ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

AI governance 2026

Abstract 3D metallic C in magenta and blue tones, illustrating enterprise AI agent incidents risk and governance failures.

Enterprises Averaged 54 AI Agent Incidents Last Year; A Third Caused Data Breaches.

, , , , , , , , , , , ,

IBM’s 2026 tech leader study found that governance built for human-speed decisions cannot contain machine-speed systems. Most technology leaders are already experiencing the consequences.

Key Takeaways

  • 77% of tech leaders say AI adoption is outpacing their current governance capabilities.
  • Companies detected an average of 54 AI agent incidents over the past 12 months; 17% were high-severity incidents, with each requiring more than 4 hours to contain.
  • 37% of AI agent incidents resulted in data exposure or security breaches.
  • Only 11% of CIOs and CTOs say they’re fully prepared for the scale of agent deployment expected in the next 12 months.
  • Survey: 2,000 CIOs, CTOs, and other C-suite technology leaders across 33 geographies and 19 industries, Q1 2026, IBM Institute for Business Value with Oxford Economics

The IBM Institute for Business Value, working with Oxford Economics, published its 2026 Tech Leader Study in Q1 2026. It surveyed 2,000 CIOs, CTOs, and other C-suite technology leaders across 33 geographies and 19 industries on how enterprises are managing AI as it scales from pilots to production. The AI agent governance numbers stand apart.

 

AI adoption without governance is driving cyber incidents

77% of tech leaders say AI adoption has outpaced their current governance capabilities. 70% report that their teams are deploying technology faster than IT can keep track of. More than two-thirds say business units bypass IT entirely to adopt AI tools.

Enterprises are starting to feel the effects. Enterprises detected an average of 54 AI agent incidents in the past 12 months. 17% were high severity, requiring more than four hours to contain. Of those incidents: 37% resulted in data exposure or security breaches, 33% triggered cascading system failures, and 17% created compliance or regulatory issues.

 

Why manual controls break down as AI deployment scales

The root problem is architecture. AI agents make decisions continuously, and at volumes no approval process can realistically supervise. When companies allow business units to deploy AI systems without IT oversight, visibility degrades, and incident rates rise proportionately. When IT tries to review everything, the business slows.

Conversely, in organizations that build governance into their system architecture, incident rates stay relatively flat even as agent deployment accelerates. In organizations that rely on manual review, incidents increase in proportion to deployment.

 

Strong governance generates ROI

Organizations with designed-in governance deploy 16 times more agents than peers relying on manual review, spend 4 times less of their AI budget, and deliver 18% higher operating margins.

 

By 2027, enterprises expect to deploy an average of 1,661 AI agents, a 38% increase from today’s levels. IBM projects AI spending to reach nearly 25% of total IT budgets by 2027, up from 14.5% in 2025. For organizations still relying on manual governance, both numbers make the current gap harder to close, not easier.

President Trump points from a rally podium during remarks calling for government equity stakes in AI companies.

Trump Pushes for Government AI Equity Stake, Plans Tech Meetings This Week

, , , , , , , , , ,

His administration already holds equity in Intel and other chipmakers after similar deals. AI giants could be next.

 

Trump is pushing for the US government to hold equity stakes in major AI companies and says meetings with tech executives are coming as soon as this week.

He told reporters Friday he wants Americans to be “partners in this revolution.”

 

The US government already holds equity stakes in chipmakers, miners, and quantum computing companies through arrangements in which it took ownership stakes in exchange for federal support. Trump is signaling that AI companies are next.

Companies like OpenAI and Anthropic may soon be worth trillions of dollars, meaning even a small government AI equity stake would represent a significant sum. A direct ownership stake would also give the federal government a financial incentive to see these companies grow, consistent with the administration’s existing approach of limiting federal AI regulation.

Surprisingly, the President isn’t the only one who thinks the federal government should reap rewards from the AI boom.

 

Sen. Bernie Sanders (I-Vt.) also wants the government to own a stake in AI companies, but through legislation rather than negotiation. Sanders has proposed a bill requiring top AI companies to pay a one-time 50% stock tax. That stock would flow into a sovereign wealth fund and pay gains back to the public.

