Your AI reviews already work, and that is the most encouraging thing in enterprise AI governance this month. On 15 September 2026, EY published a survey of 202 senior AI decision-makers at companies with at least a billion dollars in annual revenue, and most of the coverage led with the gap between what organisations deploy and what they oversee. Read the same figures again and a more useful story comes out. The formal AI assurance review has become near-universal in large organisations in under three years, and when it runs it finds real problems and real budget moves to fix them.
The numbers are worth sitting with. Ninety-eight per cent of the organisations surveyed have formal AI governance policies, and 98 per cent completed a formal AI assurance review in the past year. Those reviews surfaced data quality problems at 57 per cent of organisations, model drift at 48 per cent and shadow AI at 39 per cent. The part that matters most is what happened next: 64 per cent significantly modified at least a quarter of their AI systems as a result, 29 per cent paused at least a quarter, and 25 per cent stopped at least a quarter outright. These are not reviews that produce a slide and a filing reference. They change what is running in production.
So the foundation is built, and it was built quickly. The opportunity for CRM and revenue operations teams for the rest of 2026 is a question of rhythm rather than rulebooks. An annual review inside a business that ships agents weekly is one photograph of a moving picture, and 91 per cent of those surveyed already run agentic AI in pilot or production. The teams getting the most from their governance investment are moving the same checks from an annual event to a continuous one, and making the quick route the official route. That is a smaller change than another policy document, and it starts paying back inside a quarter.
What did the EY AI governance survey find?
EY published its AI governance survey on 15 September 2026, drawing on 202 senior AI decision-makers, board members, C-suite executives and leaders at vice president level and above, at publicly traded companies with at least one billion dollars in annual revenue. Fieldwork ran from 28 May to 15 June 2026, with a margin of error of roughly seven percentage points. It found that 98 per cent have formal AI governance policies, 98 per cent completed a formal AI assurance review in the past year, and 91 per cent use agentic AI in pilot or full deployment. It also found that 47 per cent have set their governance process aside for an urgent deployment, and 49 per cent have not yet updated their frameworks for agentic systems.
Two further findings shape the practical work. Eighty-five per cent have agentic systems acting without real-time human oversight, and 26 per cent could not currently detect an unauthorised agent inside the organisation. Put those beside the review results and the controls clearly work. Coverage and cadence are where the remaining value sits.
Why does a formal AI review find so much?
A review finds a great deal because AI systems drift in ways ordinary software does not. Models are updated by vendors, prompts are edited by the people using them, source data changes shape, and the population an agent serves rarely stays still. The EY reviewers found data quality problems at 57 per cent of organisations, model drift at 48 per cent and shadow AI at 39 per cent. These are not exotic failure modes. They are the normal condition of a system genuinely in use, and a check that reliably finds something is a check worth running more often.
Shadow AI is the use of artificial intelligence tools, models or agents inside an organisation without the knowledge or approval of the people accountable for security, data protection and compliance. In a CRM context it usually looks completely ordinary: a seller pasting account notes into a consumer chatbot to draft a follow-up, a marketing team running a browser extension that reads the pipeline view, or a useful little agent built in a low-code tool and pointed at live records without anyone registering it. It is rarely malicious. It is almost always a signal that the approved route was slower than the deadline, which makes it one of the more actionable things a review can surface.
Read that way, 39 per cent of organisations finding shadow AI means 39 per cent now know where it is and why someone reached for it. What people build for themselves is free product research into the work your sanctioned platform is not yet doing well enough, and the useful response is usually to adopt and govern it.
Why is CRM data quality the most common finding?
CRM data quality matters because every downstream system inherits it. Reporting, forecasting, territory design, routing rules, marketing segmentation and now AI agents all read from the same records, so a duplicated account or an empty industry field does not stay a small problem for long. An agent that reads a stale opportunity stage will act confidently on it, and it will do so faster and more often than a person would. Good CRM data quality means records that are complete on the fields decisions depend on, free of duplicates, consistent in how values are defined across teams, and current enough that someone acting on them is acting on the present.
This is why the 57 per cent figure is the most encouraging number in the survey rather than the most worrying one. Data quality work has always been the hardest thing in a CRM programme to fund, because the benefit is diffuse and the work unglamorous. An assurance review turns it into a named finding with an owner and a date, attached to a programme that already has executive attention. The same field cleanup improves the forecast, the routing and the agent at once.
The fast lane should be the official lane
Forty-seven per cent of these organisations have set their AI governance process aside for an urgent deployment. The instinctive reading is a discipline problem. The more useful reading is a design problem with a known fix. A process bypassed roughly half the time is telling you, precisely and repeatedly, that its cycle time does not match the business it serves. As Richard Jackson, EY Americas Assurance Chief Technology Officer, put it, organisations are applying yesterday’s governance rules to today’s interactions with AI. Cycle time is measurable, and unlike culture it can be redesigned on a timetable.
