Your AI Governance Problem Lives Inside Your Processes

Jakob Freund is the CEO of Camunda, a software company innovating end-to-end process orchestration and automation with agentic AI.

​Most conversations about AI governance start with the model. Technology leaders ask whether a model hallucinates, whether it leaks sensitive data and whether the vendor can explain its outputs. Those questions matter, but the incident data coming out of large enterprises points elsewhere, and leaders who keep their attention fixed on the model are missing an important area of potential exposure.

A 2025 EY survey of 975 C-suite leaders found that 99% of those organizations had lost money to AI-related risks, with an average loss estimated at $4.4 million. Noncompliance with AI regulations topped the list of risks. My own company’s research has added a layer to that picture. Among 1,000 process decision-makers at organizations with at least 1,000 employees, 40% reported “an AI-related compliance or governance issue in the past 12 months.” Those respondents said process-related challenges contributed to 84% of the incidents.

When the process causes the problem, a better model can’t solve it.

Legacy controls assume a person is always involved.

Almost every process in a large enterprise reflects the assumptions of the people who designed it, and those designers expected a person to handle each step. An approval exists because someone needs to read the case before it moves forward. A handoff between teams exists because the next person needs context. The audit trail often consists of email threads, ticket comments and the memory of whoever touched the case last.

Gartner, Inc. anticipated this pattern and predicted in June 2025 that organizations would cancel more than 40% of agentic AI projects by the end of 2027. It named escalating costs, unclear business value and inadequate risk controls as the causes. Model capability didn’t make the list. The causes of failure have more to do with how an organization runs AI.