When asked about Sanders, Trump said Friday: “As far as economics is concerned, we have certain things that aren’t that far apart.”

The President said meetings with tech companies are coming in the “very near future,” possibly as soon as this week, to discuss what a government AI partnership could look like.

 

Both OpenAI and Anthropic previously published policy documents supporting versions of public wealth funds, suggesting the companies most directly affected have already opened the door.

Abstract blue wireframe cube structures with golden cores depicting AI building itself, for coverage of Anthropic's call for a global AI pause.

Anthropic Calls for Global AI Pause, Says AI Nearly Builds Itself

, , , , , , , , , , , ,

The company’s research arm says Claude authors more than 80% of its production code and warns that AI designed to build its own successors could arrive before governments can respond.

 

The Anthropic Institute published an analysis this week showing that AI is already accelerating its own development and called on governments, rival labs, and civil society to build the systems needed for a global AI pause. Anthropic said it would stop if other leading labs agree to pause development, as long as there is a way to verify everyone adheres to the agreement.

The report uses publicly available benchmarks alongside previously undisclosed internal Anthropic data.

The central finding: AI is no longer just a tool used in development. It is now a driver of it.

 

AI already does most of the work at Anthropic

Claude now writes more than 80% of the code that goes into Anthropic’s systems. Engineers are now reviewers rather than writers. That shift increased the amount of code each engineer ships per day by 8x since 2024, and employees say they get around 4x as much work done.

The range of tasks AI can handle without human help doubles every four months. In March 2024, Claude could complete tasks a human finishes in four minutes. By April 2026, it was handling work that takes a skilled person 12 hours.

On open-ended research tasks, Claude’s success rate reached 76% in May 2026, up 50 percentage points from six months earlier. On deciding what to research next, Claude now outperforms human researchers 64% of the time in live sessions, up from 51% in November 2025.

 

Once AI builds itself, controls become much harder to add

The analysis lays out three possible futures. In the first, AI capability growth stalls and today’s AI spreads gradually through the economy. In the second, AI handles more and more of the work while humans still set the direction. In the third, AI systems design and train their own successors without meaningful human input. Researchers call this recursive self-improvement. Anthropic says the first scenario is unlikely.

If AI systems can design their own successors, the pace of progress is no longer limited by how fast humans can conduct research. It becomes limited only by computing power. At that point, the controls needed to keep AI systems safe become much harder to build after the fact.

 

A pause only works if everyone can prove they stopped

Anthropic said that an individual company can easily pause its development, but that would only change who leads the race, not alter the pace of development. A real coordinated pause requires a way to verify that all frontier AI developers stop at the same time. The report points out that AI training runs are far easier to hide than missile silos, and that comparable arms control treaties took decades to build.

Anthropic says it will organize conversations with policymakers, researchers, civil society, and other AI companies in the coming months and will publish the results.

US House chamber floor with AI data network visualization overlay, for coverage of the Sectoral AI Governance Act of 2026.

Congressional Bill Would Give Federal Agencies Power to Regulate AI That Violates Existing Law

, , , , , , , , , ,

Federal agencies can now weave AI rules into existing laws and enforce compliance when AI drives violations.

 

Rep. Sara Jacobs (D-CA-51) introduced the Sectoral AI Governance Act (H.R. 9125), giving federal agencies explicit authority to write and enforce rules when AI violates a law they already oversee. Consumer protection, employment discrimination, fair housing, financial services, and healthcare all fall within scope.

 

What the bill does

Any agency with enforcement authority over a federal law can issue rules targeting AI systems that contribute to violations of that law. A violation of those rules is enforced as a violation of the underlying federal law itself, meaning existing civil and administrative penalties apply.

The bill covers any AI or statistical system that influences a decision, across any area of federal law. The bill explicitly excludes tools that only store or transmit data.

Before issuing rules, agencies must provide 60 days’ public notice and consult the Office of Information and Regulatory Affairs (OIRA) to avoid conflicts with other agencies. The Office of Science and Technology Policy (OSTP) and the National Institute of Standards and Technology (NIST) review the technical characteristics of any AI system before the agency writes rules for it. Rules must be reviewed every three to five years and updated or dropped if the technology or the law has changed. Agencies that choose not to issue rules must publish reports to Congress every two years explaining why. Agencies that do regulate must report enforcement actions on the same schedule.

