In brief
- AI adoption is accelerating, not slowing. Over 90% of organisations expect usage to grow in the next 12 months, so governance gaps widen the longer controls lag behind.
- AI is already mainstream, with 67% of organisations reporting widespread use. Heavy restrictions tend to push activity into personal accounts and unsanctioned tools.
- The heaviest AI usage sits in high-stakes functions like data analysis, software development, and customer support, where sensitive and regulated data is routinely handled.
- Documented policies are not the same as control. Regulators and customers increasingly expect demonstrable enforcement, auditability, and measurable oversight.
Insights taken from CultureAI’s upcoming research paper: The State of Enterprise AI Usage
AI adoption isn’t slowing down. It’s accelerating, quietly, unevenly, and often outside formal control.
To separate assumption from reality, CultureAI commissioned an independent research study of 300 senior technology, security, and risk leaders across North America and Europe. Respondents included CISOs, CIOs, CTOs, Data Protection Officers, and senior IT and security leaders across finance, healthcare, technology, legal, and professional services.
The research focused on five areas:
- Organisational AI usage
- Governance structures
- Risk perception
- Enforcement capability
- Regulatory readiness
What we found is clear: most organisations are operating on outdated assumptions about AI usage. And those assumptions are creating risk.
Below are the five biggest myths exposed by the data.
Myth 1: AI adoption is slowing, so there's time to prepare.
Reality
AI usage is increasing, not plateauing. Over 90% of organisations expect AI adoption to grow in the next 12 months, with 41% anticipating significant growth. AI is expanding across departments and embedding itself into everyday SaaS workflows.
Why it matters
Risk scales with usage. Governance programmes that move slowly while adoption accelerates create widening exposure gaps. Waiting to “finalise policy” before implementing operational controls allows sensitive data to flow into AI tools without oversight.
Myth 2: AI is still restricted or experimental.
Reality
AI is already mainstream. 67% of organisations report widespread AI use across teams, while only 7% describe it as highly restricted or banned. The majority of enterprises are well past experimentation.
Why it matters
Heavy restrictions often drive usage underground. Employees adopt personal accounts or unsanctioned tools, reducing visibility rather than reducing risk. The challenge is no longer whether to allow AI: it is how to enable it safely and measurably.
Myth 3: AI is mostly used in low-risk areas.
Reality
The highest levels of AI usage are in data analysis, software development, and customer support, functions that routinely handle sensitive customer data, proprietary code, and strategic information.
Why it matters
AI risk is embedded in high-impact workflows. The exposure includes intellectual property, regulated data, and business-critical insight. As AI becomes integral to production environments, the potential blast radius increases.
Myth 4: We already have strong visibility and controls.
Reality
While 72% of leaders claim full visibility into AI usage, 65% have identified shadow AI within their organisations. Embedded AI features, personal accounts, and long-tail SaaS tools remain difficult to monitor with traditional controls.
Why it matters
Approved application lists and proxy logs do not equate to true AI usage visibility. Traditional DLP and CASB solutions were not designed to interpret prompts or behavioural intent. Blind spots persist, and incidents typically originate in those blind spots.
Myth 5: Policies and training are enough.
Reality
Compliance and privacy are top concerns, and most organisations express confidence in their regulatory posture. However, many acknowledge that policies are not actively enforced, and detection of sensitive data leakage is only partial.
Why it matters
Governance documentation alone does not constitute control. Regulators and customers increasingly expect demonstrable enforcement, auditability, and measurable oversight. Confidence without operational proof creates regulatory and reputational risk.
The Pattern Behind the Myths
Across all findings, adoption is advancing faster than enforcement maturity. AI is widespread, embedded, and growing - yet visibility remains fragmented and controls are inconsistent.
The next phase of enterprise AI is not about debating adoption. It is about operationalising governance through measurable, real-time oversight.
📖 Access the research
In March 2026, CultureAI releases new research: The State of Enterprise AI Usage: The Illusion of Control.
Based on insights from 300 senior leaders in regulated industries, this report explores enforcement maturity, sector-specific trends, and regulatory readiness in greater depth.
The takeaway is clear: AI usage is already happening at scale. The question is whether it is visible, controlled, and provably compliant.