AI Audit Readiness and the Gap Between Passing and Governing

Two 2026 Surveys Measured Confidence. The Five Levels of AI Posture Explain Where It Came From

by Sam Rogers
8 min read
analysis
governance
measurement
risk-management
regulated-industries
AI Audit Readiness and the Gap Between Passing and Governing

This article is for educational purposes and does not constitute legal advice or certification criteria. Organizations should consult qualified counsel about obligations that apply to them.

Believing you would pass an AI audit is itself a self-report, and the audit exists because self-reports are not evidence.

Two Reports, One Shape

On July 29, 2026, Schellman published its State of AI Governance Report 2026. Researchscape fielded the survey between April 13 and May 11, 2026, among 525 US professionals working in or around AI governance at organizations with more than 500 employees and at least $100 million in annual revenue. The headline finding was a wide gap: a large majority believed their organization could pass an AI compliance audit today, while a much smaller group described their governance as fully mature. Schellman framed the report around five areas where confidence and maturity diverge: funding, agentic AI oversight, accountability, regulatory readiness, and business impact.

Drata's The State of GRC in the Age of AI, released July 15, 2026, surveyed 300 IT and security professionals through Wakefield Research and found the same shape from the other side. Only a small minority were fully confident they could see every AI tool in use across their organization. A majority said an AI tool used for GRC work had already contributed to a failed audit or a lapsed regulatory standard at least once.

Both surveys are vendor research, and both sponsors sell what the findings recommend: Schellman is an ISO 42001 certification body, Drata sells compliance automation. So the percentages deserve the skepticism any sponsored survey deserves, and I'm giving them exactly that much. The shape doesn't depend on them. Confidence is high, visibility is low, and the audit has already been failed somewhere in the building.

What an Audit Actually Tests

The phrase "AI audit" hides a specific object. In most enterprises it means conformance to ISO/IEC 42001:2023, the AI management system standard published in December 2023, or to a program modeled on it. The auditable requirements sit in seven clauses: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. Annex A adds a reference set of controls, grouped under headings such as policies related to AI, assessing impacts of AI systems, the AI system life cycle, data for AI systems, and use of AI systems.

Every one of those clauses tests the management system. Clause 6 asks whether the organization planned for AI risk and assessed the impact of its systems. Clause 9 asks whether it decided what to monitor, by what method, and when, and whether it ran an internal audit and a management review. An organization that documents all of this, follows its own documents, and can produce them on request will pass. That's what a management-system audit is for.

Now notice what it doesn't observe. The standard requires the organization to determine what to measure. It doesn't require that the measurement include how the analyst behaves when the model's answer is wrong. An organization can hold a certificate, a policy, an impact assessment, and a monitoring cadence, and still have no artifact anywhere recording whether a single professional caught a single seeded error. When new systems are introduced, execution is audited. Behavior is not.

So the two answers in Schellman's survey are answers to different questions. "Could we pass an audit" asks whether the apparatus exists. "Is our governance mature" asks whether the apparatus works. The first is a documentation question. The second is a behavioral one. Respondents were right to answer them differently. The gap is the honest part of the data.

Where the Gap Sits on the Ladder

The AI Posture maturity model gives the gap coordinates. It scores an organization on three independent vectors, People, Infrastructure, and Regulation, and each vector climbs the same five levels: Perceiving (a written acknowledgment, nothing measured), Assessing (a baseline exists), Integrating (a policy change traces to that baseline), Calibrating (measured continuously, defensible to an outside reviewer), and Engineering (maintained as capability).

Place the survey answers on that ladder. An organization with a written AI policy and no behavioral measurement is Perceiving on the People vector, whatever its confidence. An organization that would pass an ISO 42001 audit has, on the Regulation vector, something close to Integrating: obligations exist as controls, and the controls are documented. "Fully mature" is a claim about Calibrating or above. What the survey measured is the distance between Level 1 on one vector and Level 4 on another, reported by the same respondent as if they were one number.

AI Posture's constraint rule refuses that averaging. An organization's overall posture is the minimum of its in-scope vectors. Calibrating on Regulation with Perceiving on People yields Perceiving. That's structural, and it's why a certificate doesn't settle the maturity question: the certificate lifts one vector, and the vectors don't lift each other. The Regulation vector's obligations across jurisdictions are cataloged at EveryAILaw; the Infrastructure vector's readiness for agent interaction is a separate discipline with its own evidence. Neither is the People vector, and the People vector is where Schellman's respondents were the least measured and the most confident.

The Human Review Finding Is the Tell

Schellman's agentic oversight section is the part of the report that reaches the People vector, and it's the part that should worry the confident. Among organizations with agents in testing or production, the public release says only that approaches to reviewing agent decisions and actions vary considerably. Three review models cover that range. Some define thresholds that trigger human review. Some review only decisions they consider high-risk, with nothing establishing that anyone wrote down what high-risk means. The rest require a person to review every agent action regardless of risk.

The third model is the one confidence produces. It sounds like rigor and it decays on contact with volume. When one person has to approve everything, approvals become rubber stamps within a quarter or two, and the organization carries the cost of review without the protection. The second model has the same defect at a slower rate: an undefined threshold is a threshold each reviewer sets under deadline. This is the operational drift sequence at the point where human review becomes performative, and the review step still exists on the process diagram. An auditor reading the diagram sees oversight. Dashboards show activity. They do not show reliability.

Nothing in a management-system audit distinguishes a review step that catches errors from one that timestamps them. That's the measurement Clause 9 leaves to the organization, and it's the one the confident organizations haven't taken.

What Would Make the Confidence Earned

Moving from Perceiving to Assessing on the People vector takes one artifact: a baseline of how people actually behave when AI output is uncertain, incomplete, or wrong. Not what they report, what they do.

PAICE (People + AI Collaboration Effectiveness) produces that baseline. The assessment seeds errors of the kind that reach filings and client reports, plausible and confident and false, and scores whether the professional catches them, verifies the claim that carries the decision, escalates when a source can't be confirmed, and corrects rather than defends. Someone who sounds fluent but misses the seeded error scores lower than a terse person who catches everything. The output is a cohort-level reliability profile, which is exactly the kind of monitoring measure Clause 9 asks an organization to choose and can't choose for it.

The architecture keeps it governance without surveillance. Scores attach to hashed identifiers. No conversation text is retained. Individual results are structurally unavailable to the organization, not withheld by policy. A governance committee sees the reliability of its cohort and the direction it's moving. It doesn't see which analyst to talk to. The analyst does.

An organization holding that baseline can answer the survey's two questions with one number, because the number is no longer a self-report. It can name its level on the People vector, show the evidence, and name the next rung. Until then, the audit we believe we'd pass is testing the paperwork, and the maturity we doubt is the part the paperwork never reached.

Want to assess your team's AI collaboration readiness? Learn about PAICE for organizations or take an individual assessment to see it firsthand.

Curious but short on time?

Take the 3-minute PAICE Pulse — a quick confidence check that maps how you see your own AI collaboration posture. No login required.