- In an AWS-commissioned Strand Partners survey of European businesses, 24% reported a documented responsible-AI approach and 10% a data governance strategy; the article says the base for these figures is not stated.
- AWS's report, based on interviews with 154 executives at 128 organizations, says some approval processes are so slow that staff skip them, and that usage counts alone say little about value.
- Leaders should check who owns their AI policy, how long experiments wait for approval, what tools staff use unofficially, and whether they measure results rather than adoption.
In one AWS-commissioned European survey, AI use outpaces documented responsible-AI approaches, on figures with no stated base
AWS's Reimagine 2026 report draws on confidential interviews with 154 executives at 128 organizations across 23 industries, conducted over nine months. The report argues for embedding governance in AI systems themselves and keeping humans answerable for results. Help Net Security covered the findings. The adoption data comes from a different source: research by Strand Partners, paid for by AWS, covering businesses in Europe. In it, more than half of the small, mid-sized and large companies reported using AI.
The coverage does not say what base those percentages are drawn from, so treat them as directional and as European figures only. The two figures may not come from the same population. The executive interviews are a separate source and describe a different problem: where policy exists, it can be slow enough that staff bypass it.
Approval queues in some organizations lag the work
According to the report, some of the interviewed organizations still send AI experiments through approval gates built for long technology programs, although the work itself now moves in days. In the authors' example, a two-week experiment that waits a month for sign-off leads some teams to stop asking at all. Policy in that situation, they write, is "pushing it underground." One interviewed leader said CIOs who spent years on shadow IT now face shadow AI at ten times the scale.
Boston University CIO Chris Sedore estimates that 40 to 50 percent of the university's people use AI at least weekly. Part of that sits outside university-provided tools; he described it as "going rogue." Data leakage is among the technical risks the authors identify: proprietary information, customers' personal details and confidential business intelligence. The authors say organizations fear this leakage can be invisible and often runs through third-party tools staff use without oversight.
Adoption is not the same as results
The report warns that usage figures reveal little about value, and the 88% example comes from a single organization observed early in its AI journey. Dr. Rashed Iqbal, CTO at RAK IDO, makes a related point about saved time: without a plan for the hours freed up, the company gains nothing. For a budget-holder, usage counts alone are weak evidence of return.
Controls interviewees described
Bradesco's Rafael Cavalcanti built a decision tree that screens each AI use case with three questions: does it involve personal data, does it run live or in batches, and must a person stay in the loop. Depending on how those answers fall, a use case lands in a defined risk tier with matching safeguards.
On agents, the authors' guidance is to begin with a person approving actions, grant more independence once the agent proves dependable, and retain the means to pull that independence back. They liken this to probation for a new hire. Security limits should sit outside the agent, they write, because agents "can misinterpret or work around embedded rules."
Where salary, HR or personal communications data is involved, some organizations redact it before processing. At Houston Methodist, staff needed about a year of experience before they trusted that the system looked at group-level patterns and left individuals out.
What the evidence can and cannot support
The findings are qualitative, drawn from interviews, and the survey behind the adoption figures was commissioned by AWS and covers European businesses. Regulatory differences between jurisdictions complicate matters further, according to the coverage. Standard Bank's Duncan Macdonald, speaking about operating in 22 countries, said you don't want a paradigm where 20 countries are affected because two don't allow certain things. None of the interviewed organizations claimed to have solved the junior-talent problem, where AI removes the repetitive work that once built judgment.
Questions to put to your team
1. Do we have a documented responsible-AI approach and a data governance strategy, and who owns each?
2. How long does a small AI experiment wait for approval, compared with how long it runs?
3. What do we know about AI tools staff use outside those we provide, and what data reaches them?
4. Do we classify use cases by personal data, live versus batch processing, and human oversight, with controls attached to each tier?
5. For any agent we run, which limits are enforced outside the agent, and how would we reduce its autonomy?
6. Do we measure outcomes from AI use, or only adoption?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Help Net Security.
