Adoption of artificial intelligence is accelerating faster than the governance structures meant to manage its risks, according to research released Thursday that assesses nearly 3,000 companies. The analysis, produced by the Thomson Reuters Foundation’s AI Company Data Initiative (AICDI) in partnership with the World Business Council for Sustainable Development and others, lays out stark gaps in board oversight, ethics safeguards and data-protection roles at firms deploying AI.
Adoption vs. oversight
The joint work, developed with partners including CMS, the Principles for Responsible Investment and the WBCSD’s membership, finds headline commitments are often not matched by operational policies and structures. The AICDI data shows 43.7% of companies publicly communicate that they have an AI strategy, but of those, just 27% report adherence to a formal governance framework.
Other findings highlight additional weak points in corporate governance of AI:
- 40% of companies report some form of board oversight of AI;
- Only 3.8% have an AI ethics committee;
- 31% have an AI governance team, but among them only 11% specify a Data Protection Officer role.
| Metric | Percentage |
|---|---|
| Companies with AI strategy | 43.7% |
| Of those, following governance framework | 27% |
| Board oversight of AI | 40% |
| Companies with AI ethics committee | 3.8% |
| Companies with AI governance team | 31% |
| Of those, have Data Protection Officer | 11% |
Gaps beyond public pledges
The Thomson Reuters Foundation’s head of data insights and investor stewardship, Joy Zhang, emphasized that looking beyond public commitments reveals widespread absence of tangible policies for critical elements such as training-data quality, model registries, employee AI literacy, impact assessments and safeguards for meaningful human oversight of AI systems. The research draws on UNESCO’s Recommendation on the Ethics of AI as a benchmark for responsible practice.
Business groups and investors participating in the WBCSD forum argued that responsible AI governance is far more than a compliance checkbox: it is “a business imperative” to deliver safe AI services, protect and strengthen worker skills, maintain oversight of operations and value chains, and make informed decisions about where to embed AI across the enterprise.
Implications for companies and boards
The findings carry practical consequences for corporate strategy and investor evaluation. Boards are increasingly being held accountable for AI-related risks, but the data suggest many directors lack the institutional tools and organizational backing needed to oversee AI effectively. For companies, the absence of common operational practices — such as model registries or regular AI impact assessments — can raise legal, reputational and operational exposures as regulators, customers and shareholders demand greater transparency.
For investors, the AICDI disclosure windows offer a way to benchmark governance maturity across firms and sectors. The Thomson Reuters Foundation and partner organizations are urging companies to use the data as a prompt to strengthen internal policies and reporting.
WBCSD and its collaborators also highlighted practical supports for boards and executives. The Thomson Reuters Foundation offers a Responsible AI training program aimed at bolstering director oversight capabilities and improving corporate readiness to manage AI risks.
As AI becomes more embedded in products and processes, the gap between adoption and governance underscores a central challenge for business leaders: scaling innovation while building the institutional checks needed to ensure safety, accountability and public trust.
