Introduction and key findings

Enterprises are putting AI into production faster than they are building the means to govern it. 

Between July and September 2026, Bigeye analyzed the public records of 1,851 enterprise organizations and ranked 1,576 of them on a four-stage AI trust maturity ladder. We found no public evidence that any one of the companies surveyed had reached Stage 3, where AI policy is enforced automatically from end to end.

Only 155 organizations, or 10%, have reached Stage 2, where both written policy and programmatic controls are in place. The rest are split between organizations with named accountability but no controls yet (Stage 1), and organizations using AI with no visible governance at all (Stage 0). Organizations whose public evidence is too thin were not placed.

Takeaways at a glance

• No organization we researched appears to have automated AI governance end to end. Not one of 1,576 organizations analyzed were put in Stage 3. Only 10% have turned AI policy into working controls. Organizations that build controls now get to shape what “good” looks like in their industry instead of catching up to it.
• Most enterprises couldn’t yet show an auditor or regulator that their AI policy is being followed. Nearly half (47%) of organizations face a need to prove AI compliance to their board or regulators, but only 27% of those have named an AI governance committee, and 4% have a documented AI gateway. 
• Governance built inside one platform won’t cover the AI enterprises actually run. About a third (30%) of organizations run two or more enterprise AI agent platforms, and only 7% of those have a gateway that applies one set of rules across them. Each new platform adds another set of controls to reconcile unless policy sits above the platforms.

The AI maturity ladder

The maturity ladder is our attempt to quantify the maturity of a company’s AI governance program. Based on publicly available evidence collected by our team, we placed each organization at the highest stage that evidence supports, from Stage 0 to Stage 3. 

Here’s what the four stages represent, and where the organizations we analyzed landed:

What this report is, and isn't

Our researchers analyzed a median of 79 public documents per organization, including SEC filings, annual reports, websites, press releases, and job postings. 

In short, we based our analysis on publicly available evidence of what companies are doing and reporting on. There are limits to this approach, as there are to other research approaches; surveys, for example, rely on self-reporting and may not reflect what happens in an organization in practice.

With that said, here’s what you need to know about our findings:

• Who we researched. Between July 23 and September 25, 2026, we analyzed 1,851 organizations using a proprietary AI-assisted research process. Based on that analysis, we assigned a ranking on our AI trust maturity ladder to 1,576 of them. Of the organizations we ranked, 94% had 1,000 or more employees; 1,075 were headquartered in the US; 49% were public companies.
• How to read the numbers. This report is a snapshot of the companies we surveyed. It does not say what share of the market does something, or what any individual company is doing. A missing signal doesn't necessarily mean an organization isn't doing the thing; it means we couldn’t find evidence to validate it.
• The visibility caveat. Organizations that placed higher on the ladder had more documents read: a median of 72 at Stage 0, 93 at Stage 1, and 118 at Stage 2. More documents mean more signal to assess their maturity efforts; it could also mean there is less for them to report on.

This is the first edition of what will be an ongoing report. Over time, it will provide a robust picture of what has moved, in addition to where orgs are today. 

Key finding: AI disclosure is outrunning AI governance

Organizations are scaling up AI use, but aren’t building the governance structures to match. Between January 1 and September 15, 2026, 61.6% of US public companies that filed an annual report disclosed using AI, up from 10.4% over the same period in 2021. 

Of those, however, only 39 (0.64%) described a meaningful AI governance program. To determine this, we analyzed the 250 filings that contained the phrase "AI governance." Only about one in six described the filer's own governance program (for example, they said explicitly, "our AI governance committee"); most were boilerplate about state legislation.

How and when AI is being governed at the organizational level is still very much opaque. This presents a very real challenge for internal teams: When boards, auditors, or other stakeholders ask for evidence that their AI is well-governed, how will they prove it?

Key finding: The AI footprint is already sprawling

Part of the challenge in proving governance likely stems from the increasing sprawl of a typical org’s AI footprint. Today, enterprise AI use typically spans several platforms and includes both vendor and bespoke tools.

Here’s what our analysis revealed:

• No single vendor dominates. Microsoft Copilot is the most commonly cited AI platform in our analysis of public documents, followed by OpenAI/ChatGPT and Salesforce Agentforce/Einstein. 
• One platform is rarely enough. 404 organizations name at least one vendor AI platform family in their public documents, and 49 name three or more. Counted more broadly, including customer-facing products, 477 (30%) show two or more enterprise AI agent platforms.
• Orgs are building. Increasingly, a large share of AI apps are being built in-house: Our research found a majority (54%) of orgs demonstrated evidence of agent frameworks, direct use of model APIs, coding agents, and model-context integrations that would suggest AI app development.
• Scale-ups and partnerships are common. In the past 12 months, 49% of organizations we analyzed had announced company-wide efforts to ramp up AI use, or a strategic partnership with an AI, cloud, or data platform, suggesting that sprawl will continue to grow in the future.

For AI leaders, that changes what governance has to do. Controls built into one platform govern the agents inside that platform. But as organizations’ AI footprints sprawl, a gap emerges. Of the 477 organizations running two or more agent platforms, only 33 (7%) have a documented AI gateway that provides a consistent infrastructure enabling governance across heterogeneous AI environments.

Learn more about the importance of platform-neutral governance here.