 

The bill preserves state authority to regulate AI, except where state rules directly conflict with a federal rule issued under the act.

H.R. 9125 was referred to the House Judiciary Committee and the Committee on Oversight and Government Reform.

South lawn view of the White House where President Trump signed NSPM-11 on AI vendor policy in national security, June 2026.

White House Executive Order, NSPM-11, Empowers Agencies to Terminate AI Vendor Contracts Over Usage Limits

, , , , , , , , , ,

The provision formalizes the authority the Department of War used against Anthropic, three months after canceling the company’s $200 million contract.

 

President Trump signed memorandum NSPM-11 on June 5, directing national security agencies to terminate contracts with AI vendors that repeatedly restrict how the government can use their systems. The provision codifies the authority the Department of War used to cancel Anthropic’s $200 million contract in March, after the company declined to permit unrestricted government use of its Claude models.

 

Agencies can terminate AI vendor contracts for imposed restrictions

Section 3(b) of the memo directs agency heads to terminate contracts with any AI company that repeatedly restricts government use of its systems. The memo specifies termination “for default or for convenience,” meaning the government doesn’t need to prove a breach. If an agency determines a vendor’s usage policies conflict with NSPM-11, it can end the contract without establishing fault.

That standard addresses the Anthropic dispute directly. In March, the Department of War terminated its contract with Anthropic after the company declined to accept terms requiring “any lawful use” of its models. Anthropic voiced concerns that its models could be used for mass domestic surveillance and fully autonomous weapons and wanted assurances neither would happen. The Pentagon designated the company a supply chain risk, ordered removal of its products from all defense systems within 180 days, and canceled the $200 million contract.

The rule has an escape valve. Agency heads can keep a restricted vendor relationship active for up to one year if cutting ties would create an immediate national security gap. Each exception must be reported in writing to the National Security Advisor and the President’s top science advisor within 30 days.

 

Agencies now need to use multiple vendors

Section 4(a) directs agencies to diversify their vendor base within 120 days, so they hold active contracts with multiple vendors at once. The directive is a direct response to what happened when the Department of War canceled Anthropic’s contract: agencies had no contracted backup. OpenAI stepped in quickly, but NSPM-11 makes spread-vendor contracting a formal requirement going forward.

 

NSPM-11 rescinds a previous Biden Administration memorandum, NSM-25. The Secretary of War has 90 days to rewrite the Pentagon’s rules on AI in weapons systems. Those rules, set out in DOD Directive 3000.09, govern when and how AI is used in lethal operations, including the conditions under which a human must remain in the decision loop. The revised directive will align those rules with NSPM-11’s requirements and is subject to annual review as AI capabilities advance. A classified annex covering sensitive security matters is expected within the same 90-day window.

The Anthropic case that prompted the memo’s central provision remains in litigation. A California federal court blocked the supply chain risk designation in March, ruling the action was punitive rather than security-based. The D.C. Circuit denied Anthropic’s emergency request to lift the designation in April. The lawsuit continues in both courts.

Connecticut state flag and capitol building alongside a digital circuit visualization, accompanying coverage of Connecticut's 2026 comprehensive AI law.

Connecticut Signs Comprehensive AI Law Covering Employers, Developers, and Consumers

, , , , , , , , , ,

Governor Ned Lamont signed the legislation on May 29, 2026, making Connecticut the latest state to regulate AI across employment, frontier AI development, and consumer-facing platforms.

Connecticut Governor Ned Lamont signed Public Act 26-15, which addresses employer hiring tools, large AI developers, AI companions marketed to minors, and social media recommendation algorithms. It is one of the more sweeping state AI laws enacted to date.

 

What employers have to do

Starting October 1, 2026, employers filing WARN Act notices with Connecticut’s Labor Department must disclose whether the layoffs are related to AI or other technological change. 

