AI Governance
AI Incident Study Reveals Major Gaps in Post-Deployment Oversight Under Global Regulations
New research analyzing real-world AI failures finds that most incidents show little evidence of the monitoring and assessment practices required by major governance frameworks.
A comprehensive analysis of AI incidents from 2020 to 2026 has uncovered troubling compliance shortfalls in how the industry monitors and reports AI system failures once they are deployed in the real world. Researchers examined incidents against requirements from the EU AI Act, NIST AI Risk Management Framework, and GDPR to assess whether companies and organizations are meeting post-deployment accountability standards.
The Compliance Picture#
The findings paint a stark picture of oversight gaps. More than three-quarters of the incidents examined (77.1%) showed no evidence of the post-market monitoring required under the EU AI Act. Even more striking, 99.6% of incidents lacked documented Data-Protection Impact Assessment evidence, a core GDPR obligation. Additionally, roughly one in ten incidents (9.8%) were simultaneously non-compliant with two or more regulatory regimes, suggesting systemic governance blind spots rather than isolated lapses.
Monitoring as a Critical Factor#
One key distinction emerged: how incidents were discovered mattered enormously. When companies found problems through their own internal monitoring systems, compliance rates soared—87.5% under the EU AI Act and 95.8% under NIST standards. By contrast, incidents discovered externally (by third parties, media, or affected parties) showed compliance rates of just 5.3% and 58.1% respectively. This pattern suggests that organizations with robust internal monitoring capabilities are far more likely to meet governance obligations than those relying on detection from outside.
A New Framework Proposed#
Drawing on these empirical findings, the researchers propose the Proactive AI Governance Compliance Framework (PAGCF), a four-phase lifecycle designed to improve accountability. The model spans pre-deployment assessment, continuous monitoring, incident preparedness, and cross-framework verification—aiming to close the gaps the study identified.
The research, based on analysis of the AI Incident Database, underscores that monitoring capacity is not simply a nice-to-have feature but a foundational condition for effective AI governance in practice.
