06th November 2025: An AI “governance gap” is emerging as businesses pour money into AI tools and products without oversight or protective processes in place. While business leaders are chasing productivity boosts and cost reductions by investing large sums in AI, new evidence suggests many are sleepwalking toward significant governance failures, finds BSI research.
The global study, combining an AI-assisted analysis of over 100 annual reports from multinationals and two global polls of over 850 senior business leaders, conducted six months apart, offers a comprehensive view of how AI is publicly framed in communications, alongside executive-level insights into its implementation.
Governance gaps emerge
87% of Indian business leaders expect to increase investment in AI in the next year (the highest globally), and when asked why, a majority cited boosting productivity and efficiency (77%), with half (53%) focused on reducing costs. 71% said it would help to fill a business skills gap. Four fifths (83%) in India now consider AI to be crucial to their organization’s growth (59% said this globally), highlighting the integral role executives see AI playing in the future success of their businesses.
Highlighting the striking absence of safeguards, less than half (46%) reported that their organization has an AI governance programme, although this rose modestly to just over half (54%) in large enterprises[1], a pattern repeated across the research. While more than two-thirds (67%) say AI use is controlled by formal processes, less than half (46%) are using voluntary codes of practice. Half have processes to assess the risks introduced by AI and the required mitigations and just a third of Indian businesses (35%) restrict employees from using unauthorised AI.
The AI-assisted analysis reinforced this emerging governance gap and also identified a second, geographical one. Keyword analysis showed governance and regulation were more central themes to reports produced by UK-based companies, appearing 80% more frequently than in reports from companies based in India and 73% more than those based in China.
A key component of governance and management of AI lies in how data is being collected, stored and used to train large language models (LLMs). Only half of Indian business leaders know what sources of data their business uses to train or deploy its AI tools – although this is significantly higher than the global average of 28%. 69% said their business has clear processes in place around use of confidential data for AI.
Susan Taylor Martin, CEO, BSI said: “The business community is steadily building up its understanding of the enormous potential of AI, but the governance gap is concerning and must be addressed. While it can be a force for good, AI will not be a panacea for sluggish growth, low productivity and high costs without strategic oversight and clear guardrails – and indeed without this being in place, new risks to businesses could emerge. Divergence in approaches between organizations and markets creates real risks of harmful applications. Overconfidence, coupled with fragmented and inconsistent governance approaches, risks leaving many organizations vulnerable to avoidable failures and reputational damage. It’s imperative that businesses move beyond reactive compliance to proactive, comprehensive AI governance.”
Risk and security concerns remain under-addressed
Nearly a third of Indian executives (30%) felt AI has been a source of risk or weakness for their business, with just over half (57%) having a standardized process for employees to follow when introducing new AI tools. Just 50% reported having a formal risk assessment process to evaluate where AI may be introducing new vulnerabilities.
In their annual reports, financial services (FS) organizations placed the highest emphasis on AI-related risk and security (25% more focus than the next highest, the built environment). FS firms particularly highlighted the cybersecurity risks associated with implementing AI, likely reflecting traditional consumer protection responsibilities and the reputational consequences of security breaches. In contrast, technology and transport companies placed significantly less emphasis on this theme, raising questions about sectoral divergence in governance approaches.
Little focus on errors and value
There is also limited focus on what happens if AI goes wrong. Just 40% in India say their organization has a process for logging where issues arise or flagging concerns or inaccuracies with AI tools so they can be addressed, however more than half of Indian businesses (57%) cite having a process for managing AI incidents and ensuring timely responses – compared to the global average of 29%. A quarter of Indian organizations (25%) felt if generative AI tools were unavailable for a period of time, their business could not continue operating.
More than two thirds (67%) of Indian business leaders say AI investment has taken resources that could have been used on other projects. Yet only less than half (46%) have a process for avoiding duplication of AI services across the organization in various departments.
Human oversight and training falls to the bottom of the list
Across the annual reports, the term “automation” is nearly seven times more prominent than upskilling, training, or education. Overall, the relatively lower prominence of workforce-related topics suggests businesses may be underemphasizing the need to invest in human capital alongside technological advancement.
There is some complacency among business leaders that the workforce is well equipped to navigate the disruptions of AI and the new skills required to get the best out of it. Almost three quarters (71%) of organizations in India say they are confident their entry level workforce has the skills needed to use AI, and the same percentage say their entire organization currently possesses the necessary skills to effectively use AI tools in their daily tasks. 79% say they are confident their organization can train staff to use generative AI critically, strategically, and analytically.
Two thirds (64%) of Indian businesses have a dedicated learning and development programme to support AI training. A higher proportion (83%) say they’ve received training to use or manage AI safely and securely, suggesting that fear of AI may be driving reactive training, rather than proactive capability-building. This report follows earlier research by BSI into the impact of the rollout of generative AI on roles and work patterns published in October 2025.