Share with your CISO
A new AI governance study from Arctera exposes a critical disconnect inside regulated organizations: 55% say they have AI policies and training in place, but only 19% have the logging, retention, and monitoring controls needed to actually prove how an AI-assisted decision was made. Drawn from 500 compliance decision-makers across finance, healthcare, and energy in the Americas and EMEA, the findings show that written policy has outpaced operational proof by a wide margin, with 78% of AI-using firms expecting communications risk to increase.
What this means for your business
The 36-point gap between “we have a policy” and “we can prove what happened” is where regulatory exposure actually lives. If your organization is in finance, healthcare, or energy, and AI is touching regulated workflows (45% of respondents say it already is, either as a core tool or extensively used), then the question an auditor or regulator will ask isn’t whether you had a governance framework. It’s whether you can reconstruct the prompt, the output, the human review, and the retention chain for a specific decision made six months ago. Most organizations, by their own admission, cannot.
The pattern here is familiar: compliance functions write policies faster than engineering teams instrument systems. Arctera, whose business depends on selling exactly the logging and archival tools this research says are missing, has an obvious incentive to frame the gap as wide and urgent, which may explain why the 19% figure gets headline treatment while the 71% who claim audit-trail readiness gets quietly undermined in the methodology. Both numbers are probably right. Feeling prepared and being able to demonstrate preparation are different things, and regulators increasingly care only about the latter. The 70% of respondents who now call archives a “critical asset” for AI governance signals that this isn’t abstract: firms are reconnecting old records infrastructure to new AI workflows because that’s where the evidence trail already lives.
The harder structural problem is accountability diffusion. Sixty percent of respondents place AI governance responsibility on compliance functions, but the controls that generate a defensible audit trail, prompt monitoring, automated retention, risk scoring, are engineering and infrastructure decisions. CISOs who don’t own the AI deployment stack but are expected to answer for its audit readiness are in the most exposed position. The firms that close this gap first won’t be the ones with the best policies. They’ll be the ones where the CISO has enough cross-functional authority to make evidence-capture a deployment requirement, not a post-hoc documentation project.
Concept deep-dive: Defensible audit trail
A defensible audit trail is a time-stamped, tamper-resistant record showing exactly what inputs entered a system, what outputs it produced, who reviewed them, and how long they were retained. In traditional compliance, this covers emails and trades. In AI-assisted workflows, it must also capture the prompt sent to the model and the generated response, because those are now part of the decision record. Without it, a regulator can’t verify that human oversight actually happened, regardless of what the policy document says.
Based on reporting from AI governance gap leaves firms unable to prove decisions, originally published 2026-07-23 04:04:00.
