KPMG survey finds AI shift to governance & security

KPMG has published a global survey showing that organisations scaling artificial intelligence are shifting their focus to governance, security and financial oversight. It also found that regional gaps in AI maturity have narrowed.

Based on responses from 2,131 senior leaders across 20 countries, 64 per cent of organisations in the Americas are scaling AI or have moved beyond that stage, compared with 61 per cent in Asia Pacific and 56 per cent in Europe, the Middle East and Africa. That leaves an eight-point gap between the leading and trailing regions, down from 16 points in the first quarter.

Planned spending also increased. Average intended AI investment over the next 12 months rose to USD $210 million from USD $186 million in the first quarter.

Shift in focus

The findings suggest that companies further along in AI deployment are moving beyond basic adoption and concentrating instead on the controls needed to manage the technology across larger parts of their operations.

KPMG said 55 per cent of organisations now operate a formal AI harness layer, which it described as the controls and tooling between AI models and business use. Among organisations reporting established returns, that figure rises to 86 per cent.

Senior management oversight is also becoming more common. The survey found that 53 per cent of respondents place accountability for AI-informed decisions at C-suite level or above, including 35 per cent with a named executive responsible and 18 per cent assigning that role to the chief executive officer or executive committee.

Employee use of AI agents has increased as well. Some 34 per cent of respondents reported significant employee adoption, up from 25 per cent in the first quarter.

Organisational maturity was also linked to more formal AI structures. A formal AI harness layer is in place at 31 per cent of organisations in the experimentation stage, 58 per cent of those scaling AI, and 86 per cent of those reporting established returns.

Security and resilience

As AI moves further into core business processes, cybersecurity and operational resilience are becoming more prominent concerns. KPMG found that 86 per cent of organisations are adapting their cybersecurity operations and strengthening policies, processes and controls in response to AI-related threats.

Concern appears greatest among businesses already seeing measurable returns. Among organisations reporting established returns, 71 per cent include cyber and data security among their AI budget priorities, compared with 36 per cent of those still at the experimentation stage.

Model sovereignty is also moving up the agenda. The survey found that 72 per cent of organisations formally consider it in AI decision-making, covering questions such as where models, data and intellectual property are hosted, controlled and governed.

Within that group, 21 per cent said they have an enterprise-wide strategy under regular review. Among organisations reporting established returns, 53 per cent said model sovereignty forms part of a formal enterprise-wide strategy.

Cost and value

The survey pointed to weaker maturity in financial management. While AI budgets are rising, many organisations have yet to put in place consistent methods for measuring whether spending is producing value.

It found that 61 per cent review AI costs during approval and 59 per cent monitor them during operation. However, only 12 per cent consistently assess AI value against cost across the organisation.

That figure rises to 48 per cent among organisations already reporting returns, suggesting that businesses with stronger results are more likely to have linked economics to governance.

Lisa Heneghan, Global Chief Digital Officer at KPMG International, said: "What scale demands is not simply more AI, but the accountability and coordination to run it well and treat it as an enterprise-wide priority. Winning at scale requires senior leadership accountability and building governance and robust controls that turn investment into results, without losing control of risk to scale securely, sustainably and profitably."

The survey covered organisations with annual revenue of at least USD $50 million, while the US tracking sample covered organisations with annual revenue of at least USD $1 billion. Maturity scores measured progress from planning and experimentation through integration and enterprise-wide scaling.

The figures suggest that while AI adoption is becoming more widespread across regions, the next dividing line may be how effectively companies govern, secure and measure the technology as spending rises and deployments deepen.