Artificial intelligence has become the biggest compliance risk for businesses as governance fails to keep pace with the technology and its usage.

US compliance specialists Thoropass has released its 2026 State of Audit and Compliance Report, revealing that AI adoption has rapidly become the most significant new source of IT security compliance risk. Almost 7 in 10 security and compliance leaders say AI adoption is outpacing their security and compliance controls, signalling a growing governance gap.

The report, based on a survey of more than 500 security, IT, and compliance professionals, found that while compliance programs are more mature than ever, they are under increasing strain from multi-framework audits, evidence management overhead, and the fast rise of AI-related risk.

“AI has moved faster than governance,” explained Sam Li, CEO of Thoropass. “Most organisations did not plan for how quickly employees and teams would adopt AI tools, and compliance programs are now racing to catch up. What we are seeing is a widening gap between innovation and oversight.”

The company added AI is becoming integral not just to organisations’ technology stacks, but to how companies operate. That same technology can and should be used to help organisations run smoother, more efficient audits, empowering them to eliminate manual effort, improve evidence quality, and give teams confidence as audit expectations evolve.”

The research concluded AI-related concerns now eclipse traditional security threats in both perceived likelihood and potential regulatory impact:

• 69% of respondents stated that adoption of AI tools in the organization is outpacing their ability the security and compliance controls.
• 55% say that AI-related data exposure or misuse as their top breach concern – a higher rate than ransomware, IAM failures, or cloud misconfigurations.
• 57% believe AI-related incidents are the most likely to trigger regulatory action or customer fallout in 2026.
• Only 18% say they are not concerned about AI-related compliance risk.

“Compliance programs look mature on paper, but they’re feeling the strain,” the research cautioned. “Most organisations run multiple external audits each year, and more than half say their programs are mature, with defined metrics and monitoring in place. This is not a lack of structure. The friction shows up in execution.

“Nearly 91% have had to resubmit evidence because of auditor feedback or miscommunication. More than half cite evidence collection across scattered tools as their biggest bottleneck, and managing multiple frameworks remains the top compliance challenge. Four in 10 teams duplicate work across frameworks, and 38% are not confident they would pass an unplanned audit tomorrow.

“This is not about burnout. 96% actually say compliance is manageable. It is about fragmentation. Evidence lives in too many systems. Auditor expectations shift. Frameworks overlap but do not align cleanly. Preparation stays reactive when it should be continuous.”

The report explained that compliance is increasingly viewed as an ongoing risk management function – driven by security posture, insurance requirements, and customer trust – rather than a once-a-year certification exercise.

“The audit model itself is changing. Organisations do not just need more controls – they need audits that operate continuously and keep pace with how modern systems actually work. The future of audit is less manual collection and more real-time assurance.” continued Li.

The definition of “audit-ready” is changing, according to the research. Organisations that can consolidate compliance workflows, maintain up-to-date evidence, and integrate AI governance into existing frameworks will be better positioned for both upcoming audits and regulatory scrutiny.

“This year’s survey reveals an industry caught between two forces: the pressure to adopt AI quickly and the imperative to govern it responsibly,” Thoropass concluded.