap Report for more insights.