Thoughtworks has published its Global CIO Survey 2026, and its title asks the question the data cannot answer: who governs enterprise AI? The consultancy surveyed 3,200 CIOs across ten countries regarding enterprise AI governance. The finding is that nobody has settled it. Authority over AI has spread across the business. Accountability, by the CIOs’ own account, has not.
What the enterprise AI governance survey found
The sample is large and independently fielded. Censuswide polled 3,200 CIOs across ten countries between 1 and 10 July 2026. Those ten include India, the UK, the US, Canada, Australia, Germany, Brazil, Saudi Arabia, the UAE and Singapore.
Three numbers carry the story. Eighty-nine percent of CIOs agree they are now more responsible for redesigning workforce workflows and labour models than for managing core IT infrastructure. Eighty-eight percent say AI adoption in their organisation is happening faster than governance structures can adapt. And 90% believe central IT would still be blamed for AI tools that business units bought on their own.
The confidence contradiction
The enterprise AI governance survey contains a tension it does not resolve. While 88% say adoption is outpacing governance, 97% of North American CIOs nonetheless consider their organisation prepared to govern AI consistently across functions. Two-thirds call themselves very prepared. In Canada, that falls to 49%.
Both things can be true at once only if “prepared” means something narrower than it sounds. Independent research suggests that is exactly what is happening.
Independent research agrees
EY’s AI Risk and Governance Survey polled 202 executives at companies with at least $1 billion in revenue. It found 98% had formal AI governance policies. Yet 47% admitted their organisation had previously bypassed its own governance process for urgent deployments. A quarter of those using agentic AI could not detect unauthorised agents running internally.
OneTrust and Sapio Research surveyed 1,200 senior decision-makers across eight markets. Eighty-seven percent encouraged agent use; only 47% had clear governance controls around it. Just 5% said coordination and accountability were clear across the full AI lifecycle.
ABBYY’s study of 1,200 IT leaders found 54% saying AI was adopted faster than they could govern it. Yet 82% reported having a governance framework. Grant Thornton found 78% of executives lacked strong confidence they could pass an independent AI governance audit within 90 days.
Where enterprise AI governance actually sits
The survey’s most useful contribution is the map. There is no dominant model. Globally, 23% of CIOs name the CEO as the greatest influence over AI decisions. Another 21% name central IT, 11% the executive team and 10% dedicated AI roles.
Budget ownership is equally split. Twenty-two percent say IT manages AI budgets centrally, and 22% that IT and the business share them. Another 20% say business units control their own. A further 19% put budgets at executive or board level, and 17% say the model is still evolving.
That distribution is the finding. When five models each attract roughly a fifth of respondents, the honest summary is that no organisation has a settled answer.
The Chief AI Officer problem
The same ambiguity shows up in the newest executive role. Seventy percent of organisations have hired a Chief AI Officer, and another 26% intend to. But there is no consensus on what the role is for.
Thirty-six percent say the CAIO extends the CIO’s centralised strategy. Thirty-five percent say the role operates independently, with equal or greater influence. Twenty-nine percent describe the relationship as a source of friction or unclear boundaries. In Germany, which has the highest CAIO adoption in the survey, 39% of those officers work entirely independently of the CIO.
The accountability mismatch
The gap the release really describes is between authority and blame. Ninety percent of CIOs expect central IT to be held responsible for failures caused by AI tools it never chose.
They also report personal accountability for outcomes they cannot control: security incidents involving AI systems (37%), data privacy breaches (35%), and brand or reputational damage from AI misuse (34%). More than a third feel accountable for workforce disruption caused by AI adoption.
That is not a governance model. It is a liability arrangement. The independent research points the same way. The Purple Book Community’s survey of security leaders found 90% claiming full visibility into their AI footprint while 59% confirmed shadow AI was present, and 86% claiming a complete AI inventory while 57% admitted shadow AI existed. Its authors put the conclusion bluntly: distributed accountability is a polite name for no accountability.
Why the framing suits the firm that commissioned it
Thoughtworks is a consultancy that sells AI transformation, operating model design and governance advisory. A survey concluding that governance is fragmented, that the CAIO role is undefined, and that the answer is clearer decision rights is, conveniently, a survey that describes the work it sells.
That does not make the findings wrong. The sample is large, the fielding was independent, and the numbers line up with EY, OneTrust, ABBYY and Grant Thornton. But it does explain the framing. The release’s own quotes lean toward “AI transformation is a team sport” and away from any structural conclusion the firm could not sell into.
The India angle
India was one of the ten countries surveyed, though the release published no India-specific figures. The regulatory context there is moving regardless.
India’s AI Governance Guidelines arrived in November 2025, setting out seven principles and an institutional structure that includes an AI Governance Group, a Technology and Policy Expert Committee and an AI Safety Institute. The DPDP Act supplies the data-protection baseline. For Indian CIOs, the governance question is less abstract than the survey’s global averages suggest, because the rules are already being written.
What to watch
Three signals. Whether the confidence gap closes from the governance side or the adoption side, because a 97% readiness claim alongside an 88% lag is not a stable position. Whether the CAIO role settles into a defined relationship with the CIO, since a third of organisations currently describe it as friction. And whether boards start setting governance expectations before approving AI investment, which Grant Thornton found fewer than half currently do.
The survey’s most quotable line comes from Thoughtworks’ chief executive: authority over AI is distributed, but accountability has not moved with it. The data supports him. What it does not show is anyone fixing it.
Editor’s Note
This analysis draws on Thoughtworks‘ Global CIO Survey 2026, fielded by Censuswide, and on independent surveys from EY, OneTrust with Sapio Research, ABBYY with Opinium, Grant Thornton and the Purple Book Community, together with India’s AI Governance Guidelines and the DPDP Act. Where a figure or claim is a company’s own, we say so.