Why Do Executives Struggle to Govern Companywide AI Software Decisions?

Why AI procurement resists standard governance.

Standard enterprise software procurement is governed by a well-understood process: business case, vendor evaluation, security review, contract negotiation, IT approval, deployment. This process works because software purchases above a certain cost threshold are visible — they appear in procurement records, require budget approval, and involve the IT department at some point. AI software breaks this model in three ways. First, the cost threshold is often too low to trigger standard procurement governance — a €50/month per user SaaS tool flies under the radar. Second, AI tools are increasingly embedded in existing software rather than procured as standalone products — the AI feature in the project management tool the team already uses does not trigger a new procurement decision. Third, the technical risk profile of AI tools is not captured by standard security reviews that were designed for deterministic software systems.

The regulatory exposure that executives underestimate.

The governance gap in AI software decisions is not only an internal risk management problem — it is increasingly a regulatory exposure. The EU AI Act, emerging US state-level AI regulations, and sector-specific guidance from financial regulators and healthcare authorities are creating a compliance landscape that requires organizations to be able to account for where they are using AI, what decisions those AI systems are informing, and what oversight mechanisms are in place. Organizations that have allowed AI software to proliferate without governance will face significant compliance reconstruction work as these regulatory requirements crystallise.

The information problem.

Executives who want to govern AI software decisions across a large organization face a fundamental information problem: they do not have an accurate inventory of where AI is being used. Business units have not disclosed all of their AI tools, partly because they are uncertain what counts as 'AI' and partly because the procurement process that would create a disclosure obligation was never triggered. Building an accurate AI inventory is the necessary first step for any serious governance program, and it is typically more difficult than expected. Shadow AI — AI tools deployed without central knowledge — is a widespread organizational reality, not an edge case.

Building governance that works at the pace of AI adoption.

The governance frameworks that succeed in managing companywide AI software decisions share a design principle: they are light enough that business units use them voluntarily rather than route around them. Heavy governance processes — multi-week review cycles, complex approval chains, exhaustive documentation requirements — create incentives to avoid disclosure rather than facilitate it. Effective AI governance creates a clear, fast path to approved use that is preferable to the shadow procurement alternative. The goal is not to slow AI adoption; it is to ensure that AI adoption is visible, evaluated, and intentional at the organizational level.