Key finding: The accountability gap

Most enterprises know they will have to prove their AI is under control, but few have built publicly visible structures that would let them. This creates visible accountability gaps on several levels.

Forty-seven percent of organizations show a need to demonstrate AI compliance, evidenced by regulatory statements, risk disclosures, or sector obligations. Of those, 203 (27%) have a named AI governance committee and 32 (4%) have a documented AI gateway.

Even among orgs with clear compliance obligations, such as an EU AI Act footprint, US state AI laws, or insurance bulletins, this gap holds. Of the 490 organizations (31%) we identified with time-sensitive compliance obligations, only 156 of them (32%) have evidence of a committee in place.

Scale-up plans are also ahead of oversight. Of the 765 organizations that announced an AI scale-up or partnership, only 283 (37%) show their security team engaging with AI risk, and 201 (26%) have a committee. Across the whole study, only 342 organizations (22%) have flagged AI risks in an official communication to the board or executive team.

Companies are hiring to address these gaps, which suggests that they’re aware of them. However, the broader governance structure isn’t following. 597 organizations (38%) have a named enterprise AI leader, such as a chief AI officer or head of an AI center of excellence. Of those, only 30% also have a governance committee.

The picture across industries and regions

Regulated industries are furthest up the AI trust ladder, because regulators are already asking them for evidence. More than half of all financial services and healthcare companies we surveyed were at Level 1 or higher. 

Seventy-two percent of financial services organizations and 67% of healthcare organizations show a need to prove AI compliance, compared with 21% in consumer, retail, and media, and 23% in manufacturing.

Even with this regulatory pressure, however, many of these organizations are still stuck. Only about one in five financial services or healthcare organizations had a named AI governance committee in the documents we analyzed.

US-headquartered organizations were slightly further along than those based elsewhere: 11% of the 1,075 US organizations reached Stage 2, against 7% of the 500 outside the US. They are also more likely to name AI risk to the board (25% versus 15%). Part of that difference reflects disclosure: US public companies file with the SEC, which puts more of their governance on the public record.

Leaders and laggards: What separates mature organizations

Stage 2 organizations are bigger, closer to the board, and already tracking what their AI costs. They are not more cautious about AI; they run more of it.

Org size tends to correlate with greater maturity. The share at Stage 2 is 5% among organizations with 1,000 to 4,999 employees, and 7% among those with 5,000 to 24,999 employees. It jumps to 26% at 25,000 or more. 

This suggests that the largest enterprises have both the most budget to build controls and the most AI to coordinate.

 Cost is also top of mind for more mature orgs. Our survey looked for signals that an org is concerned about unmanaged AI spend: AI FinOps or spend-management hiring, executive commentary on AI cost discipline, consumption pricing exposure, among others. We found evidence of this in 11% of Stage 1 orgs and 35% of Stage 2 orgs. Once AI spend shows up as a line item someone has to defend, the organization needs to know which agent, team, or use case is driving it. 

Your next step by stage

Whatever rung you are on, the next step is specific and achievable.

• Not assessable: Put your governance on the record. If outsiders can't see it, auditors and partners will ask for it one request at a time. Publish your AI principles and name the person accountable for AI risk.
• Stage 0: Name an owner and know what's running. Appoint an accountable AI leader, form a governance committee with a seat for the data team, and build an inventory of the AI systems and agents already in use. You can't write policy for agents you haven't found.
• Stage 1: Turn policy into controls. Write rules once, against data classes and sensitivity levels rather than per platform, and route agent requests through a gateway that applies them. Start attributing AI spend to the agents and use cases that drive it.
• Stage 2: Make enforcement automatic. Evaluate each request against the quality, sensitivity, and lineage of the data an agent is about to use, and let the system produce the evidence trail as it runs, rather than assembling it for each audit.

To see where your organization sits and which of these steps comes next for you, take the AI Trust Assessment.

Good news: Wherever you are, the data foundation is already in place

Most enterprises already have the platforms AI trust depends on. But having a warehouse or a catalog doesn’t make the data in it fit for AI. That takes continuous evidence of its quality and sensitivity, and a way for AI policy to act on it.

1,122 organizations (71%) run an enterprise data warehouse or lakehouse, and 802 (51%) already run data governance or catalog tooling. Of the 737 organizations that have both, 503 (68%) are still at Stage 0 or 1, and 120 (16%) have reached Stage 2. The platforms are in place; the controls on AI that would draw on them mostly aren’t. What we can’t see from public evidence is whether the data inside those platforms is continuously monitored for quality or sensitivity, and that is the part AI depends on.

That puts data and governance leaders in a strong starting position, with one condition. Every agent an enterprise deploys reads from data their teams already manage, so they are best placed to decide what an agent should be allowed to touch. But that decision needs live answers about the data: whether it is fresh and accurate right now, whether it contains regulated information, and where it came from. A catalog entry or a one-time classification describes the data as it was. AI policy needs to know what it is at the moment an agent asks for it.

The connection has to work across platforms, though. The organizations furthest up the ladder are the most likely to run several AI platforms, and their data rarely sits in one place either. A trust signal computed inside one vendor's platform covers only the data and agents that live there. Governance that holds up across the estate has to sit independently of any single platform and read from all of the data underneath it.

Next steps

Talk to Bigeye to learn how other enterprises are connecting their data foundation to their AI controls, and what that would look like in your environment.