Grant Thornton interviewed 950 business leaders across 10 industries between 13 Feb. and 18 Mar. 2026.1 Three in 4 of their boards had approved major AI investments. Most could not say, with evidence, that the AI was working or that it was safe. The report calls the distance between the 2 the AI proof gap. This article takes the findings that bear on content: what AI reads, what it says, and who answers for it.
01The proof gap, measured.
Asked how confident they were that their organisation could pass an independent audit of AI governance and controls, with documented evidence, within 90 days, 78% of leaders lacked strong confidence. Among organisations still piloting AI, 7% were very confident; among those with fully integrated AI, 74%. The report’s reading is that the leaders built governance first and scaled on it. The rest are scaling AI they cannot explain, measure or defend.
Asked what has held AI back, 46% name governance or compliance barriers, the largest factor by a wide margin. Technology limitations are named by 15%. Only 8% say AI is not underperforming. Yet only 11% identify risk and compliance as the function that needs the most focus to meet their AI ambitions: the organisation knows what is failing and is not prioritising the remedy.
02Approved by the board, owned by nobody.
Three in 4 boards have approved major AI investments. Of the boards surveyed, 48% have not set governance expectations for AI, and 46% have not brought AI risk and opportunity into ongoing board or committee oversight. The report puts it in 2 lines: “Your AI investment was approved. No one owns the outcome.”1
For directors and officers this is the second of the 2 questions AI Readiness asks: are they becoming increasingly, and unnecessarily, exposed as AI grows? An approval without oversight is exposure the board has signed for, and the report shows how common it is.
03Governance begins with what AI reads.
The survey measures the AI an organisation deploys. The same discipline applies to the AI that describes it. Copilots, assistants and the public models answer from what the organisation has published over years: current pages beside superseded reports, retired microsites and PDFs in several versions, each read as true today. The organisation’s own online position is the root cause of 79% of misinformation or misrepresentation. AAAnow Research, Dec. 2023 to Jan. 2026; P&C (human misinformation) 2014 to 2023.
That makes content the first object of AI governance, and the simplest to evidence. The question a board can ask today, what is our AI reading and what is it saying about us, has an answer that can be shown to an auditor: what AI reaches, how it reads it, where its account departs from the organisation’s own, and what was done about it. It is also the first of the 2 questions: is the organisation fit for AI visibility, and what does that mean?
04An incident most have never rehearsed.
The report asks whether organisations hold an AI-specific incident response playbook, and names hallucinations and harmful outputs among the incidents it should cover. One in 5 has a playbook defined, owned and tested; 48% have a documented playbook they have never tested; 29% are still writing one; 3% have none. In the report’s words, “A plan you have not tested is a hypothesis, not a plan.”1
A wrong answer about the organisation, given to a buyer, an investor or a regulator, is such an incident. Knowing where the answer came from, which page, which document, which version, is what makes a response possible, and what lets the board show afterwards that it was handled.
05From documentation to continuous oversight.
The report’s conclusion is that governance written as static documentation and periodic review was built for a world in which a person sat at each decision. As AI acts for itself, governance has to run at the same speed and with the same continuity: monitoring in real time, detecting departures from what was expected, and able to reconstruct how an outcome was produced and where accountability sits.1
Applied to what AI reads and says about the organisation, that is AI Confidence: diligence and oversight as the organisation advances and grows, with an independent record each month of where it stands, what has moved and what was corrected. It is the evidence the audit in the report asks for, and the understanding on which decisions on AI can rest.
Sources.
- Grant Thornton, 2026 AI Impact Survey: The AI Proof GapLive interviews with 950 business leaders across 10 industries, 13 Feb. to 18 Mar. 2026. Audit confidence: pp. 4, 8 and 9; causes of underperformance: p. 7; boards: p. 6; incident playbooks: p. 15; continuous oversight: p. 16. https://www.grantthornton.com/services/advisory-services/artificial-intelligence/2026-ai-impact-surveyGrant ThorntonWe do not enable external links - please copy and paste, you are then certain as to the link being opened
- AAAnow Research, the root cause of misinformationThe organisation’s own online position as the root cause of 79% of misinformation or misrepresentation. AAAnow Research, Dec. 2023 to Jan. 2026; P&C (human misinformation) 2014 to 2023. https://aaanow.ai/platform/misinformation/