Deloitte’s 2025 AI Survey says 91% of organizations plan to increase AI spend again this year [1].
McKinsey reports 88% of firms now use AI in at least one business function [2].
PwC finds 56% of executives say Responsible AI is led by first line teams (IT, engineering, data, AI), not by a central control function [3].

That mix is powerful, but also dangerous: adoption is scaling faster than oversight.

A recent bibliometric study (510 papers) shows something that surprised me.
AI governance research is growing, but it is still small compared to the full AI research landscape. And the “hot zone” is not where many boards think it is.

The strongest clusters in the literature are:

• Education + ChatGPT

• Ethics + privacy (GDPR)

• Generative AI

But the “governance” cluster is relatively small, and high risk areas (critical infrastructure, worker management, policing, and malicious use) are still underexplored [4]. That is exactly where the EU AI Act brings real legal pressure, with prohibited and high risk categories [5].

My practical takeaway for leaders in the Netherlands:
If your AI governance plan is mostly “privacy and principles”, you are late.

Start with three concrete moves:

1. Map your AI systems to EU AI Act risk levels

2. Assign named owners across the full lifecycle

3. Build audit ready artifacts (logs, data lineage, model facts, impact checks)

If an auditor asked tomorrow, could you show proof, not promises?

For a fast governance readiness check, contact info@centralink.nl

References 
[1] Deloitte. (2025). Turning AI into ROI: What successful organisations do differently. Deloitte Insights.
[2] McKinsey & Company. (2025). The State of AI: Global Survey 2025.
[3] PwC. (2025). Responsible AI survey: From policy to practice.
[4] Kim, B.-J., Jeong, S., Cho, B.-K., & Chung, J.-B. (2025). AI Governance in the Context of the EU AI Act: A Bibliometric and Literature Review Approach. arXiv.
[5] European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). EUR-Lex summary.