Executive Summary
Governance theatre is the policy, committee or framework that exists to make the people in the room feel in control. It is what fear produces when it reaches the governance function: something that can be approved this quarter and shown on a slide. The gap is visible in the numbers. In a 2025 survey of 351 practitioners, 75% of organisations reported having AI usage policies, and 48% said they monitor their production AI for accuracy, drift and misuse. In IBM’s 2025 breach study, only 34% of organisations with an AI governance policy regularly audited for unsanctioned AI. A policy nobody checks against will survive a board meeting and fail an audit.
Core conclusions
- Theatre manages the anxiety of the people approving AI. Control manages the risk of the AI itself. The two look alike on paper and diverge the first time something goes wrong.
- A control exists when three things are true: it leaves a record each time it runs, a named person can stop the system and has done so, and it has produced at least one finding that led to a change.
- Boards can ask for those three things directly. The questions take ten minutes and are the same ones an ISO/IEC 42001 auditor will ask later.
The argument, in ten slides
Save it, or send it to whoever is presenting the AI policy at the next board meeting.
Theatre answers the fear in the room
Every part of this series so far has followed a fear to the point where it turns into something an organisation does. In part two the fear became a mandate. In part four it became a purchase. This part is about what it becomes when it reaches the people responsible for keeping AI safe, and that includes people in my own line of work.
The fear here is specific. A board has approved AI spending it does not fully understand. A director has read about a chatbot that promised a customer a refund the company never offered, or a model that leaked data it should never have seen. Somebody at the table asks whether that could happen here, and nobody can answer with certainty. The board does not want a technical briefing. It wants to stop feeling exposed.
The governance function is then asked to produce something by the next meeting. What can be produced in five weeks is a document: an AI policy, a set of ethical principles, a committee charter. The document is approved, the minutes record that AI governance is in place, and the room feels better. The AI systems themselves are unchanged.
That is governance theatre. It is rarely cynical. The people who write it are usually doing their best under a deadline set by someone else’s anxiety. But the thing it was built to manage is the feeling in the boardroom, and a feeling is managed once the slide has been shown.
The gap between the policy and the practice
The numbers suggest theatre is the norm.
A 2025 survey of 351 practitioners, run by Gradient Flow and sponsored by Pacific AI, found that 75% of organisations had AI usage policies setting out what is and is not permitted. 59% had a role or office responsible for AI governance. 54% had an incident response playbook for AI. Only 48% said they monitored their production AI systems for accuracy, drift and misuse. The policy layer was well populated. The layer that would show whether the policy was working was thin.
Most organisations have the policy. Fewer check whether it works.
Source: Gradient Flow, 2025 AI Governance Survey, sponsored by Pacific AI; 351 respondents, February to May 2025. Monitoring is reported as a share of all respondents.
IBM’s 2025 Cost of a Data Breach study, based on breaches at 600 organisations, points the same way. 63% of the breached organisations either had no AI governance policy or were still developing one. Among the organisations that did have a policy, only 34% performed regular audits for unsanctioned AI. Of the organisations that reported a breach involving an AI model or application, 97% said they had no AI access controls in place.
Read together, those figures describe organisations that have written down what should happen and have not set up a way to find out whether it does. That is the shape of theatre: the rule exists, and nothing checks against it.
Free tool
Board AI Oversight Checklist
The questions a board should be able to answer about its AI, and the evidence each answer needs behind it.
Four common forms of governance theatre
Theatre takes a handful of recognisable forms. In my audit work I see the same four again and again, and each one is a sensible thing to have that has been allowed to stand in for the control it was meant to support.
The principles poster. Fairness, transparency, accountability, human-centricity. The words are right and nobody disagrees with them. None of them says what a developer should do differently on Monday, so none of them changes what gets built.
The committee that has never said no. An AI ethics or risk committee meets monthly and reviews every use case put in front of it. Its approval rate is close to 100%. Either every proposal it has seen was sound, or the committee is approving what it is shown because nobody on it feels able to refuse a project the chief executive has already announced.
The amber risk register. Every AI risk is rated medium. Nothing is red, because red would require action this quarter, and nothing is green, because green might look complacent. A register in which everything is amber has stopped measuring anything.
The human in the loop who approves everything. A reviewer signs off each AI decision before it goes out. The reviewer handles several hundred a day and has rejected a handful in a year. The sign-off is real, and it is a signature. Whether any judgment happened behind it is a different question, and the oversight capacity work on this site exists because the answer is usually no.
Each of these survives a board meeting well, because a board meeting asks whether a thing exists. Each fails an audit, because an audit asks whether it worked.
Three tests that separate a control from a performance
ISO/IEC 42001, the management system standard for AI, is useful here for a reason that has little to do with certification. It is built on the assumption that a written policy proves nothing until there is evidence it operated. Its clauses on documented information (7.5), monitoring and measurement (9.1), internal audit (9.2) and nonconformity and corrective action (10.2) all ask, in different ways, for proof of operation. Audit practice draws the same line in older language, between a control’s design and its operating effectiveness.
From that work I use three tests. They are deliberately plain, and any board member can apply them without a technical background.
The record test. Ask for the record that shows the control ran last month. If the control is a review of high-risk use cases, ask for last month’s reviews. If it is monitoring for model drift, ask for last month’s drift report and who read it. A real control leaves a trace every time it runs. A performance leaves a policy document and an approval date, and then nothing.
