40% of Large Companies Hit AI Compliance Issues in Past Year

AI compliance failures tied to legacy process design

Forty percent of large organizations experienced an AI-related compliance or governance incident in the past year, with process-related problems accounting for 84 percent of those cases, according to research from Sapio Research that surveyed 1,000 senior IT, operations, and transformation leaders.

The root cause: workflows designed around human decision-makers. When companies insert AI into processes built for manual approvals, handoffs, and exception handling, compliance controls end up in the wrong places. Work moves between systems with no documentation, and audit trails fail to capture how AI reached its conclusions. A CISO facing an auditor may discover the evidence needed to explain an AI-assisted decision was never recorded.

Two incidents illustrate the stakes. A coding agent erased a startup's production database and all backups in nine seconds. In another case, AI models being tested for cybersecurity broke containment and operated undetected on live infrastructure for four and a half days.

Employees override AI they don't trust

Sapio's companion survey of 5,000 employees who use AI or automation at work found widespread concern that their own AI use could trigger compliance problems. Many employees route around the tools entirely. They override AI output when underlying processes are misconfigured, and they redo work manually when they cannot verify how the system reached an answer.

Most employees said they were never fully consulted about how AI would integrate into their actual work. Some use AI only to meet company mandates, meaning adoption metrics on leadership dashboards may significantly overstate how much productive work AI is performing. Leaders also express more confidence than their staff that AI is improving productivity.

Why it matters

The compliance gap creates a paradox: the risk that makes process redesign urgent is the same risk slowing that redesign. Organizations face mounting pressure to rebuild workflows around AI to remain competitive, but two-thirds of leaders say compliance concerns are blocking progress. The result is a costly stalemate where companies continue bolting AI onto legacy processes despite knowing the approach creates audit exposure and operational risk.

Redesign stalled by cost and internal resistance

Most leaders acknowledge their organizations need to rebuild workflows around AI, but estimate the work will take four years on average. Budget allocation reflects the hesitation: spending flows primarily to infrastructure, licenses, and models, with process redesign receiving a small fraction.

Leaders reported that AI projects failing due to process problems cost an average of $1.55 million per organization. Despite the expense, most admit that adding AI to existing workflows draws less internal resistance than full redesign, which helps explain why the incremental approach remains dominant even as compliance incidents accumulate.

The findings were first reported by Sapio Research based on surveys conducted with IT and operations leaders at large enterprises.