Contact

The enterprise AI governance gap

AI adoption is moving faster than governance, data-flow control, and regulatory readiness.

Adoption — Eurostat reports that 20.0% of EU enterprises with 10 or more employees used AI technologies in 2025, up from 13.5% in 2024.

Scaling gap — McKinsey's 2025 State of AI survey found broad AI usage, but nearly two-thirds of respondents said their organizations had not yet begun scaling AI across the enterprise.

Governance gap — IBM's 2025 breach research reports that 63% of organizations lacked AI governance policies to manage AI or prevent shadow AI.

Regulatory timing — Article 50 transparency rules apply since 2 August 2026. Annex III high-risk obligations apply from 2 December 2027 and Annex I embedded systems from 2 August 2028 under Digital Omnibus Regulation 2026/1744, in force since 27 July 2026.

Evidence-backed risk map

The problem is not one universal cost number. It is a set of risks every enterprise AI deployment must quantify before rollout.

Risk area Current public fact What to validate in PoV
AI governance 63% of organizations lacked AI governance policies in IBM's 2025 research. Approved tools, access controls, model/data ownership, audit ownership.
Data breach exposure IBM reports USD 4.44M global average breach cost in 2025; IBM Germany reports EUR 3.87M in Germany. Which prompts, documents, embeddings, and logs leave the controlled environment.
Shadow AI IBM Germany reports USD 670k higher average breach cost for organizations with high shadow-AI usage. Unapproved AI usage, logging gaps, training data exposure, employee workflow reality.
Regulatory readiness Article 50 applies since 2 August 2026 (Article 50(2) marking for pre-existing systems by 2 December 2026). Annex III applies from 2 December 2027, Annex I from 2 August 2028. Risk class, documentation, logging, human oversight, transparency, deployer duties.
Variable cost Public market forecasts show rapid AI spending growth, but provider-specific TCO must be modeled per use case. Seat fees, inference/API usage, infrastructure, support, compliance operations.

The shadow AI multiplier

The risk is not only the approved AI tool. It is the unmanaged AI usage that appears when employees need answers faster than internal systems can provide them.

63% Organizations lacking AI governance policies in IBM's 2025 global breach research
$670k Higher average breach cost with high shadow-AI usage, according to IBM Germany's 2025 release

The regulatory window

  • Feb 2025 Prohibitions and AI literacy The first AI Act obligations became applicable.
  • Aug 2025 GPAI and governance Governance rules and obligations for general-purpose AI models became applicable.
  • Aug 2026 Transparency and enforcement live Article 50 transparency rules apply since 2 August 2026. GPAI enforcement powers and sanctions apply from the same date.
  • Dec 2026 Marking deadline and new prohibitions Article 50(2) machine-readable marking becomes mandatory on 2 December 2026 for systems placed on the market before 2 August 2026. New Omnibus prohibitions on non-consensual intimate content and CSAM generation apply from 2 December 2026.
  • Dec 2027 High-risk standalone systems Annex III obligations apply from 2 December 2027 under Digital Omnibus Regulation 2026/1744, in force since 27 July 2026.
  • Aug 2028 High-risk embedded systems Annex I product-embedded obligations apply from 2 August 2028 under the same Regulation.

Three questions every AI buyer must answer

  • 01
    Where do prompts, documents, embeddings, outputs, and logs actually go? Decision point: Data-flow evidence matters more than vendor assurances. High-X position: Selected workflows can run inside customer-controlled infrastructure.
  • 02
    Can human oversight be shown as a system event, not only as a policy document? Decision point: High-risk workflows need reviewable evidence. High-X position: Human approval or rejection can be captured inside the workflow.
  • 03
    Which AI workflows must continue when external services are unavailable? Decision point: Resilience depends on deployment architecture. High-X position: Local-first deployment can reduce dependency for defined workflows.

Competitive matrix

High-X Cloud AI Generic On-Prem
Data flow Local-first for configured workflows Provider-controlled processing path Depends on vendor architecture
Governance evidence Designed around audit and oversight workflows Often policy and platform dependent Often integration dependent
Deployment control Customer-controlled infrastructure Cloud account and provider terms Hardware local, stack may remain proprietary
Cost model Fixed license hypothesis plus local operations Seat, usage, and provider pricing License, hardware, and operating cost
Offline operation Targeted for selected local workflows Limited or unavailable Varies by product
Validation path Bounded Proof of Value in customer environment Vendor trial or sandbox Project/integration phase

Sources: Eurostat 2025, McKinsey State of AI 2025, IBM Cost of a Data Breach 2025, EU AI Act Service Desk (Sep 2026), Digital Omnibus Regulation 2026/1744.