ReadingResearchRadarInvestment frameworkAI Company Primary Sources
Sign in / Sign up
← Back to reading
NewsQuick take3 min readDisconfirmAI Editorial

Enterprise AI Governance Survey: Cross-Functional Collaboration Taking Shape, Board and HR Participation Below 15%

A survey of diginomica's community of over 400 CIOs reveals that 51% of enterprises consult other functional departments when formulating AI governance policies, while only 14% develop them entirely independently within the technology department. Cybersecurity (21%) and legal (19%) are the most prominent collaborators, but participation from the board of directors (14%) and human resources (13%) is notably low. Catherine Dawson, Chief Legal Officer at US legal tech company 8am, shares her experience of multiple revisions to the company's policy, shifting from conservative bans to a balanced approach fostering innovation, arguing that AI governance must continuously iterate between safety guardrails and experimental space.

2026-11-03 18:40 GMT+8

If an AI governance policy is issued solely by the technology department, it will be viewed as IT imposing technology on business lines, and therefore destined to fail. This is Mark Chillingworth, author of the diginomica survey, concluding after analyzing his community data. His judgment is based on a forming trend: among the more than 400 CIOs and senior digital leaders in his invite-only community, 51% of enterprises have consulted other functional departments when developing AI governance policies, 31% completed this through cross-functional teams, and only 14% developed the policy entirely independently within the technology department.

However, the coverage of collaboration remains uneven. The cybersecurity team is the most prominent collaborator, appearing in 21% of cases, followed by legal (19%) and risk and compliance (17%). Chillingworth suggests this may indicate that AI is still primarily viewed as a technological change—requiring functions responsible for protecting data and system security to intervene first—while strategic-level participation is clearly insufficient: the board of directors appears in only 14% of policy development processes, and human resources in just 13%.

Sign in / Sign up
ReadingResearchRadarInvestment frameworkAI Company Primary Sources

The experience of Catherine Dawson, Chief Legal Officer at US legal tech company 8am, perfectly illustrates this realistic path of 'conservative first, iterative later.' She recalls that the core problem the company initially faced was shadow AI—employees registering external AI tools on their own and inputting company and customer data into them. About a year and a half ago, she launched the first version of the AI governance policy alongside the technology and cybersecurity teams, taking a fairly conservative stance: banning personal use.

But the ban quickly faced challenges. Dawson recalls that people came to her saying that personal use is exactly how people experiment with and become familiar with these tools, asking if they could relax the rules. The company subsequently adjusted its strategy, establishing a separate restrictive policy for personal use, guiding employees to use approved tools while retaining some room for experimentation. She stated that the company's policy would continue to evolve because tool selection changes, information security requirements change, and the models themselves change; she feels she is 'almost always in draft mode.'

From the survey results, enterprises with governance policies are indeed beginning to see practical effects. 26% of enterprises reported blocking a specific tool or vendor after the policy was introduced; 24% said approval speeds for AI projects accelerated; 20% revised their policies after receiving challenges from other functional departments; and 17% identified policy violations. 69% of community member enterprises maintain a list of approved AI tools and provide a pathway for application.

Notably, token costs have become a new variable influencing governance decisions over the past 12 months. 39% of enterprises stated that token costs are the primary factor influencing policies on personal and experimental AI use, 33% considered it a secondary factor, and 17% admitted they have no clear visibility into their AI token costs. Dawson mentioned that she is preparing to revise the personal use policy again because the economics of AI usage are changing, requiring a new balance between encouraging exploration and controlling costs.

Chillingworth pointed out at the end of the article that AI is a systemic change that alters how all areas of the enterprise operate, so governance must also come from all areas. He plans to repeat this survey in 12 months, especially in the context of recent cybersecurity and geopolitical events, to observe whether the collaborative landscape of enterprise AI governance evolves further.

Sources

  • diginomica.comdiginomica↗
Continue researching →