Editor’s note: The following is a guest post by Michael Meehan, global VP of partners and alliances at Exterro, a data security software vendor.

I've had some version of the same conversation with a dozen different partners over the last few months. A customer got excited about AI, moved fast and is now quietly asking whether anyone actually knows what it's doing inside their environment. Usually the answer is no, and usually nobody wants to say that out loud in a steering committee meeting.

The disconnect between AI deployment and governance isn’t something enterprises will grow out of on their own. It's shaping up to be the defining risk of the current AI cycle and might be the best services opportunity for the channel in a decade.

For a while, this AI control gap was mostly anecdotal — something partners and IT leaders mentioned in passing, usually with a shrug. Now there's data behind it. IBM recently surveyed 2,000 CIOs and CTOs and found that 70% believe AI is being deployed faster than their teams can track it, and 77% say adoption is already outpacing their governance capacity. Leaders in most enterprise IT organizations admit they've lost track of their own AI footprint.

Cisco's 2025 AI Readiness Index adds another relevant data point from a survey of more than 8,000 senior business leaders. Only 13% of organizations qualified as AI "pacesetters," the small group with the infrastructure, skills, and governance maturity to actually scale AI responsibly. Governance wasn't a footnote in that research. It was one of the core pillars Cisco used to assess AI readiness.

The two studies seem to suggest that the constraint on enterprise AI right now isn't model quality, compute or even budget. It's control. Nobody's struggling to find AI tools to deploy. They're struggling to know what they've already deployed.

How we got here

None of this necessarily happened because organizations were being reckless. It was the predictable outcome from individual teams solving individual problems faster than governance could keep up.

A marketing team starts using a generative AI tool for content drafts. A finance analyst pastes numbers into a chatbot to save time. An engineer starts using an AI coding assistant that nobody in security has vetted. None of these people think they're doing anything wrong, and in isolation, maybe they aren't. But multiply that across a few thousand employees and a dozen departments, and you end up with an AI footprint that nobody in IT, legal or compliance could accurately describe if you asked them.

Some customers describe this as "AI fatigue," which may be the right term. In general, people aren’t against AI, but a gap exists between the top-down pressure to adopt it quickly and the reality on the ground. Approval cycles take three to six months in regulated industries. Existing governance frameworks often predate generative AI. And employees are being told to move fast with tools nobody's fully explained to them. Poor alignment pushes a big chunk of AI use into the shadows, where nobody's watching.

That approach is getting expensive. EY's 2025 responsible AI research found that 99% of the organizations it surveyed had already experienced financial losses tied to AI-related risk, 64% of them over a million dollars, with an average loss north of $4 million. The professional services firm surveyed nearly 1,000 C-suite leaders in June of last year.

Courts are starting to treat AI prompts and outputs as discoverable evidence in litigation, which means the informal, ungoverned way most employees are using AI today is creating a legal record nobody's managing. Add regulatory frameworks like the EU AI Act, and the risks are no longer hypothetical.

The channel's role

Enterprises know AI governance is a problem, but most don't have the internal expertise or bandwidth to fix it on their own. That's where the channel comes in.

For most of the last two decades, partners made their money selling and managing infrastructure — servers, cloud, storage, licensing. That business isn't going away, but it is evolving. Customers aren't short on AI tools, but they lack someone who can walk into the room and answer the harder questions: What data is this actually touching? Who's accountable if it gets something wrong? If a regulator or opposing counsel comes asking, can we prove what happened?

Partners who can answer those questions stop looking like vendors and start looking like the people a customer calls before the next rollout, instead of after something's gone wrong.

It doesn't require a new business model. But it does mean expanding a conversation most partners are already having.

Start with an honest inventory. Most organizations have never mapped where AI is running across their environment against their existing data classification standards. That's an assessment practice, and it's usually the easiest door in. Customers are far more willing to pay for a diagnostic than a solution they don't yet understand they need.

Policy work is a natural next step. Telling employees to use AI responsibly isn't policy. Partners can help build something with teeth: specific approved platforms, clear rules about what data can and can't go into a prompt, defined escalation paths when something goes wrong. Then, help enforce it, which is something customers struggle with on their own.

There's also a growing need around investigation readiness. Organizations need to reconstruct what an AI tool did, when, and why, with a human able to explain and defend the outcome after the fact. This is a fairly short walk for partners working adjacent to security and compliance.

治理必须是持续性的。它需要定期审查、人在回路中的检查，以及一个能让法务、合规和 IT 获得共同视图的共享资源。AI 商业模式正存在于此。与部署这种一次性项目不同，治理是持续进行的。AI 的演进速度持续快于围绕它的政策，因此监督需求会不断自我更新。

先发优势

这还算不上抢地盘，但已经很接近了。目前大多数企业还没有 AI 治理方面的首选合作伙伴。谁赢得信任来填补控制缺口，谁就会成为客户不断回访的顾问。

等待治理框架标准化，或等待客户明确要求这一点，是错误的打法。IBM 和 Cisco 的数据并不是在预测未来的风险。它们描述的是大多数企业今天的处境。

你不需要一夜之间变成合规专家店。评估和政策工作直接建立在大多数合作伙伴已在安全与数据管理方面具备的技能之上。你可以把这些能力转向 AI 工作，而且你很可能有一些客户账户中，CIO、总法律顾问或合规部门的某个人曾顺带提到 AI 风险，却不太知道该怎么处理。这些交易更容易成交，因为客户已经知道自己有问题。

董事会和高管已不再仅仅因为 AI 活动本身而印象深刻。他们想知道它正在创造价值，同时没有悄然制造他们日后必须为之负责的风险。

能够成功扩展 AI 的企业，未必是运行最先进模型的企业。它们将是那些能够向董事会、监管机构或自身领导层解释其 AI 在做什么、以及为什么他们能够为其背书的企业。这种能力不会随任何平台一同交付。必须有人来构建它，而越来越多情况下，这个“有人”将是合作伙伴。

IBM 和 Cisco 所描述的控制缺口并不是快速采用过程中的暂时副作用；它就是这一市场未来十年的形态，正在大多数行业仍专注于部署速度之时形成。那些尽早认识到这一点、并在其成为基本门槛之前开始将治理纳入服务栈的合作伙伴，将不只是增加一条新的收入线。他们将改变与客户关系的性质，从供应商变为顾问，而且一旦确立，其他人很难逆转。

这就是当下摆在渠道面前的机会。下一个问题是：谁会率先行动？