Cybersecurity statistics / Benchmarks
What share of organisations have an AI governance policy in place?
12 published sources answer this. They report between 18% and 44%, with a median of 36.5%. The figures differ because the surveys cover different organisations and define the question in slightly different ways, so the spread matters as much as the middle.
Last updated 2026-07-26. 12 publishers, reporting between 2025-04-24 and 2026-05-07. Every figure below was checked by hand against its source.
What each source reports
| Figure | Source | Published |
|---|---|---|
| 18% | Only 18% of organisations have policies governing AI use. | 2025-08-14 |
| 20% | 20% of organizations have optimized their AI cybersecurity governance frameworks and embedded them into organizational culture. | 2026-03-19 |
| 23% | 23% of companies globally have a policy against using foreign AI models such as Deepseek in 2025. | 2025-10-22 |
| 23% | Only 23% of organizations surveyed have implemented comprehensive AI security policies. | 2025-04-24 |
| 26% | Only 26% of organizations have fully documented and enforced AI governance policies in 2025. | 2026-01-08 |
| 36% | Just 36% of companies indicate they have a formal AI policy in place. | 2025-08-20 |
| 37% | Only 37% of organisations have policies to manage AI or detect shadow AI. | 2025-07-30 |
| 40% | Only 40% of organizations have a formal AI governance framework in place. | 2026-05-07 |
| 41% | Only 41% of companies have AI policies and guidance in place, which relates to managing risks associated with AI. | 2025-06-12 |
| 41% | 41% of organizations have created specific AI usage policies. | 2026-03-04 |
| 41% | Only 41% of organizations have AI-specific data privacy policies in place. | 2026-03-23 |
| 44% | Only 44% of organizations report having policies in place to secure AI agents. | 2025-05-28 |
How this page is put together
Candidate figures are gathered automatically from the database each week, then each one is read and either accepted or rejected before it appears here. A figure is rejected when it answers a different question, for example a single sector or country, a consequence of an attack, or a rate among victims rather than among all organisations.
Only one figure per publisher is used, the most recent. Cite the original publisher rather than this page: every source is linked above.
Other benchmarks
Get new figures as they publish
This page is updated as new reports answer the same question. The weekly email carries the newest figures.