Are you scaling AI within a control environment that can keep pace?

Europe’s AI market in 2026 is at an inflection point. Organisations are moving rapidly from experimentation towards broader deployment, while regulation, most notably the EU AI Act, is becoming a defining feature of the operating environment. For risk and compliance leaders, the strategic issue is no longer whether AI will scale, but whether governance, controls, and assurance can scale alongside it.

Marsh’s AI without blind spots: The 2026 Marsh European AI Opportunities and Risk Survey Report points to a consistent pattern across industries and markets: AI interest is high and deployment is advancing, yet governance maturity remains uneven. In enterprise risk management (ERM) terms, uneven governance leads to inconsistent risk acceptance decisions — different teams applying different standards to comparable use cases — at the exact moment boards and regulators are asking for defensible, repeatable oversight.

Adoption is still early to mid-stage for most organisations. Over a third of respondents describe themselves at the very beginning of adoption, with a meaningful share still limited to pilots or no deployment at all. Another large segment reports AI availability confined to selected functions. Only a minority have scaled across multiple business units, and even fewer describe AI as a core business capability.

Risk leaders should treat this maturity distribution as a governance window. Early adoption is precisely when roles, decision rights, and minimum controls can be standardised before usage becomes embedded in day-to-day operations. Waiting until “we scale” to formalise AI governance is how organisations accumulate control gaps that compound as adoption expands.

Where AI is already used and why ERM oversight must extend beyond IT

AI is already being used in operational work, not just for experimentation. The most common applications are basic workflows and daily workload tasks across teams, followed by IT operations and cybersecurity. Legal and compliance functions are also active users, and use by risk management, while lower today, is expected to grow.

For ERM and compliance leaders, the critical point is not which function uses AI the most. It is that AI is moving into workflows where it can influence judgments, decisions, communications, and records. Summarisation, drafting, classification, and document handling can affect contractual commitments, regulatory submissions, HR outcomes, and customer communications, even when the tool is positioned as “productivity support.”

Over the next two years, organisations expect AI to become more deeply embedded across core business functions, not only in technical teams but also in finance and accounting, risk management, legal and compliance, and other core functions.

This is why generative AI risk management must be treated as an operating model capability: defined accountability, consistent risk assessment, lifecycle controls, and an assurance approach aligned with the three lines of defence. If accountability remains confined to IT and security, organisations risk overlooking non-technical exposures that regulators and boards increasingly scrutinise, including fairness, documentation, third-party dependencies, and explainability.

Governance maturity is uneven, and the EU AI Act readiness raises the stakes

Leaders show strong awareness of AI-related risks, particularly data privacy and security, as well as the risk of erroneous outputs. Regulatory and compliance risk is also prominent, alongside algorithmic bias and fairness concerns.

However, awareness does not equal control. Many organisations still rely on general ERM processes or ad hoc reviews. As a result, formal AI risk assessment often occurs only after adoption has started, creating a significant readiness gap.

A key assurance issue lies beneath these findings: confidence in managing erroneous outputs remains low. Errors in AI-generated content are not merely quality issues. They become governance problems when outputs inform decisions, support regulatory records, or are treated as verified facts. Addressing this risk requires clear validation steps, defined human review points, logging, and escalation when confidence in the outputs is uncertain.

EU AI Act readiness is becoming an execution challenge rather than a knowledge challenge. Many organisations still lack concrete compliance plans, while the greatest obstacles remain the implementation of controls, the interpretation of requirements, and cross-functional coordination. Ultimately, readiness depends on translating regulatory obligation into operational evidence that can withstand scrutiny.

Are you scaling AI with a control environment that can keep pace? Fill in the form below if you would like to contact us.

Hands typing on a laptop in a dimly lit room

Article

Are you scaling AI within a control environment that can keep pace?

Where AI is already used and why ERM oversight must extend beyond IT

Governance maturity is uneven, and the EU AI Act readiness raises the stakes

Are you scaling AI with a control environment that can keep pace? Fill in the form below if you would like to contact us.

Related insights

AI adoption is accelerating: Is AI risk management keeping up?

Strategy under uncertainty: embedding risk in decision-making

Is your supply chain ready for CS3D? What the Corporate Sustainability Due Diligence Directive means

European logistics network under pressure: Supply chain resilience lessons from the Rhine River drought