The AI Governance Benchmark 2026 reveals that AI governance remains largely an IT responsibility despite growing enterprise-wide adoption. Executives must establish clear accountability and consistent controls to enable secure, responsible AI scaling.
The report “AI Governance Benchmark 2026”, published jointly by Box and the Handelsblatt Research Institute, appears to highlight an organisational imbalance – for whilst Artificial Intelligence (AI) is being integrated ever more closely into business processes, responsibility for managing it still lies predominantly with the IT department.
At the same time, or in conjunction with this, there was a risk that key AI risks would often not be recognised as a governance issue. According to Box, this report is based on a survey of 300 decision-makers from companies with at least 500 employees. The survey was carried out in June 2026 in collaboration with the market research institute techconsult. In addition to the quantitative survey, the study also incorporates four in-depth interviews with representatives from TÜV SÜD, the Hoffmann Group, the German AI Association and the DvH.
These interviews contextualised the findings drawn from business practice and supplemented the survey data with different perspectives on the use and governance of AI. The benchmark highlights a key task for the next phase of AI implementation: Organisations must define responsibility for AI beyond the remit of “IT“ whilst ensuring that jointly agreed rules can be enforced across different applications.
When it comes to AI governance, in 44 per cent of companies the primary responsibility lies with “IT“
AI has long since evolved within organisations from an isolated technology into a company-wide management function. However, the “AI Governance Benchmark 2026“ shows that this development has so far been reflected only to a limited extent in the allocation of responsibilities. In 52 per cent of the companies surveyed, the IT department is involved in decisions regarding the use of AI, whilst senior management or the board of directors are involved in only 30 per cent of cases.
This pattern continues when it comes to AI governance: In 44 per cent of companies, primary responsibility lies with “IT“. A “Head of AI“, “Chief AI Officer“ or similar role is responsible in 11 per cent of cases, whilst the executive board is responsible in just 10 per cent.
Only three per cent stated that several business functions share primary responsibility for AI governance. To date, only 40 per cent of companies have established a central role for AI governance. In light of these figures, the report raises the question of the extent to which AI is already understood as a company-wide management responsibility, rather than merely as an issue that can be outsourced to a single department.
Governance structures are lagging behind growing demands
AI governance involves complex interrelationships that go well beyond mere technical implementation. Data protection, as well as regulatory and security-related requirements, must be taken into account, as must the specific conditions of the respective business areas.
The benchmark reveals a striking discrepancy here: Only 18 per cent of respondents view a lack of governance structures as a major obstacle to scaling up AI. At the same time, 42 per cent cite data breaches and 41 per cent cite security and cyber risks as key risks associated with the use of AI.
Both areas of risk were directly linked to who is permitted to access which company information and how such access is controlled. These are therefore clear governance issues that need to be addressed at company level.
Company-wide AI policies require a common technical foundation
For governance to meet these growing demands, it also needs a uniform basis at a technical level. If access policies are implemented separately for each AI tool or business unit, the effort required to enforce policies consistently increases as the number of applications grows, whilst at the same time the chances of uniform implementation are at risk of diminishing.
“Many organisations still underestimate the importance of consistent governance. To prevent the uncontrolled proliferation of AI applications, security and access controls must follow corporate content wherever it goes, regardless of which tool or application is used. By establishing these basic rules, companies can avoid siloed solutions and enable their teams to use AI with greater confidence,” comments Michael Pietsch, “Vice President for DACH and Eastern Europe” at Box.
For example, sensitive documents could be classified at Box to be a subject to specific protection rules, such as a download restriction for certain connected applications. This would enable jointly defined guidelines from the “IT“, “Security“, “Legal“ and business departments to be implemented centrally at the content level.
Key findings from the DS editorial team
- It is clear that many companies have not yet fully grasped the critical importance of AI governance.
- Responsibility must be assumed in full by senior management – any further delegation of AI governance, for example to the IT department, leads to unnecessary fragmentation.
- AI, in terms of both the value it creates and the risks it poses, is a tool of strategic importance and requires clear assignment to C-level management.
- All relevant Technical and Organisational Measures (TOMs) in the context of the organisation’s use of AI must also be clearly assigned.
- Governance is not an end in itself, but is of fundamental importance for compliance with data protection and cybersecurity – and senior management bears primary responsibility in this regard.
Conclusion from the DS editorial team
AI has become an integral part of day-to-day business operations – and is there to stay! As a tool that is becoming increasingly fundamental to business operations, its governance must be centralised at the decision-making level – naturally, C-level executives can and should draw on external or internal support to ensure well-informed decision-making.
Further information
DATENSICHERHEIT.DE, 10|02|2026
KI im rasanten Wandel: Verantwortung schafft Akzeptanz
DATENSICHERHEIT.DE, 09|16|2026
EU AI Act: Pressure on IT and data managers in the AI sector remains high
DATENSICHERHEIT.DE, 09|09|2026
KI außer Kontrolle: Shadow Agents setzen Führung unter Druck
![Denis Meißner berichtet: Viele unserer Kunden, gerade im öffentlichen Bereich, beschäftigen sich viel intensiver mit Datensouveränität, Transparenz, Compliance und Kostenkontrolle, Foto: © ]init[](https://www.datensicherheit.de/wp-content/uploads/denis-meissner-init.webp)
