Audit committees moved AI governance into their top three priorities this year, and most of them say their own oversight of it is not yet mature. Deloitte's Center for Board Effectiveness and the Center for Audit Quality, in the fifth edition of the Audit Committee Practices Report published September 22 2026, report that 82% of respondents describe their AI governance oversight as emerging or limited. The accompanying media alert puts AI governance in the top three for 75% of committees, up from 35% a year earlier.
That is a 40 point jump in one year. The agenda moved. The evidence supply did not.
What the audit committee survey actually found
The report draws on close to 250 responses from audit committee chairs and members.
| Finding | Figure | Measure |
|---|---|---|
| Cybersecurity among top three priorities | 87% | Share ranking it top three |
| AI governance among top three priorities | 75% | Share ranking it top three, up from 35% |
| Technology including AI named as the skill most needed | 70% | Share selecting it |
| AI governance oversight described as emerging or limited | 82% | Self-described maturity |
The comparison that carries the argument is cybersecurity against AI governance, on the one readiness measure the survey applies to both. The media alert reports confidence in cybersecurity oversight at 82% and confidence in AI governance oversight at 56%. Same question, same respondents, a 26 point gap. Cybersecurity is the closest available analogue, a technical risk owned outside the committee that boards have been overseeing for far longer, and it is the one that has had time to build its reporting. AI governance has arrived at nearly the same altitude on the agenda without it.
One trap in this release, worth naming
Two separate 82% figures appear in the Deloitte and CAQ material and they measure different things. One is confidence in cybersecurity oversight, in the media alert. The other is the share describing their AI governance oversight as emerging or limited, on the report page. Anyone quoting this survey should check which one they have.
Two things are true at once here
The report page's 82% emerging or limited sits alongside the media alert's 56% who are confident they can effectively oversee AI governance. Those look contradictory and they are not. A director can believe the committee has the judgment to oversee something and also know the programme is early. Confidence is a statement about the people in the room. Emerging or limited is a statement about the machinery feeding them, and machinery is the part a CFO can fix.
Why a top-three priority comes with emerging oversight
Priority is set by risk. Oversight maturity is set by evidence. A committee can reprioritize in a single meeting. It cannot, in a single meeting, change what arrives in the board pack.
What arrives is almost always adoption data. Licences deployed, seats activated, sessions run, prompts sent, spend committed against budget. It is the only data the AI stack emits by default, and vendors ship the dashboards that display it.
Gartner just named the instrument out loud
In its September 16 2026 spending forecast, Gartner puts worldwide AI spending at $2.7 trillion in 2026, a 49.5% increase year over year. In the same release Gartner describes enterprises looking to their providers to help manage costs and "embed usage tracking into their workflows to evaluate success."
Read that as a director would. The instrument enterprises are asking their providers for, expressly to evaluate success, is a usage counter.
A usage counter is a good operations instrument. It tells you where licences sit idle and what the run rate will be next quarter. We made the same point from the other end in our work on why usage volume broke as a performance metric. What it cannot do is support a governance conclusion, because it describes one population at one moment and an oversight question is always comparative.
The three-line test for a board pack
Take any AI slide heading to an audit committee and look for three lines. Which outcome metric moved. Which group it moved relative to. What the analysis cannot rule out. If all three are missing, the slide is a coverage report, and the committee's 82% self-assessment is accurate rather than modest.
Does human review close the gap?
The intuitive fix is more human eyes. A randomized test says that runs the wrong way.
Atlassian's Teamwork Lab recruited 950 full-time knowledge workers and analyzed 903 after filtering, randomly assigning them to review a proposal containing two deliberate flaws. One group saw it unpolished, one saw an AI-polished version, one saw the polished version labelled "Early Draft."
Reviewers of the polished version were 22% less likely to flag the first flaw and 15% less likely to catch the second. They spent 62% more time reviewing it and read it 31% slower. They were 18% less willing to offer feedback, 1.7x more likely to rate the author's effort as high, and 2.5x more likely to rate the draft as finalized.
More hours, fewer catches. The Early Draft label largely removed the effect.
What the experiment proves and what it does not
Random assignment is stronger than the observational surveys most AI research offers, because it removes the possibility that the reviewers who saw polished work were different people to begin with. Atlassian also reports that Gen X reviewers and managers showed no meaningful change in detection, so the effect is not uniform.
