Editor Note:
Pick one of the four options below and delete the other one before publishing.
*This note will only show in the editor and will be hidden on the preview and live page. Feel free to delete this note after updating the section below.
Cybersecurity Awareness Month 2026
Option 2
AI governance: How much is enough?
There is no universal AI governance model.
What works for an organisation experimenting with AI may not work for one scaling it across the enterprise.
That's why Gartner's framework approaches governance as a maturity journey, helping organisations apply the right level of oversight at the right time.
Explore the five stages below.
Planning
Goal: Establish authority, boundaries and credibility before AI activity accelerates.
At this stage, the focus isn't on governing every AI use case. It's on creating enough structure before adoption scales.
Key considerations:
Who owns AI governance across the organisation?
What AI use cases are explicitly prohibited?
What position will the organisation take on public AI tools?
Who has the authority to approve, pause or stop AI initiatives?
Experimenting
Goal: Make governance repeatable, fast and visible as pilots multiply.
As AI experimentation grows, consistency becomes more important than control.
Key considerations:
Are AI risks and acceptable use clearly documented?
Are governance decisions being tracked and reviewed?
Do teams know which AI tools are approved?
Can governance keep pace with experimentation?
Stabilising
Goal: Formalise authority, controls and oversight so AI becomes reliable and defensible.
The organisation is moving beyond pilots. Governance becomes a business capability rather than an informal process.
Key considerations:
Are governance responsibilities clearly defined?
Are AI policies written in language the business understands?
Are business leaders involved in governance decisions?
Is oversight consistent across initiatives?
Scaling
Goal: Make governance automatic as adoption grows.
The challenge shifts from creating governance to maintaining it at scale.
Key considerations:
Can governance keep pace with new AI deployments?
Are decision rights still clear as more teams adopt AI?
Have monitoring and oversight become systematic?
Are AI risks being reviewed regularly?
Leading
Goal: Fully systematise governance across the organisation.
Governance becomes embedded in how the organisation operates rather than something applied on top.
Key considerations:
Is AI governance treated as an ongoing leadership responsibility?
Are governance controls consistently applied across models, applications and agents?
Can the organisation demonstrate accountability and auditability?
Is governance evolving alongside new AI capabilities and regulations?
Editor Note:
Pick one of the three options below and delete the other one before publishing.
*This note will only show in the editor and will be hidden on the preview and live page. Feel free to delete this note after updating the section below.
Option 1
Continue the Conversation at Gartner Cybersecurity & Risk Management Summit
AI governance is just one of several conversations shaping cybersecurity leadership today.
Join Gartner analysts and your peers to explore practical approaches to AI governance, emerging risks, cyber resilience, identity and the future of security strategy.