Most conversations about AI at work sound the same. We talk about productivity, automation and faster delivery. That makes sense, because AI is already changing how companies build software, analyze data and serve clients.
We talk much less about governance. Not because people don't care, but because it rarely feels urgent while the focus is on adoption. The value of using AI shows up this week. The value of using it responsibly shows up later, often on the day something goes wrong.
The numbers show how wide that gap already is. UpGuard's State of Shadow AI report found that 81% of employees use AI tools their employer has not approved. A more recent PagerDuty survey from June 2026 adds that 34% of office professionals have entered customer data into AI tools. People adopted AI faster than companies decided how it should be used.
I have seen this pattern before. As someone who works in information security, it reminds me very much of ISO 27001 a few years ago.
ISO 27001, the standard for information security management, was first published in 2005. For years, many companies treated it as extra work rather than something that helps the business. Security was seen as a cost center, and certification as paperwork.
Most companies did not start because they had decided security was strategic. They started because clients asked for it. It began with a question in an RFP, then a long security questionnaire, then a contract clause that required evidence of a security programme. At some point the certificate stopped being a nice extra and became a condition for staying on the vendor list.
Today the picture is very different. The ISO Survey 2025, published in October 2026, counted 125,622 valid ISO 27001 certificates worldwide, almost 30% more than a year earlier. In software and IT services, a mature security programme is now usually expected, not a competitive advantage. Companies that started early had time to build it properly. Companies that waited had to build it under deadline pressure, often while a deal was waiting.
The lesson I took from that period is simple. When clients start asking, the clock is already running.
ISO/IEC 42001 was published on 18 December 2023. It is the first international standard for an AI management system: how an organization establishes, runs and improves the way it develops and uses AI. Structurally it will look familiar to anyone who has worked with ISO 27001. It covers scope, roles, risk assessment, controls, internal audit and continual improvement.
Adoption is still early. The same ISO Survey 2025 counted 271 ISO 42001 certificates worldwide, the first year the standard appears in the survey. Among publicly announced certifications tracked by iso42k.com as of October 2026, about half come from enterprise software companies and cloud and AI platforms, the vendors whose product is AI. Professional services firms make up about 15%.
The more important signal is not the certificate count. It is what clients have started to ask. AI questions are now a standard part of vendor security reviews. The 2026 version of the widely used SIG questionnaire from Shared Assessments added a comprehensive mapping to ISO 42001, covering AI from data gathering to bias oversight. In practice, the questions we see are very concrete:
These are the same questions ISO 27001 trained us to answer about information security, applied to a new kind of tool. Answering them takes more than a policy document. It takes evidence.
The risk is not theoretical. IBM's Cost of a Data Breach Report 2026, published in July, shows the gap is growing, not closing (summary of key findings):
Shadow AI is the part that worries me most, because it rarely looks like a security problem. It looks like a helpful engineer. Someone runs out of credits on the approved tool and opens a personal account to finish a task. Someone connects an assistant to a repository to save an hour. A meeting bot joins a client call because it was enabled by default.
None of this is malicious. But for a services company, each of these actions can mean client code or data leaving the agreed environment, with no contract behind it. That is a breach of client trust long before it becomes a breach in the technical sense.
You don't need a certificate to start answering client questions. The basics are the same as in the standard, and most of them can be done in weeks, not months.
None of this requires an ISO auditor. But it is exactly what an auditor will ask for later. Companies that build these habits now will find certification much easier when clients start asking for it.
With ISO 27001, the companies that waited for clients to ask ended up building security under pressure. AI governance is following the same path, only faster, because AI tools spread across teams in months rather than years.
Adoption usually comes first, and governance follows. I'd rather we start before clients ask. At Forte, this is the work we are doing now, and I plan to share what we learn along the way: what worked, what didn't, and which requirements turned out harder than they looked on paper.
83% faster delivery. Under 10% rework. See exactly how Xceptor got there.
.jpg)