Insights

Independent data points in the same direction: organizations are using AI faster than they are putting the data, ownership, and oversight around it.

Use is widespread and incidents are rising

The Stanford Institute for Human-Centered AI reports that the share of survey respondents whose organizations use AI rose to 78% in 2024, up from 55% in 2023. The AI Incidents Database recorded 233 AI-related incidents in 2024, a record high and a 56.4% increase over 2023.

Many projects are not set up to succeed

Gartner predicted in February 2025 that, through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data. The same release reported that 63% of organizations either lack, or are unsure whether they have, the right data management practices for AI. A RAND Corporation report from August 2024 noted that, by some estimates, more than 80% of AI projects fail, twice the rate of IT projects that do not involve AI.

Unreviewed AI output is its own risk

In May 2026, a Big Four firm’s Canadian practice withdrew a cybersecurity report after researchers found that most of its citations were fabricated or misreferenced. The lesson is that human review of AI-assisted work is a control, and it needs an owner.

Where to start

• Inventory the AI in use, including tools staff adopted on their own.
• Assign an owner and a risk assessment to each system.
• Check that the data feeding each use case is fit for purpose and permitted.
• Define review requirements for AI-assisted work products.
• Align the program to ISO/IEC 42001 and the NIST AI RMF so you can evidence it.

That is the sequence the AI Governance Readiness Review follows.

Sources

• Stanford HAI, AI Index 2025: State of AI in 10 Charts
• Gartner, Lack of AI-Ready Data Puts AI Projects at Risk, February 26, 2025
• RAND Corporation, The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed, August 13, 2024
• Australian Computer Society, Information Age, report on the withdrawn cybersecurity report, May 19, 2026 (article)

This article is general information, not legal advice. Case details are drawn from the public sources listed above.

If an AI tool speaks for your organization, your organization answers for what it says. Two public cases make the point.

An airline chatbot invented a refund policy

In a decision issued on February 14, 2024, a British Columbia tribunal considered a customer who asked an airline’s website chatbot about bereavement fares. The chatbot described a refund process that conflicted with the airline’s own policy page. The airline argued it could not be held responsible for what its chatbot said. The tribunal called that “a remarkable submission,” reasoned that the chatbot is part of the airline’s website, and found the airline had not taken reasonable care to ensure the chatbot was accurate. The airline was ordered to compensate the customer for the fare difference, plus interest and fees.

The award was small. The principle is not: a chatbot is not a separate legal entity, and a disclaimer in the fine print does not move responsibility to the tool.

A city chatbot told businesses to break the law

In March 2024, an investigation by The Markup tested a municipal chatbot built to help small business owners. It reported answers that contradicted local law, including saying landlords did not have to accept tenants using housing vouchers, that restaurants could refuse cash, and that employers could take workers’ tips. The city described the tool as a pilot that would keep improving. The investigation also found the answers varied from one attempt to the next.

What this means for governance

• Inventory every customer-facing AI tool, including those a vendor provides under your brand.
• Name an owner who is accountable for each tool’s accuracy, and define what it is allowed to answer.
• Test against your own policies before launch and on a schedule, because answers can change between attempts.
• Give vendors contract requirements for testing, logging, and incident notice, and review them at selection time.
• Keep a path to a human for anything with legal, financial, or safety consequences.

These are the kinds of controls an AI management system under ISO/IEC 42001 asks you to define and evidence, and they are what a vendor evaluation should check before you sign.

Sources

• British Columbia Civil Resolution Tribunal, decision 2024 BCCRT 149, February 14, 2024 (full decision)
• The Markup, “NYC’s AI Chatbot Tells Businesses to Break the Law,” March 29, 2024 (article)
• ISO, ISO/IEC 42001:2023

This article is general information, not legal advice. Case details are drawn from the public sources listed above.

In early 2024 a multinational engineering firm confirmed that an employee in Hong Kong had been tricked into sending a multimillion-dollar sum after a video call with what appeared to be the company’s chief financial officer and colleagues. The people on the call were AI-generated.

What happened

According to CNN Business and Hong Kong police, the employee first received a message that seemed like phishing and was suspicious. The video call, with faces and voices he recognized, removed his doubts. He made 15 transfers. The company said its systems were not compromised and its operations were not affected; the fraud worked on a person, not a network.

Why this matters for governance

The control that failed was recognition: seeing and hearing someone is no longer proof of who they are. Security awareness training alone does not fix that. A written, enforced process does.

Controls a defensible program includes

• Out-of-band verification: confirm any unusual payment request through a separate, known channel, not the channel the request arrived on.
• Dual approval and amount thresholds for wires, enforced by the payment system rather than by memory.
• A defined cooling-off or escalation step for urgent or secret requests.
• Procedures that give every employee explicit permission to pause a request from an executive.
• Tabletop exercises that include a deepfake scenario, and an incident path for reporting one.

These controls sit across security, finance, and AI governance, which is why we treat them as one program. See our fractional CISO and GRC advisory or the AI Governance Readiness Review.

Sources

• CNN Business, report on the deepfake video-call fraud, May 16, 2024 (article)

This article is general information, not legal advice. Case details are drawn from the public sources listed above.

Customers and investors increasingly ask for a SOC 2 report. Here is what that means, what you do before the examination, and who does what.

What SOC 2 is

The AICPA describes System and Organization Controls (SOC) as a suite of services that certified public accountants may provide in connection with the system-level controls of a service organization. A SOC 2 report is the version most technology and service companies are asked for. It is issued by a CPA firm after it examines your controls against the Trust Services Criteria.

What the examination covers

The Trust Services Criteria are organized into five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Organizations typically include Security and add the others based on what their customers need. A Type I report speaks to the design of your controls at a point in time. A Type II report covers how those controls operated over a period, which is why customers often prefer it and why evidence has to be collected well before the examination.

What readiness work involves

• Decide scope: the systems, the criteria, and whether Type I or Type II fits your timeline.
• Assess gaps between your current controls and the criteria, and prioritize fixes.
• Write the policies and procedures, run a risk assessment, and assign owners.
• Set up routine evidence collection so the audit period is not a scramble.
• Run a readiness review before the audit window opens.

Where advisors stop

A licensed CPA firm performs the examination and issues the report. An advisor can help you prepare and can coordinate with the CPA firm you choose, but cannot perform the examination or give you an assurance opinion. Readiness work does not guarantee a particular result. The AICPA’s SOC page also advises that organizations and CPA firms thoroughly evaluate the SOC services they use, so ask any provider who will perform the examination and how.

Practical tips

• Talk to CPA firms early. Their expectations shape how you scope and collect evidence.
• Start evidence collection before the audit period, not at the start of it.
• Fix the control, not the paperwork: auditors test whether controls actually operate.

See our SOC 2 readiness overview or support for portfolio companies.

Sources

• AICPA & CIMA, System and Organization Controls (SOC)

This article is general information, not legal advice. Case details are drawn from the public sources listed above.