Schaumburg, IL, USA —Organizations are accelerating their use of artificial intelligence, but many remain unprepared to manage the risks that accompany it. Early findings from the 2026 AI Pulse Poll suggest that governance, oversight, and incident response capabilities are not keeping pace with deployment.
The global survey, conducted by ISACA and released in preview on March 23 at the RSA Conference 2026, gathered responses from more than 3,400 digital trust professionals across IT audit, cybersecurity, governance, privacy, and emerging technology roles. The results point to structural gaps in how organizations control, monitor, and take responsibility for AI systems.
A central concern is the ability to respond to security incidents involving AI. Fifty-six percent of respondents said they do not know how quickly they could halt an AI system if required. Only 32 percent believe they could stop a system within 60 minutes, while a smaller share—7 percent—said it would take longer. The findings suggest that, in many organizations, emergency controls over AI systems are either undefined or untested.
Confidence in post-incident accountability also appears limited. Just 43 percent of respondents expressed high confidence in their organization’s ability to investigate and explain a serious AI-related incident to leadership or regulators. In contrast, 27 percent reported low or no confidence. This gap raises questions about whether existing governance frameworks are equipped to meet rising regulatory expectations, particularly as jurisdictions move toward stricter AI oversight.
Responsibility for AI-related harm remains diffuse. While 28 percent of respondents identified boards or executive leadership as ultimately accountable, smaller shares pointed to technical leadership roles, including CIOs or CTOs (18 percent) and CISOs (13 percent). Notably, one in five respondents said they do not know where responsibility would lie, indicating unresolved internal governance structures.
The survey also highlights limited human oversight of AI-driven decisions. Only 36 percent of respondents said that most AI-generated actions are reviewed or approved by humans before execution. Others reported more reactive or partial oversight, including post-hoc reviews (26 percent) or intervention only when issues are flagged (11 percent). A further 20 percent said they were unsure how oversight functions within their organization.
Disclosure practices are similarly inconsistent. Just 18 percent of respondents said their organizations both require and enforce disclosure when AI is used to generate or significantly assist work outputs. Another 20 percent reported that disclosure is required but not consistently enforced, while nearly a third (32 percent) indicated that no such requirements exist.
Taken together, the findings suggest that AI adoption is advancing ahead of institutional controls. Many organizations appear to lack clear mechanisms for shutting down systems, assigning accountability, or ensuring transparency in AI-assisted processes.
The results also point to a broader transition in enterprise risk management. As regulatory frameworks such as the EU AI Act begin to take effect, expectations around explainability, auditability, and governance are likely to tighten. The gap between deployment and control, highlighted in the survey, may therefore become a central issue for both regulators and corporate leadership.
ISACA said the full results of the 2026 AI Pulse Poll will be released in May.
