On Thursday, I closed the annual conference of the Institute of Internal Auditors in Flic-en-Flac. Before showing a single figure, I asked the room two questions.

First: is your organisation running at least one Artificial Intelligence (AI) pilot today? Not a single hand went up, so my second question fell short: keep it up only if your internal audit has formally reviewed an AI system running in production, touching customers or money.

Although I was taken aback by the fact that not one hand was up for the first question, whether or not you’re running some form of AI in the organisation, the fact that it’s not done at scale is not a Mauritian problem. It is where almost every organisation in the world is stuck.

Everybody is in or thinks it is. Almost nobody is through.

McKinsey’s latest global survey, published in November 2025 from nearly 2,000 respondents in 105 countries, found that 88% of organisations use AI regularly in at least one function. A year earlier, it was 78%. We can therefore say that for many, the experimentation phase is over.

The same survey found that only about 6% are what it calls high performers, where AI contributes at least 5% of operating profit. Boston Consulting Group (BCG), surveying 1,330 senior executives for its Applied AI Index published on 30 September, puts its most advanced group at 7.5%. Two firms, two methods, one answer: fewer than one organisation in ten runs AI at scale.

In fairness, BCG also finds that nearly half of companies now get some real value from AI. The middle has moved up. Further down the report, BCG writes that “the binding constraint is no longer whether AI creates value. It is whether companies can control and govern it”.

The story every board pack tells

Let me describe a bank. Not a real one: a composite of a pattern I saw dozens of times across Africa during my years at Microsoft, and that anyone who sits on a board will recognise.

The bank, let’s say, builds a model to pre-assess SME loan applications. The pilot works. Turnaround drops from about two weeks to a few hours, and the credit team loves it. The business case goes to the board risk committee, and the board asks three questions. Who owns this model when it is wrong? If a declined customer complains to the regulator, can we explain the decision? If it starts to drift, how fast would we know, and can we switch it off?

Nobody could provide a precise and satisfactory answer. Not because the answers are bad, but because nobody was asked to produce them. IT built the model, the business wanted the speed, and risk arrived in the last month. So, the board does not say no. Boards rarely say no to AI. They say “come back next quarter”, then the quarter after.

Nine months later the pilot is still a pilot, the data scientist has left, and a competitor is approving SME loans in three days. The uncomfortable part is that the board was right. Saying yes without those answers would have been negligent. The failure was that nobody built the answers alongside the model. A board cannot say yes to what nobody can show it.

Brakes are for going faster

Good brakes do not exist to make a car slow. They let the driver brake later and take the corner faster. Governance done well works the same way.

The gap ahead is wide. BCG finds that 42% of companies expect to give AI agents genuine decision-making authority by 2030. Only 5% have the full set of controls in place today: oversight, rollback, an audit trail, cost limits. Forty-two percent planning to hand over the keys, five percent with locks on the doors.

Look at that list of controls again. None of it is new. Ownership, change management, logging, segregation of duties: internal auditors have tested these for 20 years. The object is new. The discipline is not.

There is a second blind spot. BCG also finds that more than 80% of AI spending now sits outside the enterprise IT budget. Marketing, HR and claims teams are buying AI on a credit card. A board that reviews AI through the IT budget is missing most of it.

Three questions for you and your executive committee

Before the next AI budget cycle, put these three questions to your team: which AI systems shape decisions in this organisation today, including those bought outside IT, and who owns each one? If the list takes more than a week to produce, you have your first finding. Nobody can scale what they cannot list.

For the next AI project asking for money, what evidence would the board need to approve scaling it, and does that evidence exist yet? Ask before the money is spent, not after. This single question moves assurance from the end of the process to the start, and it is the question the bank in my story never asked.

If an AI system got it wrong tomorrow, how many hours before we knew, and had anyone actually tested switching it off? Not whether a policy exists. How many hours. If the honest answer is “we would hear about it from a customer on Facebook”, the organisation is not ready to let an agent decide anything. A disclosure: I sell AI services, and I sit on boards. Both make me want the same thing, AI that reaches production with the evidence to defend it.

For most of its history, assurance has looked backwards: did the controls work, was the number right? AI adds a second job, looking forward, telling the board what it would take to say yes. The top 10% have someone doing that job. Most of the other 90% do not.

Ask for the list of your AI systems this week. How long the silence lasts is your answer.