Most organizations now have an AI policy. Most of those policies are documents, not controls. The 2026 breach data measures the difference, and it is expensive. Breaches involving unsanctioned AI tools now cost more than the global average, and the organizations writing the most policy prose often have the least enforcement behind it. If you cannot say which of those two groups you are in, that is the first finding.
The gap between policy and control is widening, not closing
IBM’s Cost of a Data Breach Report 2026, built on 602 breached organizations across 16 countries, shows the direction of travel. Shadow AI incidents more than doubled year over year, from 20% to 43% of AI-related security incidents. Breaches involving shadow AI averaged $5.39 million against a $4.99 million global baseline, and roughly one in five breaches drew a regulatory fine on top.
The governance numbers moved the wrong way at the same time. The share of breached organizations with no AI governance at all rose from 63% to 68%. The share requiring IT approval before an AI tool is deployed fell from 45% to 38%. Only 19% said their AI governance and security teams coordinate with each other. Adoption accelerated, oversight loosened, and the policy documents got longer.
Employee behavior explains why the prose does not hold. Cyberhaven’s telemetry, as reported in 2025, found that around 77% of employees paste data into generative AI prompts, most of it through personal accounts your controls never see. The same telemetry shows the sensitive share of corporate data flowing into AI tools roughly tripled in two years, from about 11% to about 35%. A policy that says “no confidential data in public AI tools” while nothing on the endpoint or the network checks is a wall with no gate.
A ban is also a policy, and it fails the same way
The instinct after a scare is to prohibit. The data suggests prohibition mostly relocates the risk. When the sanctioned path is slow or absent, usage moves to personal accounts on personal devices, exactly where the Cyberhaven numbers say most sensitive pastes already happen. You lose the telemetry, keep the exposure, and gain false confidence. The organizations doing this well treat speed of approval as a security control: a request path for a new AI tool that answers in days, not quarters, is what keeps usage inside the boundary where you can see it.
Five tests that separate a policy from a program
Run these against your own environment. Each one is answerable this week, and each maps to a failure mode in the 2026 data.
1. The inventory test. Can you produce, today, a list of every AI tool, model, integration and agent that touches company data, including the ones nobody approved? If the honest answer is no, you are in the 68% with no effective governance regardless of what the policy document says. Discovery comes before rules: egress logs, CASB and SaaS-management data, and expense reports all reveal AI usage you did not sanction.
2. The control test. Pick any prohibition in your policy and name the technical control that enforces it. “No customer data in public AI tools” should map to DLP or browser-level paste controls on AI destinations. “Approved tools only” should map to network policy and SSO. Where a clause maps to nothing, you have written a hope, not a rule.
3. The identity test. Among organizations whose own AI models were attacked, 92% had failed to properly control access to those tools, and only about four in ten limit access to their AI systems at all. Every model endpoint, service account and agent needs a scoped, auditable identity with least privilege. Agents deserve particular attention: an agent that can read email, browse and execute actions is a new privileged identity, and most identity programs have not caught up to it.
4. The incident test. Does your incident response plan have an AI lane? Prompt injection against an internal assistant, a vendor’s AI feature leaking your data, an agent taking a destructive action, an employee pasting a customer list into a chatbot: each needs an owner, a severity mapping and a playbook. Incidents involving organizations’ own AI models roughly doubled as a share of breaches in a single year. If the first AI incident triggers an argument about whose queue it lands in, the plan failed before the incident started.
5. The regulatory test. If you operate in or sell into the EU, the AI Act’s general application date arrived on August 2, 2026. Transparency obligations under Article 50 apply, enforcement against general-purpose AI providers has begun, and the penalty regime is live, up to 35 million euros or 7% of global turnover for prohibited practices. The Digital Omnibus, Regulation (EU) 2026/1744, published July 24, 2026, deferred the stand-alone high-risk obligations to December 2, 2027 and embedded high-risk systems to August 2, 2028. That is breathing room for classification and conformity work, not a cancellation. Your policy should already map to a recognized frame, whether NIST’s AI RMF or ISO/IEC 42001, so the 2027 deadline is a milestone rather than a scramble.
What passing looks like
Organizations that score well on these tests share a shape. They maintain a living AI inventory and review it on a cadence. They publish a short allowed-tools list with a fast lane for adding to it. They enforce the data rules technically at the browser, network and API layers rather than by memo. They give models and agents scoped identities and log what those identities do. They rehearse at least one AI incident scenario a year. And they assign the program a single accountable owner who sits close to security. The 19% coordination figure is the quiet scandal in IBM’s numbers: most organizations have split AI governance and security into teams that do not talk.
None of this requires a large program to start. It requires deciding that the policy is a system with feedback, not a PDF with a signature page.
Bottom line: what to ask your team this week
Ask for the AI inventory and time how long it takes to produce. Ask which policy clauses are technically enforced and which are prose. Ask who owns an AI incident at 2 a.m. Ask how long approval of a new AI tool takes, since that number predicts your shadow AI rate better than any awareness campaign. The answers tell you whether the policy protects the organization or just documents intent.