← No Hallucinations

Governance · October 2, 2026

Approval Without Governance Is Worse Than No AI at All

By David Monahan · Data Defenders, LLC · the three stages where AI becomes a liability

Three-quarters of organizations sit in the first three stages of the AI Governance Lifecycle: Investigation, Experimentation, and Sanctioned. Each stage carries its own breed of risk — and the next one doesn't fix the last one, it just adds to it. The Sanctioned stage, where leadership has approved specific tools but no governance framework has been wrapped around them, is the most dangerous of the three. Not the safest. The previous post mapped where organizations are stuck. This one is about how floating with ungoverned AI can cost your organization more than a little lost productivity.

Stage 1 — Investigation: the risk is already real

Investigation is where AI shows up before leadership has decided how the business should be using it. An employee pastes a client's medical history into ChatGPT to summarize it. A sales rep forwards an RFP to an AI assistant that archives every attachment. A clinician's old meeting invite auto-admits a personal AI notetaker that happens to be sitting in a hospital's virtual rounds — which is exactly what happened at an Ontario hospital in December 2024, when a former physician's Otter.ai scribe auto-joined via a stale calendar invite, captured protected health information from a virtual hepatology session, and emailed the transcript out of the organization. The hospital filed Breach Report HR24-00691 with the Ontario privacy commissioner. No one authorized the tool. No one knew it was there.

That is Shadow AI, and the numbers around it are not small. Roughly 41% of individuals report using generative AI for work by late 2025, running about 2.3× ahead of firm-level adoption. Around 20% of organizations have experienced a breach linked to Shadow AI, and 87% don't have mature capabilities to detect it in the first place.

Shadow AI isn't the risk of a future breach; it's a present one that nobody has written down. The reason the band on the chart is painted Critical is simple: data is leaving the organization's control before anyone has decided whether it should, there is no inventory to answer to a regulator with, and the incident response starts with "we didn't know that tool was in use" — which is the sentence that ends careers in a breach notification letter.

Stage 2 — Experimentation: the pilot that became a lawsuit

Experimentation is where the organization decides AI has a use case and is worth using. Pilots start. Proofs of concept get a champion. A vendor's "smart" feature gets flipped on in the next release. Nobody intends for the pilot to become production. It becomes production anyway, because the pilot works well enough to not turn off, and because turning it off would require someone to own the decision.

The textbook case for how this ends is Mobley v. Workday, filed in the Northern District of California (Case No. 4:23-cv-00770). The plaintiff alleges that Workday's AI-driven applicant screening tools produced disparate impact against applicants who are Black, over 40, or disabled — violations of Title VII, the ADEA, and the ADA. In January 2024, the court denied Workday's motion to dismiss and held that a software vendor can be liable as an "agent" of the employers that use it, which is the landmark finding of the case so far. In June 2026, Judge Rita Lin denied another motion to dismiss, this time on California Fair Employment and Housing Act claims. Discovery is ongoing. Class certification is pending. Workday's tools screen applicants for more than 10,000 employers worldwide, including roughly half the Fortune 500.

No employer in that 10,000 ran the pilot thinking they were buying a disparate-impact claim. They were buying efficiency. The absence of a governance framework around the pilot — model risk assessment, bias testing, documented human review, named owner — is what turned the pilot into a plaintiff class. That is also why the band on the chart is painted Jeopardy: the organization now has AI in a decision loop, is making consequential decisions with it, and has no evidence that it has managed what the model does with the people on the other end of those decisions.

Stage 3 — Sanctioned: the audit trail that hangs you

Sanctioned is where leadership blesses specific tools and/ or vendors. A memo authorizes use for drafting and summarization. A procurement contract is signed. In isolation, each of these is good hygiene. Together, without a governance framework behind them, they are the audit trail that proves the organization knew — but failed to implement full governance.

