5 Common Misconceptions About AI Governance

This is an abridged adaptation of my original article published on Substack. Read the full article.

Introduction: What Is AI Governance?

AI governance is an emerging field that, somewhat amusingly, doesn't have a universally agreed-upon definition. As with many other professions, what it should entail, how to go about it, and to what extent it should be applied vary depending on the standards and approaches of those who practice it.

Broadly speaking, AI governance refers to the policies, processes, responsibilities, and oversight arrangements that guide how organizations develop, deploy, and use AI systems. At an organizational level, this is sometimes described as enterprise AI governance, particularly when coordinating governance across an organization's operations, products, and business functions.

Yet despite its growing relevance to businesses, several misconceptions persist about what AI governance involves and why it matters.

1. SMBs Don't Need AI Governance

“We're a small organization. If something comes up, we'll deal with it.”

AI governance is not exclusively for large enterprises. Its relevance depends on how an organization uses or develops AI, along with the associated risks and responsibilities. While smaller organizations don't necessarily need the same sophisticated, costly governance investments as large enterprises, they are no less capable of encountering consequential AI risks simply because they lack complex organizational structures.

Here's a recent example: In April 2026, PocketOS, a small software company serving car-rental businesses, experienced an incident in which an AI coding agent inadvertently deleted its production database and associated backups. The agent used an API token with overly broad permissions, executing the action without authorization. Although the cloud infrastructure provider, Railway, subsequently recovered the data, customer operations were disrupted.

The incident also demonstrates that AI governance problems don't necessarily remain confined to the organization using the technology. PocketOS, its customers, its infrastructure provider Railway, and the developers of the AI tools involved all occupied different positions within the wider network of stakeholders affected by, or relevant to, the incident.

Even businesses using AI for less consequential activities need to consider issues such as customer data, inaccurate outputs, and the circumstances under which human intervention is necessary. Organizational size alone doesn't determine the relevance of AI governance.

2. AI Governance Is Just Having an AI Policy

“We'll just copy an AI policy we found online or write a general one. That should be enough indefinitely.”

While an AI policy establishes expectations, meaningful governance depends on how those expectations are implemented and maintained. For the health of an organization, an AI policy is better understood as a starting point, rather than a comprehensive substitute for organizational accountability.

Written policies are not the same as operational arrangements. Assigning responsibilities, approving AI use cases, and reviewing decisions are ongoing activities that documentation alone cannot address.

A 2026 CIRA study found that 50% of surveyed Canadian organizations had an AI policy, while another 36% were developing one. A separate Ivanti study found that only 24% of employees at companies with AI policies reported that those policies were followed very consistently.

These findings do not mean that organizations struggling to implement AI policies have failed in their efforts. Establishing and operationalizing governance is a legitimate challenge, particularly for smaller businesses with limited resources or access to specialized expertise.

This is where AI governance specialists bring value: translating broad principles and policies into arrangements suited to an organization's needs, including identifying risks, clarifying responsibilities, and establishing oversight procedures. That doesn't mean a small business needs to shell out a hefty amount for governance consulting before adopting AI. Even a brief engagement can help steer an organization in the right direction as it begins implementing AI in its operations.

3. AI Governance Can Wait Until Regulation Arrives

“Why should we worry about AI governance when the government hasn't even established comprehensive AI regulations?”

Some organizations may—understandably—associate AI governance primarily with regulatory compliance. However, treating AI-specific legislation as a prerequisite for governance overlooks the broader purposes it serves.

Organizations already make decisions about how AI is developed, deployed, and used, regardless of whether specific legislation governs those activities or how formalized these decisions are internally. Questions about acceptable risks, accountability, data practices, and oversight do not suddenly become relevant once legislation is introduced. They already affect organizational operations, customers, and other parties.

Furthermore, the absence of comprehensive AI-specific legislation doesn't mean the absence of existing legal obligations. Depending on the circumstances, privacy, consumer protection, human rights, and other laws already apply to aspects of organizational AI use. Data protection and AI governance, for instance, frequently overlap.

