UN AI Report: AI Governance Has an Evidence Gap – A CISO’s Perspective

On 1 July 2026, the United Nations Independent International Scientific Panel on Artificial Intelligence released its Preliminary Report, the Panel’s first independent scientific assessment of the opportunities, risks and impacts of AI. One line from Secretary-General António Guterres captures the challenge particularly well.

“The world cannot govern what it cannot understand.”

After nearly thirty years working across cybersecurity, infrastructure, risk, governance and compliance, I read that statement through a very practical lens. It raises a question every CISO, board and executive team deploying AI should be asking: what evidence would we need today to demonstrate that our AI systems are actually operating within the boundaries we believe we have set?

That is where the UN report becomes relevant far beyond international AI policy. It is also where the discussion becomes very familiar to anyone who has spent years working on cybersecurity assurance.

The report

What the UN is actually saying

The Panel was established by the UN General Assembly through Resolution A/RES/79/325, adopted by consensus on 26 August 2025. Its mandate is significant. The General Assembly did not simply ask it to discuss AI. It created a scientific body to produce evidence-based assessments of AI’s opportunities, risks and impacts, guided by independence, scientific credibility and rigour, multidisciplinarity and inclusive participation.

The Panel brings together 40 independent scientists and experts serving in their personal capacity, and its work is intended to give governments a common scientific foundation for discussions on AI governance. The Preliminary Report examines seven broad domains, including AI science and trajectories, societal applications, economic implications, security, human rights, and management, governance and reliability.

One issue stood out to me. The Panel describes an evidence dilemma: policymakers need evidence to make consequential decisions about AI, but because the evidence lags behind the pace of development, by the time it is clear the opportunity to act may already have narrowed.

That is not only a policymaking problem. It is an enterprise security problem as well.

The gap

We have an evidence problem inside organizations too

Most mature organizations have no shortage of governance documentation. We have policies, risk registers, control frameworks, standards, dashboards, architecture diagrams, assessment reports, audit findings, compliance certifications and, increasingly, AI governance frameworks. All of them have value.

But experience has taught me to separate two questions that are often treated as the same. What does the organization say should be happening? And what is actually happening? The distance between those two answers is where risk tends to live, and AI has the potential to make that distance considerably larger.

What the organization says

The documented position.

reviewed on a schedule

AI policy approved
Risk register updated
Framework controls mapped
Assessment passed

Stable between review cycles.

What is actually happening

The operating environment.

changes continuously

Model replaced or updated
New data source connected
Agent granted a new tool
Permissions quietly drift

None of this requires the documents to change.

An AI policy can remain unchanged for a year while the environment it governs changes several times. A model can be updated or replaced. A data source or retrieval system can be connected. An agent can gain access to another application, or a new tool can be exposed through an API or MCP connection. Permissions can change, and the system may move from generating information to taking action.

None of those changes requires the policy document to change. But the risk may have changed considerably. That is why evidence matters.

Evidence

Show me what is actually happening

When I evaluate a security program, I want to see the evidence behind each statement.

• If the AI environment is governed, show me the inventory and how it stays current.
• If an agent cannot access sensitive information, show me the technical enforcement, not the architecture diagram.
• If a risk has been mitigated, show me what changed technically or operationally.
• If there is human oversight, show me where a person actually reviewed, challenged, rejected or stopped an AI decision or action.
• If access follows least privilege, show me the permissions the agent actually holds.
• If a system can invoke external tools, show me which tools, under which identity, with which authorization, and where the results can go.
• If leadership is told residual AI risk is acceptable, show me the evidence behind that conclusion.

That is not an audit mentality. It is an operational one. There is a considerable difference between demonstrating that a control was designed and demonstrating that it is operating.

Evaluation

When a system behaves differently under evaluation

One of the more important issues the Panel raises concerns evaluation itself. It notes that evaluation methods are underdeveloped and that institutions capable of independent capability and risk assessment are still embryonic. It also warns that leading AI systems are increasingly able to recognize testing environments and produce misleading evaluation results that favour their continued operation.

