AI governance vs compliance: what is the difference?

Compliance is a point-in-time proof that you met a rule. Governance is a continuous proof that a named person is accountable for an outcome. You can have the first without the second, and most organisations do. That is the whole distinction, and governance vendors have a commercial reason to blur it, because the thing they sell is evidence collection, and evidence collection is compliance.

The gap shows up clearly in the numbers. Schellman’s 2026 State of AI Governance Report found that 74% of organisations believed they could pass an AI compliance audit today, while only 27% described their governance programmes as fully mature. Nearly three-quarters confident they would clear the bar. Just over a quarter confident anyone is actually running the thing. That 47-point spread is not a measurement artefact. It is the sound of an organisation that has documents but no owner.

What compliance actually proves

A compliance audit asks whether a control existed and whether you can evidence it. Was there an AI use policy? Was it approved? Did staff acknowledge it? Is there a register of models in use? Is there a record of a risk assessment for each one? Were the assessments signed?

These are reasonable questions. They are also entirely answerable by a well-organised person with a document management system and two weeks. None of them asks whether the policy changed anyone’s behaviour, whether the register is current, or whether the risk assessment reflects what the model is doing this month rather than what it was expected to do at procurement.

Compliance is a photograph. It is accurate about the moment it was taken and silent about every moment since.

There is nothing wrong with photographs. If you are subject to the EU AI Act, to sector regulation, to a customer’s security questionnaire, you need them. The error is believing the photograph is the same as the thing it photographed.

What governance proves

Governance answers a different question: when this goes wrong, who finds out, how fast, and who has the authority to stop it?

That question has four parts, and compliance addresses none of them well.

First, a named individual. Not a committee, not a function, not “IT and Legal jointly”. A person whose objectives include AI outcomes and whose bonus moves if those outcomes move. McKinsey found that only 28% of organisations place direct AI governance ownership with the CEO, and 17% with the board. Which means that in most companies the question “who owns this” resolves to a shrug and a working group. We have written separately about who should own AI in a mid-size company, because the answer is less obvious than it sounds and getting it wrong is the most common structural failure we see.

Second, a detection mechanism. Something that tells you an AI system is behaving differently from last quarter, before a customer tells you. A policy does not detect. A register does not detect. A person who looks at a number every month detects.

Third, authority. The owner has to be able to turn something off. If the named person can raise a concern but cannot stop a deployment, you have a complaints procedure, not governance.

Fourth, a feedback loop into decisions. The outputs of governance have to reach the people who approve spend. PwC’s 2026 Annual Corporate Directors Survey found that 82% of directors rate the information linking AI outcomes, risks and business performance as fair, poor, or not provided. The board is approving AI investment on information it does not rate. That is not a governance programme. That is a budget line with a policy attached.

The technically compliant, entirely ungoverned company

Here is what the 74% looks like from the inside. I have seen this shape repeatedly in businesses between 200 and 3,000 people.

There is an AI acceptable use policy, drafted by an external firm in 2025, circulated by email, acknowledged by 94% of staff. There is a register of approved tools, maintained in a spreadsheet by someone in IT operations. There was a DPIA for the customer service assistant. There is a clause in the supplier contract about model training on company data. Every one of those artefacts would survive an audit.

Meanwhile: the finance team is pasting management accounts into a consumer chatbot because the approved tool is slower. Nobody has looked at the customer service assistant’s escalation rate since the pilot. The register has not been updated in five months and does not include the three tools procured on departmental credit cards. The person who wrote the DPIA has left. When the board asks whether AI is under control, the CIO says yes, and is not lying, because every document the CIO can point to is in order.

That company passes. It is also completely ungoverned, and it is carrying risk that nobody has looked at because looking is nobody’s job. If this sounds familiar, the pattern is close to what we describe in whether shadow AI is a real risk for a 500-person company.

Why the vendors blur it

Worth saying plainly, because it explains the state of the search results on this question.

The tooling market for AI governance is largely an evidence market. Model registries, policy management, control mapping, audit trail generation, framework crosswalks against ISO 42001 and the EU AI Act. These are useful products and I am not arguing against buying them. But what they produce is better compliance artefacts, faster. If you have no named owner and no detection mechanism, buying the tool gives you an ungoverned organisation with tidier paperwork, and a higher confidence that you would pass, which is precisely the 74% number.

So when a vendor page uses “governance” and “compliance” as near-synonyms, that is not sloppiness. The conflation is the product positioning. Governance is a management problem with an organisational answer. Compliance is a documentation problem with a software answer. Only one of those can be sold by the seat.

How to tell which one you have, in about ten minutes

Four questions. Ask them out loud, in a room, and do not let anyone check first.

Name the person. If the board asked today who personally owns AI outcomes, can you say a name without checking? If the answer contains a slash or the word “committee”, you have compliance.

Name the number. What single metric tells you whether an AI system in production is still doing what it was approved to do? If nobody can name it, nothing is being watched.

Name the date. When was the model register last changed? If the answer is more than a quarter ago, either nothing has changed in your AI estate, which is improbable, or the register is fiction.

Name the stop. Who turned something off in the last twelve months, and what was it? If nothing has ever been stopped, either you have no exposure or you have no brake. Decide which you believe.

Four honest answers tell you more than a control matrix. They are also uncomfortable in a way audits are not, which is the point.

Where this sits in a readiness assessment

Governance is the sixth of six pillars in our free AI readiness audit. Thirty questions, seven minutes, five questions per pillar across Data, Process, People, Technology, Strategy and Governance. You get a score out of 120, a band for each pillar, and a short synopsis. It does not give you an action plan, and it does not inspect your systems, because every answer is self-reported by the person sitting there answering it.

That last point matters here. The audit is not a compliance check and cannot be one. It asks about ownership, consistency and accountability, which are the things a compliance audit assumes and never tests.

The pattern it tends to expose is the same one the Schellman numbers describe. A respectable score on Technology, a respectable score on Data in businesses that have done the work, and Governance sitting a band lower than everything else. That shape is not a failure. It is the normal position for a company that bought tools before it decided who was answerable for them, which is most companies, and which is why the question in why companies need AI governance and who owns it keeps getting asked.

The practical order of operations

If you are at the start of this, do not begin with a framework.

Write one name on a page. That is the owner. Give them a line in their objectives and a standing slot on an existing management meeting, not a new one.

Then pick two or three numbers that would tell that person something changed. Escalation rate, override rate, volume of use, cost per month, complaints referencing an automated response. Anything measurable and currently unmeasured.

Then build the compliance artefacts on top of that, because now they will describe something real. A register maintained by a person with a reason to maintain it stays current. A register maintained because the auditor is coming in March is accurate in March.

Doing it the other way round produces the 74%. Documents first, owner never, confidence high, exposure unexamined.