Companies can keep deploying AI while public debate focuses on slowing the development of frontier models: these are different decisions. The practical challenge is to make adoption responsible, especially as AI agents gain the ability to access data and take actions. A 2026 OneTrust survey found that respondents reported much more encouragement of agent use than clear governance controls—evidence of a gap in that sample, not proof that every organization should move faster.
Why AI adoption can continue during calls to slow AI development
“Slow down AI” can refer to the pace of developing increasingly capable models. Enterprise adoption asks a different question: whether and how to use tools that already exist. An organization can support stronger safeguards or debate limits on frontier development while still integrating available AI into its own operations.
As an Amazon Associate I earn from qualifying purchases.
In a September 21, 2026 interview with TechTarget/AI Business, Blake Brannon, OneTrust’s chief innovation officer, described pressure from boards to transform and avoid disruption as a force behind enterprise adoption. That is his explanation of the momentum, not evidence that all boards or companies share the same priorities. He also cautioned that usefulness depends on trust: “You can create all this great AI, but if you do not trust it, you cannot turn it loose.” Read the interview.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the 2026 OneTrust survey says about adoption and incidents
OneTrust’s 2026 AI-Ready Governance survey points to a gap between reported agent encouragement and reported controls. Sapio Research surveyed 1,200 senior business decision-makers in Australia, Canada, France, Germany, Singapore, Spain, the United Kingdom, and the United States in June and July 2026. Participating organizations had at least $100 million in annual revenue; the sample was equally represented by CPO, CDO, CISO, and CMO respondents. These are self-reported results from a vendor-sponsored survey, not a census of all enterprises.
| Survey finding | What respondents reported |
|---|---|
| Agent use and controls | 87% said their organization encouraged AI agent use; 47% said clear governance, oversight, and controls were in place. |
| AI-related incidents | 86% said their organization experienced at least one measured AI-related incident in the previous year; 28% reported two or more incidents in which AI systems or agents took unapproved actions. |
| Response to incidents | 27% said their organization slowed or paused AI deployment in response to incidents. |
| Unapproved AI use | 33% said employees had used unapproved AI because approved tools or processes were not available quickly enough. |
| Governance investment plans | 98% planned to increase AI governance technology budgets in the next financial year, with an average planned increase of 25%. These are plans, not actual spending. |
The figures describe the survey’s respondents and definitions; they should not be generalized to all organizations. OneTrust published the survey findings on September 14, 2026. See OneTrust’s survey report and its survey findings.
#1 Best Overall
Why agent governance needs to focus on actions
Traditional review processes were built around people working at human speed. Agents can let more employees assemble systems that act quickly, so a policy document or pre-launch review may not be enough on its own. Brannon’s proposed focus is the point where an agent interacts with business systems or initiates a consequential action: reading enterprise data, sending email, or deleting a record.
That is a recommendation from Brannon, not a regulatory requirement or established consensus standard. His reasoning is that governance should be independent of any one model or provider and should apply where access and actions can be controlled. He also argues that potentially destructive actions need human involvement, and that agent behavior should fit an organization’s compliance obligations, security practices, and brand commitments.
Rank #2
How to assess whether governance is keeping pace
Organizations can use a few concrete questions to find gaps. The survey figures below are OneTrust’s reports about its respondents, not universal benchmarks.
- Visibility: Can teams identify both sanctioned and unsanctioned AI use? OneTrust reported that 48% of respondents had clear visibility into both, while 46% had visibility into approved AI but limited visibility elsewhere.
- Pre-deployment review: Are AI use cases assessed and approved before launch? OneTrust recommends approval workflows; it reported that 45% of incident-affected organizations had implemented formal AI review and approval processes.
- Action controls: Can policy be enforced at the points where agents reach data, tools, and workflows? Decide which actions require a person to approve them, particularly when they could cause lasting or difficult-to-reverse effects.
- Monitoring and ownership: Does someone remain accountable after deployment, with monitoring and evidence connected across the AI lifecycle? OneTrust reported departmental or scaled AI adoption at 74% of surveyed organizations, use across multiple business functions or embedding in business processes at 52%, and clear coordination and accountability across the AI lifecycle at 5%.
- Framework alignment: Are internal controls mapped to a recognized risk-management framework and applicable obligations? Mapping can help organize work, but it does not by itself establish compliance.
Frameworks and governance software: what they do—and do not—establish
NIST describes its AI Risk Management Framework as a voluntary resource and its official page notes that AI RMF 1.0 is being revised in 2026. The page also links to generative AI risk-management material. The action-point approach discussed by Brannon should not be described as mandated by NIST. Check NIST’s AI RMF page for its current status and materials.
Enterprise AI governance software is one possible way to organize assessments, approvals, monitoring, and evidence. OneTrust’s product page describes capabilities including system assessment, risk tiering, monitoring, and reporting, and says its product aligns with NIST AI RMF, the EU AI Act, and ISO/IEC 42001. Those are the vendor’s descriptions of its own offering, not independent evidence of product performance or a guarantee that a customer complies with any law or standard. Review OneTrust’s product information and verify specific capabilities and obligations directly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
