Only 18% of CEOs Say Their AI Fairness Controls Are Strong

A policy records what a company intends to do with AI. Control is the evidence that the intent holds in production: a list of every system, a named person with the authority to stop each one, and a drill that shows they can. Most boards have been told their company has AI governance. My view is that most of them have the first and not the second, and that the CEO who doubts the controls is reading the situation more accurately than the colleagues who report them.

What the CEOs said

In June 2025, EY published the results of its Responsible AI Pulse survey. One line deserves more attention than it got: only 18% of CEOs say their organization has strong controls for AI fairness and bias, against a broader C-suite average of 33%. The survey covered 975 C-suite leaders in seven roles and 21 countries, all at firms above one billion dollars in annual revenue, with fieldwork in March and April 2025. The same release found that 14% of CEOs believe their AI systems adhere to regulations, against 29% of their C-suite peers. (One scoping note: this article is calibrated for $1B+ enterprises and any firm scoped under the EU AI Act, UAE PDPL, or sectoral AI rules. A 200-person SaaS startup has different exposure and a lighter prescription.)

The CEO, the person who carries the legal and reputational weight of every system the company ships, is about half as likely as the rest of the C-suite to call these controls strong. Two caveats matter. The survey measures what executives say, not what an auditor found, and it asks about fairness and bias controls, not every control a firm runs. Even so, the senior view is the one closer to the consequence: closer to the regulator, closer to the journalist, closer to the lawsuit. EY reads its own data the same way: of the seven roles it surveyed, CEOs were the "least likely to overstate the strength of their controls."

The fieldwork ran weeks after the EU AI Act's prohibitions took effect on 2 February 2025. The regulatory floor had already moved when these executives answered, so the 18% records where large enterprises stood at that moment.

Why "we have a policy" is the wrong answer

When a board hears about AI risk, the reflex question is: do we have a policy? The answer is almost always yes. The 2025 Pacific AI Governance Survey, which drew 351 respondents through newsletters and industry partners, found that 75% of organizations have AI usage policies, 59% have a dedicated AI governance role, and only 54% have an incident response playbook for an AI failure. Read the numbers as a cascade. Each step down the funnel loses firms, and the steps that matter operationally are at the bottom.

A policy is a sentence. A role is a person. A playbook is a rehearsal. Regulators, plaintiffs, journalists and the people a model has scored all judge you by the forty-eight hours after it misbehaves in production. The better board question is this: when something goes wrong with one of our AI systems, who has the authority to stop it, and have they ever practised doing so?

If the room cannot name that person inside ten seconds, the policy is decorative.

“Policy records intent. Control is the evidence. Most firms stopped at intent.”

The Governance Gap Stack

I call the pattern the Governance Gap Stack: four rows, each narrower than the one above. It is the one picture I would put in front of any board that believes its AI governance is finished.

Two surveys with different instruments and different samples (EY's CEO-reported fairness controls at 18%, and IBM's finding that fewer than a quarter of organizations have operationalized their AI ethics principles) land on a similar bottom-row reading, four years apart. On those readings, most enterprises have yet to build the bottom row of the stack.

The bottom row is where regulators look. Everything above it is preamble.

This is also where the cost lives. Row 1 is a comms exercise, Row 2 a legal one, Row 3 an org-design decision. Building Row 4 is engineering, training, drills, on-call rotation, change management, and budget, every quarter, forever. My explanation for why so many firms stop at Row 2 is cost rather than ignorance: Row 4 is the only row that needs real money every year.

Why the gap is not closing on its own

Governance is improving, but not as fast as use. McKinsey's Global AI Trust Maturity Survey put the average responsible-AI maturity score at 2.0 on a scale of 0 to 4 in 2025. Its 2026 edition found 2.3, yet only about a third of organizations reached level three or higher in strategy, governance and agentic AI governance; McKinsey's own words are that oversight structures are "struggling to keep pace with the rapid expansion of AI use." Meanwhile Stanford HAI's 2026 AI Index counted 362 documented AI incidents in 2025, up from 233 in 2024.

