Everyone is running AI. Almost nobody is governing it.

Kong looked at anonymized production traffic running through its AI Gateway at hundreds of organizations. 62% of them run two or more AI models in production. Fewer than 1% have AI-specific governance controls in place. The State of AI Governance

Sit with the second number for a moment. These aren't survey answers about intentions. It's what the traffic shows.

F5's 2026 State of Application Strategy data points the same way from the infrastructure side: 78% of organizations manage distributed inferencing across an average of seven models. Each one has its own cost profile and its own failure modes. F5 argues that model routing and input security have become runtime problems, which is a polite way of saying nobody decided them up front. The state of AI delivery and security in 2026

The gap shows up in disclosures first

Workiva's 2026 Midyear Executive Benchmark Survey moves the problem from the server room to the boardroom. 89% of investors say they are concerned about AI accuracy in disclosures. 26% of executives have caught AI errors that had already reached external audiences. Only 11% of leaders think their data quality is ready for AI. 2026 MidYear Executive Benchmark Survey

That last figure lines up with a survey of more than 275 business leaders by MIT Technology Review Insights, produced with Snowflake. Four in five businesses, it found, can't capitalize on generative AI because their data foundations are poor. Data Strategies for AI Leaders

What to read if you have an hour

• Start with Kong's report for the baseline. It is the only one here built on observed traffic rather than survey responses.
• Then take Workiva's AI Governance Toolkit. The self-assessment checklist is the useful part. Skip the framework diagram if you already have one.
• If you're further along, Kong's AI Governance in Action walks through discovery, risk classification and guardrails using a fictional airline. The airline is invented. The sequence is sound.

A caveat we will repeat often on this site: every report above was published by a company that sells a fix for the problem it describes. That doesn't make the numbers wrong. It does mean you should read the methodology page before you quote them in a board deck.