The Accountability Gap

Ownership is not accountability

In the first half of 2026, two independent research programmes measured how organisations govern artificial intelligence. One surveyed 1,000 US small and mid-sized businesses. The other surveyed 2,145 senior leaders at enterprises with $50m or more in revenue across 20 countries. They shared no methodology, no sample, and no sponsor.

They found the same fracture.

Adoption is close to universal and still accelerating. Confidence is high and rising. And the machinery that would make either of those things safe — a named owner, a written rule, a documented place where a human can intervene — is missing in roughly half of all organisations, regardless of size or budget.

The temptation is to read this as a maturity curve: small companies are behind, large ones are ahead, and time fixes it. The data does not support that. A 15-person marketing agency without an acceptable-use policy and a $2bn manufacturer where nobody can name who signs off an AI-informed decision are the same failure expressed at different scales. Neither is short of intent. Both are short of structure.

Adoption compounds. Control doesn't.

KPMG's Q2 2026 Global AI Pulse recorded the largest quarter-over-quarter shift observed anywhere on its AI maturity curve: organisations in the driving-adoption phase — embedding AI across the business, not piloting it — jumped from 13% to 22% in three months. Confidence rose on every measure. Planned spend held at a weighted average of US$188m per organisation over the next twelve months.

Then the number that matters: 7% report established ROI — meaningful business outcomes with tangible, provable growth. That figure went down one point from Q1, while every confidence measure went up.

The small-business picture is the same shape. The National Cybersecurity Alliance and CISA found AI adoption at 87.3% across 1,000 US SMBs, driven by something entirely rational: 49.1% adopted AI to save time or automate routine work. Formal guidelines for that use existed at 45.6% of them.

So more than four in ten small businesses have put AI into daily operations while leaving every employee to decide for themselves what customer data, health information or proprietary code is safe to paste into a chat window. That is not a training deficit. It is the absence of a written rule that would take an afternoon to produce.

The gap is not between companies that are advanced and companies that are behind. It is between the speed at which a tool can be adopted and the speed at which an organisation can decide who is responsible for it.

The 3× finding

KPMG's most consequential result is a comparison, not a headline. Organisations that could point to clearly defined accountability for AI outcomes reported established ROI at 14%. Those that could not reported it at 4%.

Why a named owner produces returns

An unowned system cannot be killed. Nearly half of enterprises — 49% — have scaled back, delayed or paused AI agent deployments once costs began to outweigh value. Making that call requires someone with the standing to make it. Where accountability is diffuse, underperforming deployments persist, consuming budget that never reaches the ones that work.

An unowned system cannot be measured. ROI is not a property of a model; it is a comparison between a defined outcome and a defined cost, and both require an owner who agreed the terms in advance. This is why 76% of leaders can say AI delivers meaningful business value while only 7% can evidence established ROI.

An unowned system cannot be escalated. When an AI output is wrong in a way that matters, the cost is largely set by how fast someone with authority acts. Diffuse accountability is the most reliable way to lengthen that interval.

Note what the data does not show. Executive sponsorship is no longer the constraint: 75% say their CEO actively owns AI as a strategic priority. Sponsorship is solved. Where it lands after that is another matter.

Shared responsibility can support collaboration, but it also makes it harder to determine who owns outcomes, manages risk and holds authority to act when something goes wrong. Add the shared, unclear and not-sure rows together and roughly one organisation in five cannot name a single accountable party at all.

Four questions most organisations cannot answer

Governance fails in specifics, not in principle. KPMG asked leaders to describe four concrete operating practices. Roughly a third called each one very clear and well managed. Roughly a quarter admitted to outright gaps.

Read these as an escalation. The first is about inputs. The second is about outputs. The third is about the brakes. The fourth is about the meter. An organisation missing the third — a quarter of them — has deployed systems that make decisions and provided no documented way for the people nearest the harm to stop one. In EU AI Act terms that is the human-oversight obligation for high-risk systems: not good practice, but Article 14.

We have watched this exact failure before

The most useful thing in the small-business survey is not the AI data. It is the evidence that the same experiment has already run on conventional security controls, and we know how it ends. Small businesses adopted the right tools at high rates. They did not adopt the practices that make the tools work.

The pattern is consistent enough to be predictive. Organisations acquire a control, book the risk as reduced, and never operationalise it. Crucially, the confidence generated by acquisition is indistinguishable — from the inside — from the confidence actual protection would generate.

Confidence is tracking tool acquisition. Risk is tracking practice. The two have come apart, and nothing in the organisation is reporting the divergence.

The reactive tax

Companies that have been breached are, across the board, better prepared than companies that have not.

Organisations that have suffered an incident are five times less likely to have no plan than organisations that have not. The lesson is available. It is currently being sold at the price of an incident.

Accountability as an operating model

"Assign accountability" is useless as advice. What follows is the minimum structure that makes the word mean something operationally — small enough that a 20-person company can implement it and a 20,000-person company recognises it.

Accountability attaches to use cases, not tools

Naming an owner for ChatGPT produces an owner of a licence agreement. Accountability has to attach to the thing that can go wrong: drafting collections letters, triaging support tickets, summarising CVs. Each has a different risk profile, a different regulatory footprint and usually a different natural owner.

A registry is the system of record

Every use case gets an entry, and the entry is not complete without five fields: what it does, who is accountable, what data it touches, what risk tier it falls into, and what happens when it fails. If a use case cannot be described in those five fields it is not ready for production.

Decision rights have to be written down

• Override — who reviews or corrects an AI output before it is acted on, and where is review mandatory rather than advisory?
• Pause — who can stop an AI-driven process, by what mechanism, without needing approval? If the answer involves a ticket queue, the answer is nobody.
• Spend — who owns the operating cost and has authority to scale a deployment back? 49% of enterprises have already needed this authority.

Make the governed path the fast path

Every one of these gaps has the same root cause: the ungoverned route was quicker. Policy that competes with convenience loses every time and generates shadow usage as a side effect. Policy embedded in the convenient path holds.

The gap is closing either way

Adoption will keep compounding. 79% of enterprise leaders say AI investment survives a recession. Small-business adoption is already at 87.3%. Nobody is slowing down.

So the gap between what organisations run and what they can account for will close one of two ways. Either governance catches up deliberately — a registry, named owners, written decision rights, evidence produced by default — or it catches up reactively, after an incident, at a price, on someone else's timetable.

The organisations reporting the strongest returns are not deploying more AI than everyone else. On this evidence, they are deploying it with someone's name on it.