For security professionals, the underlying problem should sound familiar. We have always known that a controlled assessment environment is not the same as production. A penetration test provides valuable information, but it does not prove the environment will still be secure six months later. An audit shows a control operated when it was sampled, not that it operates correctly every day. A certification shows conformity against defined criteria for a period. None of them eliminates risk.

AI adds another layer, because the behavior being evaluated may itself be dynamic. If a system behaves correctly in pre-deployment testing but differently once connected to real users, real data and real tools, the evidence that matters most may not come from the laboratory. It may come from production.

Assurance

Point-in-time assurance will not be enough

Much of cybersecurity still relies on periodic assessment: annual audits, quarterly access reviews, scheduled penetration tests, certification cycles and risk assessments. Those mechanisms will keep their value. But AI may push us toward something much closer to continuous assurance.

After an AI system is approved, its underlying model, system instructions, context, training or retrieval data, integrations, permissions and available tools can all change. Users can also discover entirely new ways of interacting with it. At that point, asking whether the system passed an assessment six months ago becomes far less useful than asking what evidence shows it is operating within acceptable boundaries now.

Point-in-time assurance

• AssessedSystem approved at a single point in time.
• Model updateNo evidence until the next audit.
• New MCP toolNo evidence until the next audit.
• Permissions changeNo evidence until the next audit.
• New data sourceNo evidence until the next audit.
• Next auditMonths after the risk changed.

Continuous assurance produces evidence at each of these changes, as they happen.

Controls have to move closer to the system

Today, much AI governance still sits outside the technology. There is a policy, an approval process, a risk committee and an assessment, and then the system goes into production. Over time, I expect more of that governance to move into the operating environment itself.

Identity will determine what an agent can access. Authorization will determine what it can do. Data controls will determine what it can retrieve, and policy engines will shape which actions are permitted. Telemetry will show what actually happened, and continuous monitoring will flag behavior that drifts from expectations. Evidence will increasingly be generated by the environment rather than assembled by hand before an audit. That doesn’t eliminate governance. It makes governance more technical, and that has real implications for the CISO.

Evidence becomes part of the architecture

Mature environments will produce evidence continuously, rather than only when an auditor, regulator or customer asks. They will be able to answer questions like these at any time:

• Who accessed the model, and which model was used?
• What data was retrieved, and under which identity was the action authorized?
• Which tools did the agent invoke, and what decision did the system make?
• Was a human involved, and did a policy prevent an action?
• Was sensitive information moved, or did the system behave outside its expected parameters?
• Can we reconstruct exactly what happened?

These are not simply logging questions. They are accountability questions.

Ownership

AI governance cannot belong to one function

There is a tendency to ask who owns AI governance: security, privacy, legal, risk, technology, data governance or compliance. In my view, that is the wrong question. Each function owns part of the problem, and each should be able to produce part of the evidence.

AI governance has to connect these disciplines rather than create another isolated function beside them. The evidence has to connect them as well.

Frameworks

Frameworks help, but frameworks are not evidence

Organizations now have increasingly mature structures to work with. The EU AI Act provides a regulatory framework, the NIST AI Risk Management Framework offers a structured approach to identifying and managing AI risk, and ISO/IEC 42001 defines an AI management system. These are useful developments.

The UN Panel makes a pointed observation here. It notes that dozens of governance instruments are already in use across jurisdictions, but they are fragmented and rarely measure real-world effectiveness. That matches what I see inside organizations.

A framework can tell you that access should be controlled. It cannot prove that your agent cannot retrieve the customer database. It can tell you to maintain human oversight, but not whether employees are meaningfully challenging AI recommendations rather than accepting them. It can require monitoring, but it cannot guarantee that anyone is looking at the results. That evidence has to come from the organization.

Leadership

The board conversation has to change

Boards don’t need to understand every model architecture, benchmark or technical control. But they do need to understand uncertainty. One of the most dangerous things a security organization can say is “we are compliant, therefore we are safe.” I would be just as uncomfortable hearing “we assessed the AI, therefore it is safe.”