Starting October 1, 2027, any employer using AI tools that play a “substantial factor” in hiring, promotion, discipline, or discharge decisions must provide written notice to affected employees and applicants before making a decision. The notice must name the AI tool, explain what data it will analyze, and provide the employer’s contact information. Violations are enforceable only by the state attorney general.

The law also amends Connecticut’s employment discrimination statute to make clear that the use of an AI tool is not a defense against a discrimination complaint.

 

What AI developers have to do

Large frontier developers (companies with over $500 million in annual revenue that train foundation models) must establish internal anonymous reporting processes for employees who believe the company poses a “specific and substantial danger to public health or safety due to a catastrophic risk.” Retaliation against those employees is prohibited. Violations carry civil penalties of up to $1,000 per violation. The deadline to have the process in place is January 1, 2027.

 

Consumer-facing requirements

AI companion operators (platforms that offer human-like AI chatbots marketed for emotional connection) must implement suicide and self-harm protocols, disclose to users that they are interacting with an AI, and restrict manipulative engagement tactics when users are minors. These sections take effect January 1, 2027.

Providers of generative AI systems with more than 1 million monthly users must embed provenance data in AI-generated audio, images, and video so consumers can verify whether content was AI-generated. That section takes effect October 1, 2026.

Social media platforms that use algorithmic recommendation systems face new restrictions on how they can personalize content feeds for users under 18, including a default one-hour daily limit on algorithmically curated content. That section takes effect January 1, 2028.

 

Where Connecticut fits

Connecticut is the latest state to ratify sweeping AI laws. Illinois recently passed comprehensive AI legislation, citing federal inaction, with more bills on the way. Colorado, California, Florida, Missouri, New York, and Washington, among others, have either already signed bills into law or are currently reviewing proposed legislation.

The pattern puts the White House in an awkward position. The Trump administration is pushing for a federal AI framework and signed an executive order in December 2025 directing the federal government to limit state and local AI regulation. No federal law has materialized yet, with the president recently rejecting an executive order to institute a federal review process for advanced “frontier” AI models before release. Until one does, states are writing their own rules.

Looking up at the Illinois State Capitol dome against a clear blue sky, representing Illinois passing SB 315, the AI safety bill.

Illinois Passes AI Safety Bill; Pritzker Pledges Signature

, , , , , , , , , ,

SB 315 cleared the Illinois House 110-0 and the Senate 52-5. If signed by the governor, it will be the first U.S. law to require annual third-party safety audits of frontier AI companies.

The Illinois House of Representatives passed SB 315 unanimously, sending the bill to Governor JB Pritzker’s desk. Pritzker said he will sign it.

“Illinois is leading the nation in holding Big Tech accountable,” Pritzker posted on X. “I look forward to signing SB 315 and working with the legislature so that AI, when used, is used responsibly.”

SB 315 applies to AI developers with more than $500 million in annual revenue. Covered companies must publish a safety plan and submit to annual independent third-party audits assessing the risk of catastrophic harm, defined as events that could cause 50 or more deaths, serious injuries, or more than $1 billion in property damage.

Companies must also report critical safety incidents to authorities within 72 hours of discovery, or within 24 hours if the incident poses imminent risk of death or physical harm. The bill includes whistleblower protections for employees who flag safety concerns internally.

If signed, the law takes effect Jan. 1, 2027.

 

How it got here

Illinois Senate Democrats advanced a package of eight AI bills earlier this month, citing federal inaction. Senator Bill Cunningham (D-18th District) said lawmakers acted because “not much is happening at all in Washington.” The Illinois Senate passed SB 315 by a 52-5 vote.

House sponsor Daniel Didech called the bill a way to “put up some guardrails and make sure we have some safeguards in place to protect against some of the worst catastrophic risks.”

OpenAI and Anthropic publicly backed the measure. A trade organization representing other AI companies opposed it.

Illinois is the latest state to pass comprehensive AI legislation. Colorado recently passed a revised version of the Consumer Protections for Artificial Intelligence Act, which replaces several testing and reporting steps with disclosure requirements. California and New York both currently have similar legislation in place that addresses catastrophic risks associated with AI. 

The wave of state action runs counter to the White House’s effort to pause state laws in favor of a federal framework for AI regulation.