Why Portfolio-Wide AI Governance Statistics Are Hard to Find
Private equity firms overseeing a dozen or more portfolio companies often ask for a single adoption number: what percentage of our holdings have formal AI governance in place. That number is difficult to produce reliably, and any figure presented without a clear survey methodology and disclosed sample should be treated with skepticism. Portfolio companies run different cloud providers, different LLM vendors, and different identity systems, so a governance claim from one company rarely translates cleanly to another. A company that reports having an "AI policy" may mean a one-page acceptable use document, while another may mean logged, enforced runtime controls on every agent action. Until a firm defines governance in consistent, measurable terms across its portfolio, any aggregate statistic it produces internally will reflect inconsistent definitions rather than actual risk exposure.
Common Governance Gaps Reported Across Portfolio Companies
- Policy without enforcement: A written AI use policy exists, but no technical control verifies that agents actually operate within it.
- Fragmented logging: Agent activity is logged inconsistently or not at all across different tools and orchestration layers.
- Unscoped agent permissions: Agents are granted broad access to systems and data rather than least-privilege, task-specific permissions.
- No centralized audit trail: Even where logging exists, it is siloed per tool or per company, preventing portfolio-wide review.
- Inconsistent human-in-the-loop review: Approval requirements for sensitive agent actions vary by team or company rather than following a defined threshold.
Design-Time Policy Versus Runtime Enforcement
A useful distinction for any benchmarking effort is the difference between design-time policy and runtime enforcement. Design-time policy is the written rule set: who can deploy an agent, what data it can touch, what actions require approval. Runtime enforcement is the technical mechanism that intercepts and checks agent actions against that policy as they happen, rather than relying on the agent or its developers to comply voluntarily. A portfolio company can score well on design-time policy documentation while having no runtime enforcement at all, which means the policy has no practical effect on agent behavior. When operating partners assess governance maturity, these two layers should be scored separately. A single combined score can mask the difference between a company that has thought about AI risk and one that has actually controlled it.
Building a Repeatable Benchmarking Cadence
A one-time governance assessment produces a snapshot that ages quickly, since AI adoption inside portfolio companies tends to move faster than internal policy updates. A more durable approach treats governance assessment as a recurring exercise, ideally quarterly, using the same rubric each cycle so results are comparable over time. Sequencing matters as much as frequency. Firms with limited operating partner bandwidth generally get more value from assessing the highest AI-exposure companies first (those with the most agent deployments or the most sensitive data access) rather than attempting a simultaneous portfolio-wide rollout. This also allows a minimum viable governance baseline, defined controls every portfolio company must meet post-acquisition, to be separated from aspirational maturity targets that can be phased in over subsequent quarters.
Where Standardized Controls Reduce Aggregation Risk
The practical reason governance statistics matter to operating partners is risk aggregation: understanding total AI exposure across the fund, not just within one company. That aggregation only works if the underlying data is collected consistently. A centralized runtime governance layer that enforces policy, manages agent identity and permissions, and produces a unified audit log across portfolio companies makes it possible to roll up exposure data without requiring every company to standardize its underlying technology stack. This is a structural point rather than an endorsement of any specific adoption number, since no verified figures on cross-portfolio deployment of such controls exist yet in public research. Firms evaluating this approach should still confirm coverage of agent-to-agent interactions and tool approval workflows, not just single-agent policy enforcement, since multi-agent systems introduce additional identity and permission surface area.