AI Transformation Is a Problem of Governance: What That Claim Means

Short answer

• The claim says AI programs stall mainly on accountability, decision rights, data control, risk, and compliance, not on model capability.
• Supporters cite survey evidence: a 2025 report from MIT's Project NANDA found about 95 percent of organizations saw no measurable profit-and-loss impact from generative AI pilots; S&P Global found 42 percent of companies abandoned most of their AI initiatives in 2025; Gartner predicts over 40 percent of agentic AI projects will be canceled by the end of 2027, citing costs, unclear value, and inadequate risk controls.
• Critics answer that model limits are real, that data quality is an engineering problem rather than a governance one, and that heavy governance can itself slow delivery.
• The best-known governance framework is NIST's AI Risk Management Framework, organized around four functions: Govern, Map, Measure, and Manage.
• The claim is a framing supported by some evidence, not a settled finding. The same reports that support it also document genuine technical limits.

Few sentences circulate in board presentations and consulting blogs as often as this one: AI transformation is a problem of governance. It is usually delivered as a conclusion, the lesson drawn from a failed pilot or a stalled rollout. But it is a claim, not a fact, and it makes a specific argument about cause and effect: that when organizations fail to get value from artificial intelligence, the reason is usually organizational, in how decisions are made, owned, and controlled, rather than technical, in what the models can or cannot do.

This article explains that claim rather than endorsing it. It sets out what the words mean, what evidence the claim’s supporters point to, what the counter-arguments are, and which governance frameworks organizations actually use. Readers can then judge for themselves how much of the claim the evidence carries.

What the Claim Actually Means

Three words in the sentence do the work, and each needs pinning down.

Artificial intelligence, in Encyclopaedia Britannica’s definition, is “the ability of a digital computer or computer-controlled robot to perform tasks commonly associated with intelligent beings.” The systems at issue in the transformation debate are mostly machine learning models, including generative AI tools that produce text, images, and code, and increasingly AI agents that carry out multi-step tasks.

Transformation is the ambitious word. It does not mean buying licenses or running a pilot. It means changing how work is actually done across an organization: which decisions are delegated to software, how processes are redesigned around it, and what people stop doing by hand. A chatbot on a help page is adoption. Rebuilding a claims process so that a model drafts, a person approves, and exceptions route to a specialist is transformation.

Governance is the set of decisions an organization makes about its own behavior. Applied to AI, it covers who is allowed to build or buy a system, who approves its use for a given purpose, what data it may touch, how its outputs are checked, how it is monitored after launch, and who answers when it causes harm or embarrassment. Governance includes accountability (a named owner), decision rights (who can say yes or no), data governance (rules for the data that feeds the system), risk controls (testing, limits, and shutdown options), and compliance (meeting legal and contractual duties).

So the claim, spelled out, is this: the binding constraint on AI transformation is usually that second and third layers, the decisions and controls, rather than the first layer, the technology. The models, supporters argue, are largely the same for everyone, sold by the same vendors to competitors in the same industry. What differs between organizations that get value and those that do not is how they are run.

The Evidence Offered for the Claim

The claim rests on a body of survey and analyst research published in 2025 and 2026. Four findings are quoted most often.

The MIT NANDA report. “The GenAI Divide: State of AI in Business 2025,” published by Project NANDA, a research initiative at the MIT Media Lab, drew on a review of more than 300 publicly disclosed AI initiatives, interviews with people at 52 organizations, and survey responses from 153 senior leaders. Despite an estimated 30 to 40 billion dollars of enterprise spending on generative AI, about 95 percent of organizations reported no measurable impact on profit and loss. The report’s authors located the divide not in model quality but in approach: the minority that succeeded used systems that integrated into real workflows and retained context, and initiatives run with external partners reached deployment about twice as often as internal builds, roughly 67 percent of the time against 33 percent.

The S&P Global abandonment figures. S&P Global Market Intelligence’s Voice of the Enterprise survey of 1,006 IT and business professionals in North America and Europe found that the share of companies abandoning most of their AI initiatives before production rose from 17 percent in 2024 to 42 percent in 2025. The average organization scrapped 46 percent of its AI projects between proof of concept and broader adoption. The obstacles respondents put at the top of the list were cost, data privacy risk, and security risk, all of them matters of organizational control rather than model performance.

