Nearly six in ten corporate legal leaders believe artificial intelligence is being adopted faster than their organisations can establish effective governance arrangements, raising concerns about accountability, regulatory exposure, and board oversight.
The Q4 2026 General Counsel Risk Index, produced by Diligent Institute and international law firm Wilson Sonsini, found that respondents rated their boards’ readiness to oversee AI risks at an average of 2.9 out of five.
The findings expose a gap between the expansion of AI within business operations and the controls intended to manage its use, particularly where automated systems process sensitive information or influence important organisational decisions.
Some 41% of surveyed legal leaders said their organisations lacked an established basic AI governance framework. That included 14% reporting no formal approach and 27% whose organisations were still developing policies and guidelines.
Dottie Schindlinger, executive director of Diligent Institute, said: “Nearly six in 10 legal leaders say AI adoption is outpacing governance. That gap is a risk in itself: as AI spreads across an organization, it becomes harder to maintain clear visibility into how it is used, what data it touches and who is accountable.”
Regulatory concerns move higher —
The survey found that 59% of legal leaders rated their organisation’s overall risk exposure as high. Regulatory change was the most frequently identified concern, cited by 55%, followed by AI risk at 49% and cyber threats at 47%.
All three categories had become more prominent since the second quarter. Regulatory concerns increased from 48%, AI risk from 39%, and cyber threats from 39%.
By comparison, the proportion citing geopolitical conflict declined from 52% to 26%. Workforce, culture, and talent issues were identified by 34% of respondents, while 24% highlighted supply chain disruption.
The changes reflect shifts in the priorities reported by legal leaders rather than an independent assessment of whether individual threats have increased or decreased.
Legal oversight remains uneven —
Legal departments are already involved in several areas of AI governance. Two-thirds of respondents, 67%, said their teams participated in vendor reviews covering privacy, confidentiality, intellectual property, and regulatory risk.
However, only 23% said their legal departments regularly briefed boards or senior leadership on AI risks.
Responsibility for governance was more commonly assigned to technology, security, data, or digital functions. This can separate legal scrutiny from decisions about where AI is deployed, which information it processes, and how its performance is monitored.
That division becomes more consequential as AI is integrated into customer services, financial processes, recruitment, procurement, and other operational activities.
An effective governance framework needs to establish who can authorise AI applications, what information those systems may access, how errors are identified, and which executives are accountable for significant failures.
Sachin Kohli, partner at Wilson Sonsini, said: “Legal leaders have a critical role to play in connecting these risks across the enterprise, working alongside Risk, Compliance and Security to translate complex challenges into actionable insights.”
Board reporting also needs to distinguish the number of AI applications in use from the risks associated with particular activities. An automated process involving confidential customer records, for example, creates different governance requirements from a tool used to prepare internal meeting notes.
Legal departments can contribute to those assessments through vendor due diligence, contractual safeguards, regulatory analysis, and advice on accountability. Their involvement is most effective when these considerations inform deployment decisions rather than being addressed only after a system has been selected.
The research involved approximately 200 general counsel, chief legal officers, and other senior legal professionals surveyed between late July and late September 2026. Around 70% represented North American organisations, meaning the results describe an international group rather than UK businesses specifically.
The findings show legal departments becoming increasingly involved in operational AI decisions while regular reporting to company boards remains considerably less widespread.
