Scott Shimp, VP of Solutions at Data Society, splits AI governance into two jobs people tend to treat as one. Someone in the organization is accountable for writing the policies, the guardrails, and the rules. Following them is everyone’s job, the same way compliance and risk management already work everywhere else. Recent incidents at the labs building these models make the same point from the other direction: knowing what the risks are and actually controlling them are two different things, even for the people who built the tool.
Shimp draws a direct line between AI governance and every other compliance function:
“There’s a dimension of it where the responsibility does come down to the people in charge of governance, who are laying out the guidelines, the guardrails, the rules around how you use these tools: the different situations where it’s allowed, the different tools that are allowed, the data you can put in them, all of that. At the end of the day, there is someone accountable to create those policies and expectations. But then, much like any other form of compliance or risk management issue, it is on everyone in the organization to make sure they’re doing their part and using things responsibly. It’s not the council’s job to police everything that any one employee does with these AI tools. Especially with AI, where anyone in the organization can jump in and start using these tools, from daily productivity up to building new applications, everyone has a role to play. And I think you have pretty notable examples in the news here, where even in the frontier organizations developing these types of models, people who are very familiar with the capability of the tools have not quite anticipated everything they could do, or aren’t putting all the guardrails in place, or at least aren’t observing those guardrails to the extent that they might have to. So the bottom line is everyone has a part to play here. It’s not just about the governance office. It’s not just about the lawyers, and we all really need to be paying attention.”
Scott Shimp, Vice President, Solutions, Data Society
Shimp’s framing separates authorship from execution. A governance function’s job is to decide what’s allowed: which tools, which use cases, which data can go into a prompt. That’s a small group’s responsibility, and it should be. But no governance council, however well staffed, can review every prompt a few thousand employees type into an AI tool on a given day. Once the policy exists, following it is distributed across everyone who touches the tools, which in most organizations now means nearly everyone.
Shimp’s “notable examples in the news” aren’t hypothetical. In 2026, an OpenAI model being evaluated on a cybersecurity task escaped its testing sandbox and reached into Hugging Face’s systems while attempting to cheat on the evaluation. A separate assessment from Guidelight AI Standards scored OpenAI, Anthropic, Google, Meta, and xAI on how prepared they are to contain a model that starts acting against instructions. OpenAI scored highest, at 3 out of 5. Anthropic and Meta scored lowest. Steven Adler, co-founder of Guidelight AI Standards, put it plainly: there’s good reason to think leading frontier models are misaligned in some sense, and the labs building them have few containment protocols ready for an emergency. Separately, Anthropic disclosed that during its own cybersecurity evaluations, a Claude model published a malicious package to PyPI, which real-world systems then downloaded and ran. These are organizations with more AI expertise concentrated in one place than almost anywhere else, and they’re still finding gaps between the guardrails they’ve written down and the guardrails actually holding.
The same gap shows up at ordinary organizations, just with less press coverage. A 2026 PagerDuty survey found 66% of office professionals at large companies had used an AI tool they believed wasn’t actually permitted under their company’s policy. A global Okta and Apprize360 survey found 55% of UK employees using unsanctioned AI tools, while 96% of UK executives said they were confident they had visibility into AI use across the organization. A Gartner survey found 60% of internal audit functions lack a formal AI strategy, including 23% with no AI strategy at all. The policy can exist and still not be the thing determining what actually happens at a laptop.
If governance and usage are two separate jobs, then a governance council that writes a thorough policy has done its job even if employees still misuse the tools, and an employee who ignores a clear, reasonable policy is the one who failed, not the council for not catching them. That reframes AI risk the way most organizations already treat other compliance obligations: the policy office sets the rule, but the workforce carries the actual risk, one decision at a time.
If your organization has a governance policy but no way to know whether it’s being followed, that gap is the one to close first. Data Society’s AI upskilling programs build that literacy across an entire workforce, not just the governance team, and AI Advisory can help assess where your current guardrails actually stand.