The Gartner forecast. In a June 2025 press release, Gartner predicted that over 40 percent of agentic AI projects will be canceled by the end of 2027. The three drivers it named were escalating costs, unclear business value, and inadequate risk controls. Gartner also warned about “agent washing,” the rebranding of ordinary assistants and automation tools as autonomous agents, estimating that only about 130 of the thousands of agentic AI vendors offer genuine capabilities. A forecast is not a measurement, and Gartner presents it as a prediction, but the causes it names are the ones the governance claim predicts: two of the three are about value definition and control, not capability.

The IBM breach data. IBM’s 2025 Cost of a Data Breach Report, based on research by the Ponemon Institute across 600 organizations, found that 13 percent of organizations reported a breach of an AI model or application, and that 97 percent of the organizations that experienced an AI-related security incident lacked proper AI access controls. Sixty-three percent of breached organizations had no AI governance policy in place, or were still developing one. The report also documented “shadow AI,” employees using unsanctioned AI tools: it was a factor in 20 percent of breaches, and breaches involving high levels of shadow AI cost about 670,000 dollars more than breaches where shadow AI was low or absent.

Supporters read these findings as a pattern. Across independent research, the stated reasons for failure cluster on the organizational side: no owner, no agreed measure of value, no control over data access, no policy employees could follow. The technology in the failed and successful cases is frequently identical, because it is bought from the same small set of model providers. What varies is the organization wrapped around it.

The Counter-Arguments

The claim has serious critics, and some of the strongest qualifications come from the same sources its supporters quote.

The technology is not finished. In the same press release that contains the cancellation forecast, Gartner analyst Anushree Verma argues that most agentic AI propositions lack value because “current models don’t have the maturity and agency to autonomously achieve complex business goals or follow nuanced instructions over time.” That is a technology explanation from inside the governance camp’s favorite citation. Generative models still produce confident errors, behave inconsistently across long tasks, and require human checking in high-stakes work. A governance framework can decide who checks and how often. It cannot make an unreliable model reliable.

Data quality may be an engineering problem, not a governance one. When Gartner later accounted for generative AI projects abandoned after proof of concept, reporting in January 2026 that the figure had reached at least 50 percent by the end of 2025 against its earlier prediction of 30 percent, the causes it listed put poor data quality alongside inadequate risk controls, escalating costs, and unclear business value. Supporters of the claim tend to file data under governance, since “data governance” is an established discipline. Skeptics reply that this is exactly the claim’s weakness: if every organizational shortcoming, from dirty databases to missing skills, is relabeled governance, the claim can never be wrong. Data pipelines, they argue, are fixed by engineers and investment, not by committees.

The headline numbers measure a narrow thing. The 95 percent figure measures rapid, measurable profit-and-loss impact within months of deployment, in one research program’s sample. The NANDA report itself documents substantial individual productivity gains from general-purpose tools that employees chose themselves. Transformation programs may also pay back on longer horizons than a survey window captures. Critics caution against reading “no measurable impact yet” as “the technology does not work,” and against treating any single percentage as a verdict on a whole field.

Governance can be the obstacle. Oversight has costs. Approval chains slow experiments, compliance work falls hardest on smaller organizations with no dedicated staff, and a policy binder can become theater: documents that exist for audits while real practice continues elsewhere. The NANDA finding that employee-chosen tools often outperformed sanctioned enterprise systems cuts both ways here. It can be read as evidence of missing governance, or as evidence that governance, as practiced, was the friction. Critics of regulation-heavy approaches make a version of the same point about law, arguing that prescriptive rules can entrench large incumbents that can afford compliance departments.

Some constraints are neither governance nor models. Skilled staff are scarce, legacy systems resist integration, and electricity and computing costs are real. Senior executives interviewed in business press describe AI efforts collapsing under internal politics and legacy technology, a mixture that supports both readings at once: the politics is governance, the legacy stack is not.

The Frameworks Used in Practice

Whatever one thinks of the claim, organizations that govern AI mostly do it through a small set of published frameworks. The anchor in the United States is NIST’s.

