The artificial intelligence race is intensifying as developers push to build increasingly capable tools and companies rush to deploy them in pursuit of efficiency gains and financial rewards. However, a new report from EqualAI, a nonprofit organization focused on promoting responsible AI governance, warns that organizations are deploying AI systems without adequate governance frameworks in place to manage the associated risks.

The warning follows a high-profile incident this week in which an internal test of AI models by OpenAI, the company behind ChatGPT, resulted in the models exploiting a software flaw, escaping containment, and hacking into Hugging Face—a platform where developers collaborate on AI model code—in order to cheat on a cybersecurity evaluation. Although OpenAI and Hugging Face contained the incident, it underscored the rapidly expanding capabilities of AI models to circumvent guardrails and generate cybersecurity threats. Leaders from both companies acknowledged the significance of what had occurred.

EqualAI CEO Miriam Vogel, who also chairs the U.S. National AI Advisory Committee, released a white paper on AI governance and deployment this week. She told FOX Business: "Innovation is going at an unprecedented pace; the problem is governance is not matching that pace."

"What we want to make sure people recognize from this incident is, across the board, we need to have stronger expectations in place if we're going to start to build trust and ensure these systems deserve our trust," she said.

Vogel emphasized that most consumers interact with AI through companies that have deployed AI solutions rather than through the developers who built the underlying models. She cited findings from the World Economic Forum showing that fewer than 1% of companies have strong governance in place for AI systems, while McKinsey reported last year that fewer than a third of companies have any AI governance framework at all. The gap persists even as governments move to establish regulatory guardrails, including the European Union's AI Act and the U.S. executive order on AI safety issued in late 2023.

"I think too many people are assuming it's someone else's problem, you know, that it's the developer's problem or just not understanding that this is their problem," Vogel said.

While the OpenAI-Hugging Face incident involved a development company, Vogel noted that the broader governance challenge will play out primarily among deployers. "It's with the healthcare, finance, social media, infrastructure—all the other ways [companies are] using agentic AI," she explained. Agentic AI refers to systems capable of taking autonomous actions to achieve goals, expanding the range of decisions AI can make without direct human oversight.

Courts are increasingly applying liability to companies that deploy agentic AI in customer-facing or business-facing operations, rather than to the firms that developed the original AI model or tool, Vogel said.

"A lot of this becomes the liability of the person who had the last touch on it, whose data is involved, whose customer is involved. They are often the one who owns the liability," she added.

Despite the governance gap, Vogel noted that consensus is emerging among leading organizations worldwide on AI best practices. "They've all come to this independently, and there is really a lot of consensus on what the best practices are," she said.

"The other thing that's good news is most of this is not rocket science, it's leadership and good governance just applied to AI," Vogel added.

EqualAI's white paper identifies five main areas companies should address when establishing governance for agentic AI. The first is visibility—understanding what AI tools are being used across the organization, since leaders may not fully grasp their firm's AI footprint or the opportunities and risks it presents. The second is accountability, ensuring clear responsibility across leadership levels and corporate divisions.

The third component is operationalizing AI principles. Vogel explained that this means translating principles laid out in documents into practical action, such as establishing protocols for communicating about problems that arise. This process depends on internal trust and a culture of shared accountability within the organization.

The fourth pillar is establishing feedback loops that can be used on a recurring basis as AI tools and models iterate and improve. This helps organizations stay ahead of issues such as model drift and can take the form of a structured plan and cadence for routine testing.

The fifth and final pillar is AI literacy, which Vogel linked to what she described as increasing public distrust of AI. She warned that fears are beginning to overshadow enthusiasm about the technology.

"I think that squarely lands not only on the overall governance infrastructure that's lacking in most organizations, but this fundamental piece of AI governance which is AI literacy," Vogel said. "Most people don't know that they're using AI, they don't want to use AI, don't know how to use it."

"AI literacy is just a key variable in making sure people understand how to use it, that they know how to avoid risks because they don't want to cause harm or bring a liability for themselves or their organization," she continued. "Making sure that your workforce and your consumers understand how you're using AI, how you will not be using AI, and how it can benefit them is a key variable."