Many organizations already have the beginnings of an AI governance program. There’s an acceptable use policy, a responsible AI statement, maybe a committee that meets quarterly to talk about risk. For some time now, that’s been enough to say the organization “has AI governance.”
That’s changing, and it’s changing faster than most governance programs have adjusted for. The shift isn’t about whether organizations have the right principles written down. Most do. It’s about whether they can prove, on demand, that those principles were followed for a specific system, on a specific date, by a specific person.
The current state
Regulators, auditors, and courts are no longer satisfied with a policy document. They want to see documented processes and evidence: risk assessments for specific systems, logs of human review, records showing who approved a given use of AI and when. The EU AI Act’s transparency requirements, state AI laws working through legislatures across the country, and the broader shift toward mandatory compliance frameworks all point the same direction. AI governance in 2026 is being judged by evidence of what really happened, not by the quality of the principles written down in advance.
That’s a meaningful shift in what “good governance” requires. A well-written policy used to be most of the job. Now it’s the starting point. An organization can have a strong acceptable use policy, a responsible AI committee, and a public commitment to ethical AI, and still fail an audit, because none of those things produce a record that a specific system was reviewed, approved, and monitored the way the policy said it would be.
The artifacts regulators are asking for are specific: model risk assessments, data protection impact analyses, logs showing a human reviewed a high-stakes output before it was used, and a record of who signed off on a system before it went into production. These aren’t new concepts. Most of them have existed in some form in financial services model risk management or in privacy impact assessments for years. What’s new is the expectation that this kind of documentation exists for AI systems specifically, at the pace those systems are being adopted.
The observation
This shift exposes a structural problem that most organizations haven’t addressed: no single function wholly owns the full evidence trail for AI governance.
Legal typically owns risk interpretation and regulatory response. IT owns the tools themselves, along with access and usage logs. Privacy owns questions about what data an AI system touches. Records management and information governance own retention, classification, and the underlying question of what must be kept and for how long. Each of these functions holds a piece of what a regulator or a court would eventually ask for. None of them holds the whole thing.
That fragmentation doesn’t show up as a problem day to day. Everyone is doing their job. It shows up the moment someone asks a specific question: show me that this AI system was reviewed before deployment, show me who approved it, show me that a person exercised oversight over its output. Answering that requires pulling evidence from four different functions that don’t currently coordinate around a shared record.
Why the gap exists
This isn’t a failure of any one team. It’s a byproduct of how these functions were built in the first place. Legal, IT, privacy, and information governance each grew up around a different mandate, at different points in time, usually well before AI was a factor. Legal’s processes were built around litigation and regulatory response. IT’s were built around uptime, security, and access control. Privacy’s were built around personal data handling, largely in response to GDPR and its successors. IG’s were built around retention schedules and regulatory obligations that predate AI by decades.
When AI arrived, most organizations didn’t redesign ownership across these functions. They added AI-related tasks to each function’s existing workload instead: legal reviews new AI vendor contracts, IT manages access to AI tools, privacy assesses data flows into AI systems, IG and Records figure out what to keep. That’s a reasonable short-term response, but it means the evidence produced by each function was never designed to connect to the others. Nobody owns the seam between them, and the seam is exactly where regulators are now looking.
Why this matters
The organizations that struggle here aren’t the ones without governance. They’re the ones with governance spread across departments that each did their part correctly, without anyone responsible for assembling the whole picture. When a regulatory inquiry or a discovery request lands, what should be a straightforward production often becomes a multi-week scramble to reconstruct a history that was never centrally documented in the first place.
This is the same pattern that shows up in other parts of information governance: policy defines the rules, but nobody has ownership of proving the rules were followed. The difference with AI is that the number of systems, the pace of adoption, and the specificity of what regulators are asking for all make that gap far more expensive to leave unaddressed. A single ungoverned shared drive is a cleanup project. A portfolio of AI systems without a documented evidence trail is a recurring exposure that grows every time a new tool gets adopted.
Common mistakes
A few patterns show up consistently in organizations that get caught flat-footed. The most common is assuming that committee minutes or a policy sign-off count as evidence of ongoing oversight, when what’s needed is a record tied to a specific system, not a general statement of intent. A close second is treating evidence collection as one department’s responsibility rather than a shared obligation with defined handoffs, which is exactly the fragmentation problem described above. A third is building the evidence trail reactively, after an incident or an inquiry, rather than as a standing part of how new AI tools get adopted. And a fourth is assuming that because a system was reviewed once at launch, that review still reflects how the system is being used a year later.
The recommendation
Closing this gap starts with ownership, not with more policy.
Assign a single accountable role, not necessarily a new department, but one function responsible for assembling and maintaining the complete evidence trail for each AI system in use. This role doesn’t need to do the underlying work of every other function; it needs the authority and the mandate to pull the pieces together and know when something is missing.
Map which function currently owns each type of evidence: risk assessments with legal, usage logs with IT, data handling with privacy, retention and classification with records management. Then formalize the handoffs between them, in writing, so evidence doesn’t live only in someone’s inbox or get lost when a person changes roles.
Require every AI system in active use to have a documented record covering approval, risk classification, human oversight steps, and the data it touches. That record should be reviewed on a defined cadence, ideally quarterly for higher-risk systems, rather than created once at launch and never revisited.
Finally, build this evidence requirement into how new AI tools get adopted in the first place. If documentation is part of the intake and procurement process, it’s far cheaper to maintain than if it’s bolted on after a system is already in production and the people who built it have moved on to something else.
What this looks like when it works
A mature version of this doesn’t look dramatically different from the outside. Employees still use AI tools the same way. What’s different is that behind each system sits a short, current record: what it does, who approved it, what data it touches, and evidence that a person is really watching it. When a question comes in, whether from a regulator, an auditor, or opposing counsel, the answer is a retrieval exercise, not a research project.
The business value
None of this is about adding bureaucracy to AI adoption. It’s about making sure the organization can answer a specific question quickly when it’s asked, instead of discovering during an audit or a lawsuit that the pieces exist but were never connected. A governance program with clear ownership of its evidence trail moves faster when adopting new AI tools, not slower, because the documentation requirement is already built into the process rather than reinvented every time. It also gives the organization a consistent answer across every system, rather than a different level of rigor depending on which department happened to be paying attention.
Policy was never the hard part. Proving the policy was followed is, and that’s the work most AI governance programs still have ahead of them.
The information you obtain at this site, or this blog is not, nor is it intended to be, legal or consulting advice. You should consult with a professional regarding your individual situation. We invite you to contact us through the website, email, phone, or through LinkedIn.