--- title: "71% of large companies run AI projects. Only 9% govern them" url: https://zerofive.ai/en/blog/insights/71-percent-ai-projects-9-percent-governance canonical: https://zerofive.ai/en/blog/insights/71-percent-ai-projects-9-percent-governance language: en published: 2026-02-12 updated: 2026-09-18 author: "ZeroFive.AI" tags: AI governance, AI adoption Italy, Artificial Intelligence Observatory, AI Act companies, enterprise AI maturity abstract: "Data from Politecnico di Milano's AI Observatory: 71% of large Italian companies run AI projects, only 9% have structured governance. What the gap means." --- # 71% of large companies run AI projects. Only 9% govern them The figures presented last week by the Artificial Intelligence Observatory of Politecnico di Milano (2025 research, February 2026) tell two stories at once, and they are worth reading together. The first is a story of speed: the Italian AI market reached 1.8 billion euros, up 50% in a year, 71% of large companies have started at least one AI project, 84% hold active Generative AI licences. The second is a story of emptiness: only 9% of large companies have structured AI management, and just 15% have launched organic EU AI Act compliance programmes. Sixty-two percentage points separate those who do from those who govern what they do. At the tables where we work this gap has a precise face, and it is that of the CFO or the risk manager discovering in a committee meeting how many AI systems actually run inside the company, and for how long, without anyone ever having taken inventory. ## What that 71% actually contains The adoption figure, taken alone, says less than it seems to. The same research specifies that only one company in five uses AI pervasively across multiple functions: for the majority, "having projects" means localised experiments, distributed licences, individual use cases started from below. Adoption is wide and thin, like a coat of paint. Then there is the number that should keep security and compliance leaders awake: eight workers out of ten use AI tools their company never sanctioned (same source). Documents uploaded to consumer services, customer data inside prompts, unverified outputs flowing back into processes. Shadow AI appears in no official inventory, and yet it is, in all likelihood, the largest AI perimeter of most Italian organisations right now. Lined up, the picture is that of an adoption that happened anyway, with or without the organisation's permission, while the capacity to govern it stayed at the starting line. ## Why governance always comes later (and why the sequence is wrong) The charitable explanation for the 9% is that governance physiologically follows innovation: first you experiment, then you regulate. The explanation holds for low-impact technologies, and AI is not one, for two reasons the numbers themselves suggest. The first is that AI touches decisions, not just processes. A system that screens candidates, evaluates credit files or suggests clinical priorities produces effects on people, and the European legislator has already codified this: the EU AI Act has been in force since August 2024, the bans on unacceptable-risk practices and the AI literacy obligation have applied since February 2025, and the calendar of upcoming application deadlines is public. Companies sitting today in the 91% without structured governance are not postponing a future obligation, they are accumulating a backlog on duties that are partly already in force. The second reason is economic. The Observatory's research records a 93% increase in AI skills requested in job postings and 41% of workers performing, thanks to AI, activities that were previously out of reach: the value is there, and this is exactly what makes disorder expensive. Without prioritisation criteria, every function buys its own tool, data stays in silos, pilots multiply without ever consolidating, and spending grows faster than returns. Governance, seen from here, has little to do with the brake many imagine: it is the mechanism that decides where to concentrate capital that would otherwise disperse. ## Joining the 9%, with method The good news is that moving from the 91% to the 9% is a known journey, and it does not start with an ethics committee or a statement of principles. It starts with a measurement. In our assessments (34+ projects delivered, ZeroFive.AI data, 2026) the sequence that works has three stages, and the first is an honest census: which AI systems exist in the company, shadow ones included, who uses them, on which data, with which risk classification under the AI Act. This is the AI systems register, and it is at once the first sensible obligation and the first management tool. The second stage is the maturity rating: measuring on an objective scale the organisation's capacity across preparation, execution, risk and adoption, to know which gaps are blocking everything else. The third is the roadmap with assigned responsibilities, 30-day quick wins and a re-assessment after twelve months, because an isolated snapshot ages quickly and the value lies in comparing two measurements. Our AI Rating covers exactly these three stages in four to six weeks. Companies that have done it report a precious side effect: for the first time board, IT and risk look at the same number, and the AI conversation stops being a collection of anecdotes. The Observatory's data will be updated in a year, and the easy prediction is that the 71% will climb further. The open question concerns the other number: if the 9% stays where it is, the gap will stop being an industry statistic and start deciding, company by company, who turned spending into advantage and who merely joined the race. If you want to know which side of the gap you are on, half an hour at calendly.com/fabiolalli/zerofive is enough to find out, or write to hello@zerofive.ai.