Governmental regulation establishes expectations and clearer responsibilities, but it cannot substitute for the decisions organizations must make about their own AI activities. Governance serves purposes beyond compliance, including managing risks and supporting informed decisions about AI development and use. Therefore, it's not so much a question of whether a company is governing its AI use, but rather how well its stakeholders understand their current situation and how deliberately they choose to engage with it.

4. IT Expertise Is All You Need to Govern AI

“AI governance? So how do you implement AI?”

This is one of the most prominent misconceptions I've encountered in my interactions with others, regardless of whether they work in tech or AI-related fields. For those outside these fields, hearing “AI” may lead them to associate governance with software engineering or technical implementation. For those already working in tech, there may instead be a lack of familiarity with what distinguishes AI governance from their existing work.

A 2026 Barracuda survey of 2,000 IT and security decision-makers found that 38% reported their teams lacked the expertise needed to secure and govern AI tools across their organizations.

This is not to suggest that AI governance has little to do with IT. Quite the contrary, technical professionals play an important role in identifying and addressing AI-related risks. However, AI governance is inherently interdisciplinary, drawing on organizational management, law, ethics, risk assessment, technology, and other fields.

The IAPP's 2026 AI Governance Skills Framework identifies distinct areas of governance work spanning technical, policy, risk, legal, and assurance functions.

An understanding of how AI systems function is important, but expertise in AI governance does not necessarily require the ability to develop or implement those systems. Likewise, technical implementation expertise does not automatically encompass the responsibilities of AI governance.

Effective AI governance depends on these areas of expertise working together rather than operating independently. For the sake of professional development, IT professionals and AI governance specialists should recognize the purposes of each other's work and identify opportunities to complement one another. As AI governance continues to develop as a profession, those working within it have an opportunity, and even a responsibility, to establish solid foundations for future practice. This includes recognizing the value of different areas of expertise and encouraging collaboration between the professionals involved.

5. AI Governance Inherently Impedes Innovation

“AI governance means less profit and less innovation for little to no upside.”

The criticism that AI governance impedes the benefits of AI is a salient point, particularly for smaller organizations seeking rapid growth. However, this overlooks the distinction between different approaches to governance, including externally imposed regulations and internal organizational arrangements.

AI governance and innovation are not inherently incompatible. Particular governance approaches, however, impose disproportionate costs, create uncertainty, or unnecessarily restrict innovation.

The European Union's AI Act is the prime case study for this issue. While intended to promote trustworthy AI development and protect fundamental rights in an ostensibly “human-centric” manner, it has faced criticism for its regulatory complexity, compliance burdens, and potential effects on international competitiveness. Some implementation concerns were later acknowledged by EU institutions, contributing to the adoption of Regulation (EU) 2026/1744 in July 2026.

Yet the shortcomings of particular regulatory approaches should not be confused with the broader purpose of AI governance. Externally imposed requirements cannot always accommodate the circumstances of individual organizations, whereas governance specialists develop arrangements tailored to their activities, responsibilities, and risk exposure.

AI implementation and governance specialists also complement each other's work. While IT-focused implementation specialists identify opportunities for adoption and develop suitable solutions, governance specialists address the risks, accountability, and oversight considerations associated with those decisions. Addressing these matters during implementation helps organizations mitigate future complications while pursuing their objectives.

In much the same way that lawyers can arrive at different interpretations of the same law, AI governance specialists may disagree about the most appropriate approach to a particular situation. There is no single solution that suits every organization. Voluntary frameworks such as NIST's AI Risk Management Framework offer organizations the flexibility to adopt risk-management practices according to their circumstances rather than merely ticking regulatory checkboxes.

It is my professional opinion that AI-adopting organizations would find it in their best interest to voluntarily establish governance arrangements alongside their adoption efforts. Doing so benefits them far more in the long term than foregoing governance altogether. Interdisciplinary collaboration between technical and non-technical specialists, drawing on their respective AI governance expertise, can produce more effective and proportionate arrangements than an unnecessarily heavy-handed regulatory approach.

For a more detailed discussion of these misconceptions, the supporting research, and my perspective on AI governance and innovation, read the full article on Substack.

Terms of Service - Privacy Policy - Cancellation & Refund Policy