The stop test. Ask who can stop an AI system, and when they last did. The person should be named, should have the authority written into their role, and should be able to switch the system off without convening a meeting. If nobody has ever stopped anything, ask why not. Sometimes the honest answer is that nothing has gone wrong. More often it is that stopping a system the chief executive championed is not something anyone in the organisation feels safe doing.
The finding test. Ask for a finding the control produced that changed something. A control that has never found a problem is either working over a perfect system or not looking. Perfect systems are rare. The first finding is usually uncomfortable, and the way leadership responds to it decides whether the second one is ever reported.
A control leaves evidence that it operated.
An operating control answers each question with evidence that could have been bad news. It survives an audit, which asks whether the thing worked.
The three tests are my own framework, built on the audit distinction between a control’s design and its operating effectiveness.
The three tests have something in common. Each asks the organisation to produce something that could be bad news: a report showing drift, a name attached to a switch, a finding that embarrassed a project. That is why theatre avoids them. Theatre exists to make the room feel safe, and evidence of operation sometimes makes the room feel worse before it makes the organisation any safer.
Free tool
ISO 42001 AIMS Readiness Checklist
Clause by clause, with the evidence an auditor asks for first. Useful even if certification is not the goal.
Why fear keeps the theatre running
It would be convenient to blame theatre on lazy governance teams. In my experience it is sustained by the same fear that started it, now spread across more people.
The board is afraid of being exposed, so it rewards the appearance of control and rarely asks for evidence of it. The governance lead is afraid of being the person who blocked the chief executive’s flagship project, so the committee approves. The project owner is afraid that a monitoring report will show the system underperforming, so the report is scoped narrowly or not produced. Each of those decisions is understandable. Together they produce an organisation in which everyone is protected from bad news, including the bad news that would have prevented an incident.
This is why adding more policy rarely fixes theatre. A longer policy is still a document. What changes the pattern is a leader who visibly treats the first finding as a success, because it proves a control is working, and who protects the person who reported it. Once that happens in public, the second finding arrives sooner.
Where to start this quarter
If you sit on a board, take the three tests to the next meeting where AI governance is on the agenda. Ask for last month’s record, the name of the person who can stop a system, and one finding that changed something. If the answers take a week to assemble, you have learned something useful about the state of the controls.
If you run the governance function, pick the one AI system that would hurt most if it failed and make it pass all three tests before you write another policy. One control that operates is worth more than a framework that does not, and it gives you something real to show the board.
If you own an AI project, ask your own governance team for a finding. It is a hard request to make, and leaders who make it are telling the organisation that bad news about their project is welcome. That message travels further than any policy.
Evidence & Methodology
The survey and breach figures are cited below. The four forms of theatre, the three tests and the account of why fear sustains it are my own, drawn from audit and advisory work. Here is which is which.
| Claim | Source | Grade |
|---|---|---|
| 75% of organisations have AI usage policies; 59% have an AI governance role or office; 54% have an AI incident response playbook | Gradient Flow, 2025 AI Governance Survey, sponsored by Pacific AI; 351 respondents, February to May 2025 | Measured |
| 48% monitor their production AI systems for accuracy, drift and misuse | Same survey; the report gives this as a share of all respondents, and not every respondent had AI in production | Measured |
| 63% of breached organisations had no AI governance policy or were still developing one; 34% of organisations with a policy regularly audit for unsanctioned AI | IBM and Ponemon Institute, Cost of a Data Breach Report 2025; 600 organisations, March 2024 to February 2025 | Measured |
| 97% of organisations reporting a breach of an AI model or application had no AI access controls | Same IBM study; the base is the 13% of organisations reporting such a breach | Measured |
| ISO/IEC 42001 requires evidence that controls operate, through clauses 7.5, 9.1, 9.2 and 10.2 | ISO/IEC 42001:2023, clause structure; paraphrased, not quoted | Adapted |
| The four forms of governance theatre, and the account of why fear sustains them | My own pattern across audit and advisory engagements, not a study | My call |
| The record, stop and finding tests | My own framework, built on standard audit practice, not externally validated | My framework |
Sources
- Lorica, B. (2025). 2025 AI Governance Survey. Gradient Flow, sponsored by Pacific AI.
- IBM. (2025, July 30). IBM Report: 13% of Organizations Reported Breaches of AI Models or Applications, 97% of Which Reported Lacking Proper AI Access Controls [Press release]. Cost of a Data Breach Report 2025, conducted by Ponemon Institute.
- International Organization for Standardization. (2023). ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system.
The Fear of Being Late Is Making Leaders Buy the Wrong Things
The same fear one step earlier, when it reaches the budget instead of the governance function.
An AI Management System Is Not a Policy Binder. It's the Machine ISO 42001 Actually Audits.
How an AI management system is built to produce evidence from the first day it runs.
From Human-in-the-Loop to AI-on-the-Loop: Redesigning Oversight Architectures
Why a person signing every decision often adds less oversight than it appears to.
Boards Are Asking for AI Strategy. Many Are Asking Because They Are Afraid.
Where the board’s anxiety starts, before it asks the governance function for a policy.
This is part five of The Fear Layer. Part six turns to the conversation leaders postpone longest: telling a team their work is changing. If your board has a policy and you are not sure anything checks against it, that is a question my consulting work is built to answer.