What it does not prove is anything about a live governance process. One task, one document type, one recruited panel.
What board-grade AI evidence looks like
An oversight-grade finding has four parts, and a usage dashboard produces none of them.
- A pre-declared outcome metric. Cycle time, rework rate, handoff count, revenue per employee. Named before the measurement period opens, not selected afterwards from whatever moved.
- A comparison group. Teams that did not adopt during the same window, living through the same reorganizations and the same market.
- Stated controls. At minimum tenure, role and tool stack, because adopters self-select, the standing threat to every AI productivity number published this year.
- A confidence level and a disclosed limit. What the result supports, and what it cannot rule out.
That is what we mean by controlled cohort analysis with confidence scoring, and the method is set out on our measurement methodology page. It produces smaller claims than a single headline number, and claims that survive a director asking what the figure is compared to.
Getting there is a plumbing problem before it is an analysis problem. Outcome signals live in the systems where work happens. Adoption signals live in the AI vendors' own consoles. Nothing joins them. That join is what a Human Capital Operating System is for: an intelligence layer above the existing stack, aggregating signals no single tool in the stack can see alone. We covered the same question one level down, at the executive layer, in The AI Proof Gap, and the mechanics of the comparison itself in our guide to measuring AI ROI across a workforce. The AI Impact signal family carries adoption and outcome on one timeline, which is what makes the comparison possible.
One counter-argument is worth stating. AI governance is young, the frameworks are still forming, and a committee calling its oversight emerging may be describing the honest state of a new discipline rather than a defect. Fair. It also does not change what the committee should ask for next quarter.
Frequently asked questions
What did the Deloitte and CAQ audit committee survey find about AI governance?
The fifth edition of the Audit Committee Practices Report, published September 22 2026 by Deloitte's Center for Board Effectiveness and the Center for Audit Quality, draws on close to 250 responses from audit committee chairs and members. Deloitte's report page states that 82% describe their AI governance oversight as emerging or limited. The accompanying media alert reports that 75% identified AI governance as a top three priority, up from 35% last year, and that 56% are confident in their committee's ability to effectively oversee AI governance against 82% for cybersecurity. It surveys members describing their own committees, so it measures perception of readiness rather than readiness itself.
Why can an audit committee treat AI governance as a top priority and still call its oversight emerging?
Because priority is set by risk and oversight maturity is set by evidence, and the two move at different speeds. A committee can reprioritize in one meeting. It cannot change what arrives in its board pack in one meeting. Most AI reporting is adoption data: licences deployed, seats active, sessions run, spend committed. Those are coverage and cost measures. An oversight question asks whether an outcome moved relative to something, and that cannot be read off a usage count.
What is the difference between AI adoption reporting and AI oversight evidence?
Adoption reporting describes one population at one moment, usually the population that received the tool. Oversight evidence compares that population to a group that did not receive it, over the same period, on an outcome the business already tracks. The distinguishing feature is the comparison, not the sophistication of the chart. Adoption reporting is appropriate for rollout health, licence management and cost forecasting. It cannot support a claim that the programme changed anything, because it holds nothing to measure the change against.
Does having humans review AI output close the oversight gap?
Not on its own, and there is a randomized test on this point. Atlassian's Teamwork Lab analyzed 903 knowledge workers randomly assigned to review a proposal containing two deliberate flaws, in one of three conditions: no AI polish, AI polish, or AI polish with an Early Draft label. Reviewers of the AI-polished version were 22% less likely to flag the first flaw and 15% less likely to catch the second, while spending 62% more time reviewing and reading 31% slower. Review hours went up and detection went down. Note the scope: one experimental task, one document type, not a live governance process.
Bring evidence to the next committee meeting
If your AI reporting answers how much and how many, and your board is now asking what changed, that is a solvable gap. Request a Demo and we will walk through what an oversight-grade AI readout contains and what it takes to produce one.
Levos is accepting design partner applications from US organizations of 150 employees or more with an active AI rollout. Large organizations typically start with one function or division, measured against comparable teams that have not adopted yet. That is a stronger attribution design than a company-wide before-and-after.
