Artificial intelligence is rapidly reshaping the way organisations operate. According to McKinsey’s latest Global Survey on AI, 88% of organisations now use AI in at least one business function, up from 78% just a year earlier.

At the same time, Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, enabling systems to make decisions and take actions with limited human intervention.

Yet as AI adoption accelerates, governance is struggling to keep pace.

Poorly governed AI is proving costly. EY's 2025 Responsible AI research found that nearly all organisations surveyed reported AI-related losses averaging US$4.4 million. Recent incidents involving inaccurate outputs, misinformation, biased decisions and system failures highlight a growing reality: without proper governance, AI can create significant business risks.

According to Muhammad Ali, Managing Director of South African ISO specialist World Wide Industrial & Engineering Systems (WWISE), many organisations are embracing AI without fully understanding the associated risks.

“AI adoption is outpacing governance,” he says. “Many organisations are deploying AI without the controls, accountability and risk management needed to use it responsibly.”

One of the most significant concerns is the information organisations are feeding into AI platforms.

“Employees often upload sensitive business information into AI platforms without understanding the risks,” says Ali. “Without proper controls, organisations can expose confidential data, intellectual property and business vulnerabilities.”

The challenge extends beyond information security.

As AI becomes increasingly embedded in critical business functions, organisations are becoming more dependent on technology-driven decision-making.

“AI is a powerful tool, but it should support human judgement, not replace it,” says Ali. “Without proper oversight, organisations risk relying on outputs that may be inaccurate, incomplete or biased.”

Recent reports of AI-generated government reports receiving limited human review have renewed concerns around quality, accountability and over-reliance on AI outputs.

According to Ali, this highlights a broader governance challenge.

“The issue is no longer whether organisations should use AI, but whether they have the governance, controls and oversight needed to use it responsibly.”

“AI cannot be held accountable for its decisions. Responsibility ultimately rests with leadership teams to ensure these tools are implemented, managed and governed appropriately.”

Increasingly, AI is also becoming a business continuity issue.

AI is helping organisations automate processes, improve efficiency and support decision-making. However, overreliance on these tools can create new risks when systems fail, become unavailable or produce unreliable results.

“Business continuity has always focused on people, processes and technology,” says Ali. “AI now influences all three simultaneously, meaning failures can quickly cascade across multiple areas of the business.”

The financial impact can be substantial. Uptime Institute's latest Annual Outage Analysis found that more than half of major technology outages cost over US$100,000, while one in five exceed US$1 million.

Preparing for these risks requires more than technology investment. It requires governance, testing and resilience planning.

Ali recommends that organisations thoroughly assess and test AI tools before deployment, supported by clear policies, employee training and controls to protect sensitive information.

This is where international standards are beginning to play an increasingly important role.

Published in 2023, ISO 42001 is the first international management system standard dedicated to AI governance. Built on the information security principles of ISO 27001, it helps organisations establish a structured approach to the responsible development, implementation and management of AI technologies.

Supporting this is ISO 22301, the international standard for business continuity management, which helps organisations identify critical dependencies, test response strategies and prepare for disruptions when systems fail or deliver unreliable results.

“ISO 42001 supports responsible AI governance, while ISO 22301 strengthens resilience when things go wrong,” says Ali. “Together, they help organisations balance innovation with accountability.”

“For larger organisations, implementation can be a multi-million-rand investment, but the cost of inaction can be far higher,” says Ali. He adds that effective implementation requires more than certification, demanding strong governance, expertise and skills transfer.

Independent certification gives stakeholders confidence that governance controls have been objectively assessed and validated by a third party.

As regulation and scrutiny increase, Ali believes organisations will need to demonstrate AI governance and assurance just as they do for cybersecurity, quality and ESG.

The evolution of standards, including the upcoming revision of ISO 9001, reflects a growing focus on AI, technology and risk management, highlighting the increasing importance of governance in these areas.

“The future is not just about adopting AI,” he concludes. “It is about proving that AI is governed, monitored and managed responsibly. Organisations that can demonstrate this will be better positioned to reduce risk, inspire confidence and realise the full value of AI.”