The move that works is a pre-cleared fast lane with published entry criteria. Decide in advance what qualifies: an agent that only reads, touches no personal or special category data, takes reversible actions, is scoped to a single object or sandbox, and logs everything it does. Anything meeting all of those clears in days through a standing approval rather than a committee date. Everything else goes the long way, and the long way is now genuinely available because it is no longer clogged with low-risk requests.
There is an adoption dividend here that is easy to miss. CRM adoption rates improve when the sanctioned path is the fastest path, not when usage is mandated. The reliable levers are removing steps that do not earn their place, making the system the easiest source of the answer a user needs, involving the people who will use it in designing it, and measuring adoption as a behaviour rather than a login count. A route that clears a low-risk agent in three days instead of three months applies that logic to AI. People build inside the approved platform because it is quicker, which is the only version of compliance that survives a deadline.
What continuous assurance looks like inside a CRM
The good news for CRM teams is that most of the raw material already sits in the platform. On Salesforce, the agent inventory, the trust and audit layers and event monitoring record what agents exist, what they may do and what they actually did. On HubSpot, audit logs and the portal-level view of agents and automations serve the same purpose. On Dynamics 365, the Power Platform admin centre and the agent registry make tenant-wide inventory and data loss prevention policies straightforward. None of this needs a new tool. It needs someone to own the list and read it on a schedule.
A workable rhythm is lighter than most teams expect. A monthly pass over the register asking what is new, what changed and what has gone quiet. A quarterly review of the handful of agents that write to records, covering the fields they touch, the volume of actions and how often humans overrode them. An annual assurance review that now confirms rather than discovers. The annual review does not go away. It gets easier.
CRM technical debt is the accumulated cost of configuration choices that made sense at the time and now make change harder: duplicated fields, overlapping automations, custom code replicating native functionality, integrations nobody owns, and permission sets that outlived the roles they were built for. It is less a failure of engineering than the residue of a system used successfully for years. Ungoverned agents add a layer to it, because an agent is configuration that acts. One inventory surfaces both, so the work you do for AI assurance pays down debt you were going to face anyway.
Where to start in the next ninety days
Start with the register, because everything else depends on it. Spend a fortnight listing every agent, copilot, automation and AI-assisted workflow touching customer data, with an owner’s name against each and a sentence describing what it may change. Most organisations find more than they expected, and the entries outside the official list are the useful discovery. A register that is merely complete already answers the detection question a quarter of EY’s respondents could not.
In the second month, sort the register by what each agent can do rather than by who built it. Read-only agents that summarise and draft go in one group, agents that write to records in another, agents that communicate externally or move money in a third. Each group gets its own review frequency and approval route, and that tiering is what makes the fast lane defensible to a risk committee.
In the third month, instrument what you already run. Capture how many actions each writing agent takes, the proportion a human overrides, and the fields corrected most often afterwards. Those three measures say more about whether an agent is earning its place than any pre-deployment assessment. By the end of the quarter you have a register, a tiering model, a fast lane and a baseline: the whole apparatus, built by a small team inside a normal operating rhythm.
The Sirocco perspective
We work across Salesforce, HubSpot and Microsoft Dynamics 365, and the pattern is the same on all three: organisations that treat AI assurance as an operating habit rather than an annual event move faster, not slower, than the ones still drafting the master policy. The EY figures line up with what we find in client environments. The controls are rarely the constraint. Cadence and coverage are.
An independent CRM partner is a consultancy that advises on and implements CRM platforms without reselling licences for any of them, so the recommendation follows the client’s process, data and commercial position rather than a vendor quota. That matters most in exactly this kind of work. An agent register spanning three platforms, a tiering model that has to satisfy one risk committee, and a fast lane that works the same way wherever the agent was built are all easier to design when nobody in the room needs a particular platform to win. It also means we can say when the right answer is to do less, which is sometimes the most valuable finding a review produces.
The most useful thing about EY’s survey is that it measured a discipline that barely existed three years ago and found it near-universal and demonstrably effective. Organisations that spend this quarter turning an annual review into a running one will go into 2027 able to deploy agents fast because they can see what they have, which is a considerably better place to be than either moving cautiously or moving blind.
If you want a register, a tiering model and a workable review rhythm across Salesforce, HubSpot or Dynamics 365, schedule a consultation and we will start from what is already running.
Get in Touch
If you are building an agent register or trying to make your AI review run at the speed your teams actually ship, tell us which platforms are in scope and we will share how other clients have structured it.