Deployment is sprinting. Governance is walking. The distance compounds every quarter it stays open, because every new model deployed without a controls layer adds to the inventory of systems that would fail an audit tomorrow. A firm that stays at Row 2 for another year does not stand still: its exposure grows in proportion to how many AI systems it has shipped in the meantime.

The EU AI Act forcing function

The reason this has stopped being theoretical: the calendar has moved.

Article 5 of the EU AI Act, the prohibited-practices regime, has applied since 2 February 2025, and breaches carry the Act's highest fines. Article 4 on AI literacy applied from the same day; the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) rewrote it as a duty to take measures that support AI literacy, with no fine attached.

The next milestone still belongs on the board calendar. The high-risk obligations in Chapter III of the Act apply from 2 December 2027 for systems classed as high-risk under Article 6(2) and Annex III, deferred from 2 August 2026 by the Digital Omnibus. Annex III covers credit decisioning, hiring, biometric identification, critical infrastructure, education access, and several more.

The penalty tiers are already law. Article 99 of the AI Act caps fines at €35M or 7% of global annual turnover for prohibited-practice violations, and €15M or 3% for most other obligations, including the high-risk ones. For a large firm the higher figure applies; for an SME, the lower. For comparison, GDPR enforcement has produced €7.1 billion in fines since 25 May 2018 (DLA Piper GDPR Fines and Data Breach Survey, January 2026). That is the number boards need to put against the cost of staying at Row 2.

Put this date in the board minutes. A firm still running an Annex III system from Row 2 on 2 December 2027 has chosen that exposure.

Closing the gap in 90 days

The encouraging part: the bottom row is cheap to start and expensive to finish. The first ninety days of operational control work are mostly decisions and meetings, not software. The framework I set out as Minimum Viable Governance is the smallest set of controls that starts a firm's highest-risk systems on the climb from Row 2 to Row 4.

Three concrete moves a board can authorize this quarter:

1. Inventory by system, not by policy. Stop asking "do we have an AI policy?" Start asking "list every AI system in production, who owns it, what decision it influences, and which row of the Gap Stack it actually sits at." Many firms discover the inventory itself does not exist. That is the first finding.

2. Designate one accountable executive per high-risk system, and document the escalation chain to them. Name, role, scope of authority. In a regulated firm, the executive will not act alone: they will trigger an existing change-control or model-risk-management process. The point is that the chain is documented, named, and known to the board, not improvised at the moment of incident. This single act moves a system from Row 2 to Row 3.

3. Run a 30-minute tabletop drill on one production AI system. Pick the highest-stakes one. Walk a simulated failure on paper, with the named executive, legal, comms, and the technical owner in the room. Measure three numbers: time to stop the system (in principle), time to escalate to a named executive (in practice), time to a holding statement that legal and comms can both sign. Expect at least one of those three numbers to come back as "we don't know." Because it happens on paper, the drill carries no operational risk, and it surfaces the same insight.

None of the three requires buying software. Each is a decision the board can take in one meeting, and all three are reportable to the audit committee at the next one.

The board's three questions

If you are a board chair or audit committee member, you should be able to answer these three in one sentence each. If you cannot, your firm probably sits with the 82% of CEOs in the EY sample who did not rate these controls as strong.

1. Which AI systems in this company would fall under Article 18 of the UAE PDPL or the high-risk categories of the EU AI Act if challenged tomorrow?
2. Who is the named human accountable for the highest-stakes one, and have they ever stopped it?
3. If our CEO could honestly call these controls strong by the end of this year, what would have changed in our risk posture, and what would it cost?

“More than half of organizations have endorsed AI ethics principles. Fewer than a quarter have made them operational. The gap is the story.”

Eighteen per cent is less a number to argue with than a mirror. The CEOs in the EY sample answer from closest to the consequences, and in the most diplomatic language a survey instrument allows, they are declining to call the controls strong.

Policy is not control. By 2 December 2027, every board with an Annex III system will know which of the two it built.