Most organizations have provided their teams with AI tools and licenses. What they haven’t done is shown those teams how to use them responsibly: What’s allowed, what’s off-limits, and what happens when something goes wrong.
Our 2026 State of AI for Business report found:
These report findings come from a survey of more than 2,100 professionals across industries and roles on how their organizations are actually approaching AI adoption today.
The numbers represent meaningful progress: in 2025, only about 38% of organizations had policies in place. That 10 percentage point increase is progress but still falls short of where it needs to be. More than half of organizations currently have people actively using AI with no formal guidance on how to do it.
The absence of a generative AI policy creates real exposure around data privacy, intellectual property, quality control, and brand consistency. It’s risky when usage races ahead of governance.
You might assume this is primarily a small-company problem, that larger organizations with legal and compliance teams have it covered. The data does not support that. Even at the largest firms, with over $1 billion in revenue, roughly 30% still have no generative AI policy in place.
Most organizations we surveyed are using AI — often widely, often daily — but they’re missing the key policies that govern how this use happens.
A generative AI policy does not need to be long or complicated. But it does need to exist to avoid unmanaged risk across the organization