Compliance teams aren't resisting AI, they're out of time
Your CISO reports steady AI usage across the company. Your compliance lead says the team can barely keep up reviewing outputs, let alone testing new tools properly. Your board asks the question you can't fully answer yet: what is change management in cyber security when the people managing risk are the ones falling behind?
That gap isn't hypothetical. In a 2026 Kiteworks survey of 459 security, compliance and technology professionals across North America, Europe and the Middle East, a majority reported at least one compliance consequence tied to a gap in their organization's AI governance in the past year. These are self-reported perceptions from a vendor-commissioned study, not verified incidents, but they describe real pressure CIOs are feeling right now.
The instinct is to treat this like any other rollout: train people, publish a policy, watch adoption numbers climb. That gets you compliance on paper, not readiness in the functions that carry the most risk if AI goes wrong. Security, risk and compliance teams need change management built around what they actually report struggling with, not a copy of the plan you used for sales.
Sources: AI Governance Gap Widening: Kiteworks Survey
What is change management in cyber security for AI rollouts
In plain terms, that's what is change management in cyber security: the deliberate process of introducing new tools, workflows or policies into security-sensitive functions without breaking the controls that keep data, systems and compliance obligations intact. For AI, that means adoption moves at the pace your governance can absorb, not the pace a vendor demo suggests.
You don't need to invent that governance from scratch. The National Institute of Standards and Technology's AI Risk Management Framework, current as of 2026, is intended for voluntary, cross-sector use to help organizations build trustworthiness considerations into how they design, develop, use and evaluate AI systems.
Treat it as shared vocabulary, not a checklist to finish once. Use its core categories as the spine of your own change plan, so security, legal and compliance are arguing from the same terms when they debate what "AI-ready" actually means for their function.
Sources: AI Risk Management Framework | NIST
Where compliance and risk say AI actually breaks down
Ask a compliance or legal decision-maker why their team hasn't adopted more AI, and the answer is rarely "we don't trust it."
In a survey of 300 US compliance and legal decision-makers at organizations with over 10,000 employees, run by Atomik Research for EY and reported by Corporate Compliance Insights in late 2025, 47% cited lack of time as their primary barrier to adopting advanced technology.
Gary Burke, EY's global leader of integrity and compliance, commented on that finding.
“Compliance teams increasingly recognize technology as a key enabler”
— Gary Burke, Global leader of EY's integrity and compliance practice · Source: Almost Half of Compliance Leaders Cite Time Crunch as Barrier to Tech Adoption | Corporate Compliance Insights
That reads as a capacity problem, not a culture problem. These leaders reported recognizing the value of the technology; what's missing is dedicated hours to test, review and sign off on it inside an already full workload.
Once compliance and risk professionals do use AI, their worries shift toward the technology itself. Among 265 senior compliance, legal and risk professionals surveyed globally by law firm White & Case, data protection ranked as the top concern at 64%, ahead of worries about output accuracy. Treat this as a vendor-published finding from a firm with a commercial interest in compliance advisory work, not an independent audit.
Sources: Almost Half of Compliance Leaders Cite Time Crunch as Barrier to Tech Adoption | Corporate Compliance Insights, Artificial intelligence in the compliance function | White & Case LLP
The workforce worries about privacy, compliance worries about time
Compare that against the general workforce, and the barriers don't line up. In Gallup's February 2026 survey of 23,717 US employees, the most common reasons for not using AI at all were concerns about data privacy, security and compliance, cited by 43% of non-users and 38% of infrequent users, followed by ethical objections and doubts about usefulness.
Notice what's missing: time. The general workforce is more likely to say AI feels unsafe or pointless; compliance and legal leaders are more likely to say they simply can't get to it. These come from different surveys, samples and periods, so read the contrast as directional rather than one controlled study.
| Population | Top reported barrier | Source |
|---|---|---|
| General US workforce (Gallup, Feb 2026) | Data privacy, security and compliance concerns | Gallup |
| Compliance/legal decision-makers, large US enterprises | Lack of time | EY via Corporate Compliance Insights |
| Global compliance/legal/risk professionals | Data protection | White & Case |
The practical implication: a company-wide push built around trust-building and usefulness demos may do very little for a compliance team whose real blocker is calendar space, not conviction.
Sources: AI in the Workplace: What Separates Adopters and Holdouts, Almost Half of Compliance Leaders Cite Time Crunch as Barrier to Tech Adoption | Corporate Compliance Insights, Artificial intelligence in the compliance function | White & Case LLP
Shadow AI is the containment gap nobody tested
Policy gaps show up as behavior. In a BlackFog-commissioned survey of 2,000 workers at companies with 500 or more employees, reported by CIO.com in January 2026, a large share of employees admitted to adopting AI tools without employer approval.
BlackFog's founder and CEO Darren Williams commented on the finding.
“The efficiency gains and personnel cost savings are too large to ignore, and override any security concerns”
— Darren Williams, BlackFog founder and CEO · Source: Roughly half of employees are using unsanctioned AI tools, and enterprise leaders are major culprits | CIO
For a security team, the real risk isn't that employees use AI. It's that nobody has verified whether access to an unsanctioned tool can be revoked on demand once it's discovered. Test that containment control before you scale sanctioned AI use into anything security-sensitive.
Build your rollout around the barrier you actually have
Start by measuring, not guessing. Run AI Adoption Score's AI Adoption Barriers Survey against your security, risk and compliance staff specifically, instead of reading their adoption story off an organization-wide dashboard; their concerns about data handling, tool approval and governance clarity look nothing like a sales team's.
Keep intent and implementation separate. A team that says "AI is part of our compliance strategy" hasn't necessarily deployed anything; track stated intent and actual usage as two different milestones so a strategy slide doesn't get mistaken for a rollout.
Close the containment gap first, then decide where training deserves the compliance team's scarce hours. This is what is change management in cyber security about in practice: sequencing fixes so the team most exposed to risk isn't the last one ready.
Frequently asked questions
Who should own AI change management for security and compliance teams?
There's no single right owner, but the CIO or CTO usually needs to co-lead it with compliance and security leadership rather than delegating it entirely to L&D. The barriers these teams report, like limited review time and governance clarity, are operational, not just training gaps.
How often should we re-survey compliance staff on AI barriers?
A reasonable cadence is quarterly during an active rollout, then twice a year once usage stabilizes. Barriers like time pressure shift as staffing and workload change, so a one-time survey at project kickoff will go stale quickly.
Does the NIST AI Risk Management Framework replace our own AI policy?
No. It's a voluntary reference point for building trustworthiness considerations into AI design, development, use and evaluation, not a ready-made policy. Use it as shared vocabulary across security, legal and compliance, then write your own controls on top of it.
Is shadow AI use a sign our policy failed?
Not necessarily, but it is a sign your visibility is incomplete. Employees reported adopting AI tools without approval in a 2026 BlackFog-commissioned survey, which suggests policy alone doesn't stop informal use; pair any policy with monitoring and a tested revocation process.
Sources: AI Risk Management Framework | NIST, Roughly half of employees are using unsanctioned AI tools, and enterprise leaders are major culprits | CIO