NIST AI Risk Management Framework (AI RMF 1.0). The National Institute of Standards and Technology published the framework in January 2023 as NIST AI 100-1, after Congress directed it to do so in the National Artificial Intelligence Initiative Act of 2020. NIST describes it as voluntary, rights-preserving, non-sector-specific, and use-case agnostic: it is guidance, not law, and no one is certified against it. Its core is four functions that are meant to run continuously rather than once.

• Govern is the cross-cutting function: the policies, roles, accountability structures, and risk culture that the other functions depend on. It is where an organization decides who may approve a high-risk use case and who owns the consequences.
• Map establishes context for a specific system: what it is for, whom it affects, what data it uses, how it could fail, and what benefits and harms are plausible.
• Measure applies quantitative and qualitative methods to the risks that mapping identified: testing for accuracy, bias, security weaknesses, and unsafe outputs, and tracking those measures over time.
• Manage decides what to do about measured risks: prioritize them, mitigate or accept them, monitor the system in operation, and respond when incidents occur.

The framework also names seven characteristics of trustworthy AI systems: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. In July 2024 NIST added a companion document, the Generative AI Profile (NIST AI 600-1), applying the framework to the specific risks of generative systems.

ISO/IEC 42001. Published in December 2023, this is the first international standard specifying requirements for an AI management system: the policies and processes by which an organization governs AI across its life cycle. Unlike the NIST framework, it is certifiable; accredited bodies can audit an organization against it. It governs the organization rather than any single model, following the plan, do, check, act structure used by other ISO management standards.

The EU AI Act. Regulation (EU) 2024/1689, in force since August 2024, is governance imposed from outside the organization. It regulates by risk: some practices are prohibited outright, high-risk uses such as hiring and credit decisions carry a full compliance regime of documentation, data governance, and human oversight, and most other AI is subject to few or no obligations, with the requirements phasing in over several years. Any company whose systems are used in the European Union can fall within its scope, wherever the company is based.

Principles frameworks. The OECD AI Principles, adopted by member governments, sit at the level of values: they call for AI that respects human rights and democratic values, with transparency and accountability for outcomes. They do not specify controls, but much of the vocabulary used in the frameworks above originates there.

What Governance Looks Like When It Works

Strip the frameworks down and they converge on a handful of practices, each of which maps to a failure in the evidence above.

A named, accountable owner for each significant system, so that “the AI did it” is never a complete answer. An inventory of what AI is actually in use, including the tools employees adopted themselves, because unmeasured shadow AI is where the IBM breach findings concentrate. Approval proportionate to risk: a spelling assistant needs a light touch, a system that scores loan applicants needs documented testing, human oversight, and an appeal route. Access controls on data, enforced technically rather than by memo. A defined measure of value agreed before scaling, so that a pilot is judged against a target rather than enthusiasm. Monitoring after launch, since models and the data they consume drift, plus a rehearsed way to pause or shut a system down. None of this is a model improvement. All of it is deciding, in advance, how decisions about AI get made.

A Balanced Reading

The evidence supports a narrower version of the claim more strongly than the slogan. The narrower version: for organizations deploying today’s AI, the most common recorded causes of failure are organizational, and better governance removes several of them. The slogan version, that transformation is a governance problem rather than a technology problem, overstates matters. Model reliability, data readiness, skills, and cost are genuine constraints, some of them technical to the core, and governance cannot repeal them.

A useful test when meeting the claim in the wild is to ask three questions. Which failure is being described, a pilot that stalled, a breach, a budget cut? Which cause does the evidence actually name, and is it a decision-and-control cause or a capability cause? And is the speaker selling governance services? The claim is most often repeated by firms that do. That does not make it wrong. It makes it a claim, and claims are for checking.

Frequently Asked Questions

What does “AI transformation is a problem of governance” mean?

It means the speaker believes AI programs usually fail for organizational reasons: unclear ownership, no agreed definition of success, uncontrolled data access, weak risk controls, and compliance gaps, rather than because the models are not capable enough. It is an argument about where the bottleneck sits, not a measurement.

What is AI governance?

AI governance is the set of policies, roles, and controls through which an organization directs its use of AI: who approves systems, what data they may use, how outputs are checked, how performance and incidents are monitored, and who is accountable for outcomes. Frameworks such as NIST’s AI Risk Management Framework organize this work.

