Artificial intelligence has become an indispensable tool from design optimisation in digital construction to predictive maintenance in smart infrastructure. Yet as AI adoption accelerates, governance is lagging dangerously behind. A new Gallup survey reveals that 57% of U.S. organisations lack a fully implemented AI governance policy, exposing them to mounting legal, operational, and reputational risks.
With AI lawsuits, class actions, and regulatory investigations now emerging at pace, the once-theoretical risks of AI misuse are turning into measurable exposure. The findings underscore a widening gap between how fast AI is being deployed and how slowly most organisations are establishing the frameworks needed to manage it.
The governance gap: AI adoption without oversight
Corporate AI governance has fallen behind the speed of innovation. The Gallup data shows that only 43% of organisations have a formal AI governance policy, while a further 25% are still in the process of implementing one. In other words, more than half of businesses are using AI without a complete set of rules or controls in place.
Even more concerning, only 30% of employees say their company has clear AI guidelines or training. For sectors like digital construction, BIM, and smart infrastructure, where data accuracy and intellectual property are paramount, this governance gap represents a tangible risk.
Shadow AI: the hidden exposure inside every organisation
In the absence of clear guardrails, employees are improvising. Shadow AI, the use of unapproved or unsanctioned AI tools, has become the default. According to the survey, 78% of AI users bring their own tools to work, a figure that climbs to around 80% in smaller organisations.
This “Bring Your Own AI” culture bypasses IT and legal oversight, placing sensitive prompts, data, and outputs outside corporate controls. It also undermines data provenance, cybersecurity, and compliance reporting, complicating any incident response or audit trail.
Anirudh Agarwal, CEO of OutreachX, summarises the issue: “Shadow AI isn’t defiance, it’s demand outrunning process. When teams reach for unsanctioned tools, they’re signalling gaps in speed, access, and trust. Bring them onto governed rails, SSO, logging, and human-in-the-loop review, and you cut risk without killing momentum.”
The risks are now real: from IP breaches to defamation
AI-related risks have shifted from potential to actual. The survey shows that 47% of organisations have already experienced at least one negative consequence from generative AI use, including IP disputes, privacy breaches, or factual inaccuracies.
Yet, only 27% of organisations currently review all AI-generated content before publication. That leaves a significant portion of AI outputs, marketing copy, investor materials, design renderings, and client communications, unchecked and legally vulnerable.
The most common AI risk categories include:
- Intellectual Property (IP) and Copyright: Using AI-generated content trained on copyrighted material or lacking provenance.
- Defamation and False Claims: Publishing AI-generated copy without factual verification.
- Privacy and Data Security: Employees entering personal or sensitive client data into public AI tools.
- Regulated Content: Non-compliant use of AI in areas such as financial promotions, healthcare, or recruitment.
For digital construction firms, where generative design and predictive analytics are integral, these risks carry financial, contractual, and brand implications.
Why the governance gap keeps growing
Several structural factors explain why corporate AI governance continues to lag behind adoption:
- Adoption outpaces policy: Business units deploy AI tools faster than Legal, Risk, or HR can standardise oversight.
- Tool sprawl and unclear ownership: Different departments adopt disparate tools, creating fragmented control.
- Lack of internal AI literacy: Employees often cannot distinguish between safe experimentation and regulatory exposure.
- Rapid capability acceleration: With hyperscalers racing to launch new AI models and chip capacity expanding, unmanaged AI use will only grow.
- Litigation Momentum: From Hypothetical Risk to Courtroom Reality
Practical governance actions: closing the compliance gap
To mitigate these risks, organisations should implement layered, practical governance measures that balance innovation with control.
1. Publish a Review-First AI Policy
Define human-in-the-loop (HIL) review for all external content, prohibit entry of personally identifiable or sensitive data into public tools, and mandate retention of prompts and outputs for audit purposes.
2. Migrate Shadow AI Users to Sanctioned Platforms
Identify and consolidate shadow use into approved enterprise AI tools equipped with SSO, data loss prevention (DLP), and activity logging.
3. Implement Risk Tiers and Control Frameworks
Categorise AI use cases into low, medium, and high-risk tiers. Require legal sign-off for public or regulated content and deploy sandbox environments for testing high-risk applications.
4. Report and Review Regularly
Provide monthly board-level reporting on AI usage, content reviews, and incidents. Track the percentage of outputs that undergo human verification.
These steps align with emerging AI governance standards such as ISO/IEC 42001:2023 (AI Management Systems) and the EU AI Act, positioning organisations for regulatory readiness.
Containment or Escalation?
AI adoption will continue to scale, but without verifiable governance, legal exposure and regulatory pressure will intensify.
Organisations that invest now in transparent governance, auditable processes, and human review mechanisms can contain their exposure and maintain innovation velocity. Those that don’t risk becoming part of the next wave of litigation — and public scrutiny.
In the digital construction sector, where data integrity, IP protection, and safety compliance are central, robust AI governance is not just a legal necessity it’s a foundation for trust and competitive advantage.
Read next: Accelerating next-generation AI data centres – Build in Digital
Are you a building professional? Sign up for a FREE MEMBERSHIP to upload news stories, post job vacancies, and connect with colleagues on our secure social feed.