The SEC spent 2024 and 2025 making that distinction expensive. In March 2024, it settled with Delphia for $225,000 over marketing claims about machine learning capabilities the firm either wasn't using as advertised or couldn't substantiate — a modest fine that signaled the ceiling was going higher. In April 2025, the SEC and DOJ opened parallel civil and criminal proceedings against Nate Inc., whose founder had raised $42 million on claims of AI-powered checkout that in practice ran on manual processing by workers in the Philippines. The Mozaic Payments criminal indictment that followed, over a $20M raise against a fabricated AI platform, pushed the enforcement ceiling into 20-year prison exposure. In February 2025, the SEC stood up a Cyber and Emerging Technologies Unit with roughly 30 specialists and named AI fraud an immediate priority.

In Europe, the General-Purpose AI (GPAI) obligations of the EU AI Act went into force on August 2, 2026. Fines run up to 3% of global annual turnover or €15 million, whichever is higher, for intentional or negligent GPAI non-compliance, and up to 7% or €35 million for prohibited practices. GDPR enforcement, for reference, hit €7.1 billion in cumulative fines through 2026. In the United States, the Colorado AI Act (SB24-205 and SB26-189) is on a 2026 compliance schedule, and the EEOC has made algorithmic hiring an enforcement priority. None of these frameworks ask whether leadership approved the tool. They ask whether the organization governed what the tool did.

Approval without governance creates evidence that a reasonable person at the organization knew the AI was in use, in a specific way, for a specific purpose, with specific risks — and that no framework existed to catch what the system did with that mandate. Under most of these regulators, that is a worse position than an organization that had no AI at all. The band on the chart is painted Concern for that reason: the organization has moved from not knowing to knowing, and has not yet moved to showing.

The gap compounds, and insurance is noticing

Every month in the first three stages adds more tools, more data flows, and more undocumented decisions that will have to be inventoried later — and the cost of reaching Governed rises with the time spent there. Cyber insurance carriers have noticed. 2026 renewals are increasingly adding AI-specific exclusions for incidents arising from AI-generated code, Shadow AI, and model outputs the insured cannot demonstrate it governed. Several carriers now require evidence of an AI inventory and an acceptable-use policy as a condition of binding or renewing coverage, and the bar for "reasonable controls" is now being drawn where Governed starts, not where Sanctioned ends.

The takeaway

Three-quarters of organizations sit in the first three stages, and none is safer than the next. In Investigation, exposure is already in motion and the organization doesn't know it. In Experimentation, the pilot nobody closed is making decisions a plaintiff will one day name. In Sanctioned, the approval meant to make things safer has become the record proving the organization knew. Governed is the first stage with evidence attached to the decisions — the first stage a regulator, auditor, carrier, or plaintiff's lawyer treats as managed. In 2026, it's where the floor of defensible AI use sits.

Sources: Shadowlock Shadow AI Incident List (Ontario Hospital HR24-00691, December 2024; Samsung, April–May 2023); Technology Radius Shadow AI Statistics 2024–2026 (41% individual GenAI use, 20% breach rate, 65% PII exposure, 87% detection gap); IBM Cost of a Data Breach Report (2025); Mobley v. Workday, Inc., Case No. 4:23-cv-00770, N.D. Cal. (January 2024 ruling on vendor-as-agent; June 22, 2026 FEHA ruling, Judge Rita Lin); SEC enforcement actions — Delphia (March 2024, $225,000), Global Predictions (March 2024, $175,000), Presto Automation (2024, no financial penalty), Nate Inc. (April 2025, parallel SEC/DOJ action on $42M raise), Mozaic Payments (2025, criminal indictment on $20M raise); SEC Cyber and Emerging Technologies Unit (February 2025); EU AI Act (Regulation 2024/1689), Article 101 penalties effective August 2, 2026; Colorado AI Act (SB24-205, SB26-189); EEOC algorithmic hiring enforcement priorities; cyber insurance market reporting on AI riders and coverage exclusions (2026).

← Back to No Hallucinations

Talk to Us Directly

Free 25-minute consultation. Bring your questions.