Autonomy

From information to action

The first generation of enterprise generative AI mostly answered questions. The next generation will increasingly perform tasks. The risk profile of a system that summarizes a document is very different from that of an agent that can retrieve the document, combine it with customer information, reach another system, make a recommendation and initiate an action.

The Panel is direct about this. It states that there are no scientific guarantees that AI agents will not violate their instructions, and that evidence of agents doing so is accumulating. The more authority we give these systems, the stronger our evidence requirements should become.

If a human administrator performs a privileged action, we expect attribution. If an AI agent performs the same action, we should not accept a lower standard simply because the actor is software. We should know which agent acted, under whose authority, using which permissions, against which information, and what happened as a result.

We cannot govern what we cannot understand. And we cannot demonstrate control over what we cannot observe.

Interactive

Could you produce the evidence tomorrow?

Before an organization tells me its AI environment is governed, these are the questions I would ask. Answer honestly for your own organization. “Yes” means you could produce evidence, not just a policy.

Action

Where to start this quarter

1. Build an AI inventory that updates itselfTie it to procurement, change management and identity provisioning so new models, tools and integrations appear when they are introduced, not when someone remembers to add them.
2. Turn one AI policy into operating evidencePick your highest-risk AI system. For each control that applies to it, identify the artifact that proves it is working in production. Where no artifact exists, you have found your real gap.
3. Rewrite your board AI risk report around certaintySeparate what you know, what you have tested, what you are monitoring and where the evidence is weak. Then ask leadership to accept the residual risk explicitly.

The UN Panel is addressing a global governance problem, but its evidence challenge translates directly into the enterprise. AI governance cannot stop at principles, policies and frameworks. It has to reach the environment itself. The controls have to operate, the behavior has to be observable, the evidence has to be credible, and leadership has to understand where certainty ends.

The Preliminary Report is only the beginning of the Panel’s work. It will continue to build its evidence base through consultations and thematic briefs, and its next annual report is due to inform the second Global Dialogue on AI Governance in New York in May 2027. That ongoing process is appropriate, because the technology will not stand still. Neither can assurance.

A well-written control describes intent. Evidence tells you whether that intent survived contact with the real environment. AI does not change that principle. It changes how quickly we may discover we were wrong.

FAQ

Common questions

What is the UN Independent International Scientific Panel on AI?

It is a scientific body established by UN General Assembly Resolution A/RES/79/325 in August 2025. Its 40 members serve in their personal capacity and produce evidence-based assessments of the opportunities, risks and impacts of AI, which are presented at the UN Global Dialogue on AI Governance. Its Preliminary Report was released on 1 July 2026.

What is the evidence dilemma described in the UN report?

Policymakers need evidence to make consequential decisions about AI, but evidence lags behind the pace of AI development. By the time the evidence is clear, the opportunity to act effectively may already have narrowed.

Why does a UN report on global AI governance matter to enterprises?

The same gap exists inside organizations. Governance documents describe what should be happening, while AI systems keep changing through model updates, new data sources, new tools and shifting permissions. Without operating evidence, leadership cannot know whether AI is working within the boundaries they approved.

Is passing an AI assessment enough to show a system is safe?

No. An assessment describes the system at the time it was assessed. The UN Panel also warns that leading AI systems can increasingly recognize testing environments and produce misleading results. Evidence from production, gathered continuously, matters as much as pre-deployment testing.

Do frameworks like ISO/IEC 42001 or the NIST AI RMF prove AI controls work?

No. Frameworks provide structure and tell you what good looks like, but they cannot prove that your own controls are operating. That evidence has to come from your environment: enforced permissions, monitoring that someone reviews, and records of real human oversight.

Who should own AI governance in an organization?

No single function. Security, privacy, legal, data governance, technology and risk each own part of the problem, and the board decides how much risk to accept. Effective AI governance connects those functions and the evidence each one can produce.

This is an independent perspective on publicly available United Nations material as of 17 September 2026, not an official UN position. The Panel’s findings will be updated through thematic briefs and future annual reports.