As AI adoption expands, robust governance is becoming critical to maintaining trust, accountability, and business resilience.
Yet, according to the report Developing Dynamic Capabilities for AI Risk Governance, the speed of AI adoption is outpacing many organisations' ability to manage its risks effectively.
Drawing on international survey data and 61 interviews with senior professionals, the research highlights a key challenge: The biggest barrier to responsible AI adoption is not the technology itself, but organisations' capability to govern it.
Through the lens of the dynamic capabilities framework, the report explores how organisations can adapt their governance, decision-making, and ways of working to keep pace with AI. The report also provides practical frameworks, strategies and real-world lessons to help leaders strengthen AI risk governance and build more resilient organisations.
The dynamic capabilities framework: Sensing, seizing, transforming
Dynamic capabilities explain how organisations identify AI opportunities and risks, respond to them, and adjust their operations to create value whilst managing risk.
The research frames AI risk governance through the lens of the dynamic capabilities framework. This approach considers how organisations adapt to technological change via the three interconnected abilities:
Sensing: Recognising emerging AI opportunities and risks.
Seizing: Mobilising people, skills, and technology to respond to AI opportunities and risks.
Transforming: Making AI part of daily processes and governance so oversight is consistent, scalable, and sustainable.
Many organisations are good at spotting AI opportunities (sensing) and starting to use AI (seizing), but fewer have managed to fully integrate AI into their operations with strong governance (transforming). Because of this, they often rely on professional judgement and informal teamwork rather than clear governance processes, which can lead to gaps in oversight.
Seven key research findings
Viewed through the dynamic capabilities framework, the research identifies seven areas that organisations should address to strengthen AI governance
1. Organisational capability is the bottleneck
The report’s key message is clear: The challenge of AI governance is less about technical know-how and more about building the right organisational capabilities. Most organisations can identify AI opportunities and begin adoption, but struggle to make AI part of consistent, trackable governance processes.
2. Lines of responsibility are blurred due to AI
The traditional Three Lines Model assigns clear roles to business teams, risk and compliance functions, and internal audit in managing risk. But AI governance does not fit easily into any one area.
Because AI risks affect multiple parts of an organisation, many are creating steering committees and governance roles to bring different teams together. Whilst this can improve coordination, it can also make accountability less clear, leading to duplicated effort and uncertainty over who owns AI-related risks.
3. The current competency gap should be a strategic priority
A consistent finding in the report is the shortage of professionals who can combine AI literacy with expertise in risk, data governance, and assurance.
Organisations may rely on consultants or external vendors, and internal skills development is often ad hoc. The report highlights a growing need for professionals who can bridge AI, risk, and governance, identifying this as a strategic priority.
4. Embedding AI remains the weakest link
Whilst organisations are, to some extent, capable of sensing and seizing, their transforming capabilities lag. Many organisations are layering AI onto existing processes rather than redesigning workflows and controls around it. The result is fragmented oversight and AI initiatives that are difficult to scale.
5. Reliance on judgement and narratives makes effective oversight a challenge
Many AI systems, particularly generative AI, can be difficult to understand and monitor. As a result, organisations often rely on people's judgement rather than clear measures of performance and risk.
Lacking meaningful metrics, boards can struggle to assess whether AI is working as intended or creating new risks. The report highlights an important role for management accountants and risk professionals in developing the reporting and measurement frameworks needed for effective oversight and to support better decision-making.
6. Off-the-shelf AI tools pose unique risks
Organisations that depend on off-the-shelf AI tools tend to have the weakest AI governance capabilities.
On the other hand, organisations that develop or customise AI systems internally show greater maturity, particularly in embedding AI within governance structures.
7. Stronger capabilities produce better outcomes
The research found that organisations with stronger dynamic capabilities are more effective at both mitigating AI-related risks and realising AI-driven opportunities.
How organisations can strengthen AI governance
The report offers actionable recommendations for organisations and professionals:
Institutionalise professional authority
. Anchor AI governance in clearly defined roles across the Three Lines Model, establishing explicit accountability and escalation pathways.
Build hybrid expertise. Provide professional development opportunities so professionals can learn to integrate AI literacy, data governance, risk management, and assurance.
Turn good judgement into repeatable processes. Move from reliance on individual judgement to standardised, scalable governance routines and evidentiary standards.
Strengthen transforming capabilities
. Embed AI governance into business workflows, risk management systems, and performance measurement structures.
Build measurable oversight
. Develop structured metrics, risk indicators, and validation processes to provide transparent, auditable AI oversight.
For management accountants and risk professionals, future influence will depend on the ability to bridge data, technology, and governance. Those who develop these key skills will be essential in strengthening organisational trust and accountability as AI becomes even more embedded in business operations.
Building the foundations of effective AI governance
Successful AI risk governance is a matter of organisational capability. Committees and policies alone are not enough. Organisations need clear accountability, cross-functional coordination, and meaningful oversight.
The dynamic capabilities framework provides both a diagnostic tool and a road map for organisations that want to turn AI experimentation into an auditable, sustainable practice.
Organisations that invest in these capabilities will be better positioned to capture the benefits of AI whilst managing its risks. Ultimately, AI adoption and integration success will depend not only on the technology itself but also on the people, processes, and governance that support it.
Explore the full Developing Dynamic Capabilities for AI Risk Governance report for frameworks, case studies, and practical tools to set your organisation on the path to resilient, responsible AI usage.
Discover additional resources: