Retool Surveyed 307 CTOs, CIOs, and CISOs. 93% Worry About Vibe-Coded Tools in Production. Only 8% Call Their Governance Strong.

November 2, 2026 · Josh Agusti, Founder, Aiven Consulting Group

AI governance used to mean policies for a handful of approved tools. In 2026, it means keeping track of however many internal applications employees have built themselves with AI coding assistants, often without IT ever approving the project. Retool's 2026 AI Governance Report, based on a survey of 307 CTOs, CIOs, and CISOs conducted with Wynter in May 2026, captures just how far ahead of oversight that building has gotten.

The Speed of Building Has Outrun the Speed of Oversight

Ninety percent of the leaders Retool surveyed say business pressure to let employees build their own AI-powered tools has increased over the past year. At the same time, 93% say they are concerned about AI-generated, or vibe-coded, tools running in production, and 38% call it one of their top operational risks. Those two numbers sitting next to each other are the real finding: leaders are not naive about the risk, they are simply being asked to move faster than their controls can follow.

That tension is exactly where a structured AI readiness assessment earns its keep, since it gives leadership a clear picture of what is actually being built and by whom before the next wave of internal tools ships without review.

Governance That Can't See What's Running

Only 8% of respondents describe their organization's governance over internal AI-built tools as strong. Forty percent call it functional but manual, 37% call it uneven, and 10% say it is purely reactive, responding to problems after they surface rather than catching them beforehand. Visibility is the deeper issue underneath that number: just 5% of leaders say they are very confident they have full visibility into what AI-generated tools are actually running in production. Twenty-two percent have already confirmed at least one production incident caused by one of those tools in the past year.

Leaders who are furthest along tend not to be writing governance policy from scratch while the backlog of AI-built tools keeps growing. Many instead adapt existing governance templates into something scoped specifically to AI-generated applications, so the policy exists before the next tool ships rather than after an incident forces the issue.

The pattern across this year's governance research, Retool's included, keeps landing in the same place: the risk was never that employees would build their own tools with AI. It was that governance would stay designed for a world where IT reviewed everything before it shipped. Closing that gap usually means rethinking the AI operating model itself, not just adding another policy document to a stack nobody has time to read.

Key Takeaways

Retool's 2026 AI Governance Report, based on a survey of 307 CTOs, CIOs, and CISOs conducted with Wynter in May 2026, found that only 8% of leaders describe their internal AI tool governance as strong, while 37% call it uneven and 10% call it reactive.
93% of leaders are concerned about AI-generated, or vibe-coded, tools running in production, and 22% have already confirmed at least one production incident caused by one in the past year.
Only 5% of leaders are very confident they have full visibility into what AI-built internal tools are actually running in production, even as 90% say business pressure to keep building them has increased over the past year.