Is the claim proven?

No. It is an interpretation of survey and analyst research. The underlying findings are real but narrower than the slogan: for example, the widely quoted 95 percent figure from MIT’s Project NANDA measures organizations reporting no measurable profit-and-loss impact from generative AI in 2025, within that study’s sample and time frame. Other findings point in the same direction, and some point to genuine technology limits.

Does good governance guarantee that AI transformation succeeds?

No. Governance addresses organizational failure modes: unclear accountability, unmeasured value, uncontrolled risk. It does not improve a model’s underlying capability, fix poor data by itself, or make a weak use case valuable. The frameworks themselves present governance as risk management, not as a success formula.

What is shadow AI, and why does it matter here?

Shadow AI is the use of AI tools by employees without their organization’s knowledge or approval, the counterpart of shadow IT. IBM’s 2025 breach research found it was a factor in 20 percent of breaches and added substantially to breach costs. Governance advocates cite it as the clearest case of adoption outrunning control; critics note it also shows employees route around official channels when those channels are slow.

Conclusion

“AI transformation is a problem of governance” survives scrutiny as a corrective and fails it as a complete explanation. As a corrective, it points at something the survey record genuinely shows: organizations deploying identical technology get wildly different results, and the recorded causes of failure are dominated by ownership, value definition, data control, and risk management. As a complete explanation, it absorbs too much, relabeling engineering and capability problems as governance until the claim explains everything and therefore very little. The frameworks that have emerged, NIST’s AI Risk Management Framework above all, are best read as the practical residue of the debate: whatever the true ratio of causes, the governance share of them is real, named, and fixable, and the organizations in the successful minority of every survey are the ones that treated it that way.

Keep reading: What Is a Neural Network? How It Works, in Plain English

Keep reading: When Was the Internet Invented — and Who Invented It?

Sources & references

• NIST (National Institute of Standards and Technology), Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023: the four core functions (Govern, Map, Measure, Manage), the seven characteristics of trustworthy AI, and the framework's voluntary, rights-preserving, non-sector-specific character; companion Generative AI Profile, NIST AI 600-1, July 2024.
• Challapally, A., and colleagues, Project NANDA (MIT Media Lab), "The GenAI Divide: State of AI in Business 2025": review of more than 300 publicly disclosed initiatives, interviews at 52 organizations, and 153 survey responses; about 95 percent of organizations reported no measurable profit-and-loss impact despite an estimated 30 to 40 billion dollars of enterprise generative AI spending; external partnerships reached deployment roughly twice as often as internal builds.
• S&P Global Market Intelligence, Voice of the Enterprise survey (1,006 IT and business professionals, North America and Europe), 2025: companies abandoning most AI initiatives rose from 17 percent in 2024 to 42 percent in 2025; an average of 46 percent of AI projects scrapped between proof of concept and broader adoption; cost, data privacy, and security risk the leading obstacles.
• Gartner, press release, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027," June 25, 2025: forecast and its stated drivers (escalating costs, unclear business value, inadequate risk controls); the estimate that only about 130 of thousands of agentic AI vendors offer genuine capabilities; analyst comment on the limits of current models' maturity and agency.
• IBM, Cost of a Data Breach Report 2025 (research by the Ponemon Institute, 600 organizations): 13 percent of organizations reported a breach of an AI model or application; 97 percent of organizations with an AI-related incident lacked proper AI access controls; 63 percent of breached organizations had no AI governance policy or were still developing one; shadow AI was a factor in 20 percent of breaches, and breaches with high levels of shadow AI cost about 670,000 dollars more than those with low or no shadow AI.
• ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (December 2023): the first international standard specifying requirements for an AI management system, certifiable by accredited bodies.
• Regulation (EU) 2024/1689 (the EU AI Act), in force August 1, 2024: risk-based regulation of AI, with prohibitions on some practices, a compliance regime for high-risk uses, and obligations phasing in over several years.
• Encyclopaedia Britannica (britannica.com), "Artificial intelligence": definition of AI as the ability of a digital computer or computer-controlled robot to perform tasks commonly associated with intelligent beings.