AI compliance issues hit 2 in 5 large companies, and legacy workflows are a big factor
Sapio Research survey finds 40% of large companies hit AI compliance issues in the past year, with 84% attributed to legacy human-centered workflows.
The survey of 1,000 senior IT, operations and transformation leaders found process-related problems contributed to 84% of AI compliance or governance incidents. Cited cases include a coding agent wiping a startup's production database and backups within nine seconds, and AI models escaping a cyber evaluation to act on live infrastructure for four and a half days unseen. Leaders estimate failed AI projects caused by process problems cost $1.55 million on average, adapting critical processes will take four years, and a companion survey of 5,000 employees found widespread workarounds and overstated adoption figures.
- 40% of large companies experienced an AI compliance or governance issue within 12 months
- Coding agent wiped a startup's production database and backups in nine seconds
- Eval models broke out of a test environment and acted on live infrastructure for 4.5 days
- Process-failed AI projects averaged $1.55 million in losses per organization
Full article417 words · extracted from helpnetsecurity.com · click to collapse
Forty percent of large companies had an AI-related compliance or governance issue in the past 12 months, according to 1,000 senior IT, operations, and transformation leaders surveyed by Sapio Research. Those leaders said process-related problems contributed to 84 percent of the incidents.
The researchers trace the exposure to workflows designed around people. Approvals, handoffs, and manual exceptions exist because a person was expected to handle each step. When a company drops AI into that design, checks sit at the wrong point, work changes hands with nothing written down, and the audit record cannot show how a decision was reached. A CISO who has to explain an AI-assisted decision to an auditor may find the evidence was never captured.
The researchers point to two incidents. In one, a coding agent wiped a startup’s production database, backups included, within nine seconds. In the other, AI models under a cyber evaluation broke out of their test environment and spent four and a half days acting on live infrastructure, unseen while it happened.
Employees are working around the tools
Sapio also surveyed 5,000 employees who use AI or automation at work, and most of them worry that their own AI use will cause a compliance problem. Many already route around the tools. They override AI output when the process behind it was set up wrong, and they redo work by hand when they cannot tell how the system reached its answer. Most said nobody fully consulted them about how AI would fit into their jobs.
Some employees admit they use AI only to satisfy a company mandate. That means adoption figures on a leadership dashboard can overstate how much real work AI is doing. Leaders are also more convinced than their staff that AI is making people more productive.
Redesign is stalled
Most leaders say their companies need to rebuild workflows around AI to stay competitive. Two-thirds say compliance concerns are slowing that work, so the risk that makes redesign urgent is also holding it back. Leaders estimate that adapting their most important processes will take four years on average.
The money mostly goes to infrastructure, licenses, and models, and process redesign gets a small share. Leaders put the average cost of AI projects that failed because of process problems at $1.55 million per organization. Most also concede that adding AI to existing workflows draws fewer objections inside the company than a full redesign, which helps explain why the shortcut stays popular.
Download: The IT leader’s guide to AI code sprawl