The faster an aircraft moves, the more important its control systems become. Speed creates possibility, but it also compresses reaction time, magnifies mistakes, and raises the consequences when something goes wrong. Procurement AI has taken flight and is accelerating.
For the past year, CPOs have focused on AI capabilities and features and also, where to start. Those are the right questions, but they are just part of the larger considerations. As AI moves from prompt responses to initiating tasks, making recommendations, and eventually taking action on behalf of the procurement team, the governance surrounding AI activities must become part of the operating model itself.
The research in Ardent Partners’ The Path to AI-First Procurement shows just how quickly that issue is approaching.
- Only 19% of CPOs identified AI governance and compliance as a priority in 2026,
- 61% expect agentic AI to operate across multiple procurement processes within the next two years
- At the same time, 34% of procurement organizations report having no formal AI governance mechanism
- Another 42% rely primarily on governance that is centralized somewhere outside the procurement function
Governance Has Not Kept Pace With Plans
Centralized AI governance is both important and necessary and procurement teams should operate within the corporate policies for AI, cybersecurity, data privacy, model usage, compliance, and enterprise risk. But those policies are not designed to support every AI use within a procurement department.
For example, an enterprise AI policy will define which AI tools are approved for use, but it’s unlikely to set a policy around sourcing agent negotiation rules — can it autonomously accept a supplier’s payment term proposal? AN enterprise AI policy may establish rules around confidential data, but it’s unlike to define how an agent can access and use contract history, supplier risk information, performance data, or prior negotiation outcomes before making a recommendation. Those decisions belong with the CPO.
This is where the current state of governance becomes more concerning. Only 32% of organizations in Ardent’s research have formal AI-usage monitoring in place, while roughly the same percentage report human-in-the-loop approval controls. Thirty percent have established data quality and ownership standards for AI, and just 28% have implemented role-based access controls.
AI governance should not be viewed as obscure technical safeguards, they are the foundation for broad-based AI usage. And it is critical to establish it now, before AI activity scales and the gaps expose your teams and companies to major AI risk.
Five Questions Every CPO Needs to Answer
Procurement AI governance starts with five very practical questions.
- What can AI access and use? Which systems and data sources should it be able to access? Who determines what information is authoritative when records conflict? Where should permissions narrow because the data is sensitive or the business context demands it?
- What can AI recommend? CPOs need to understand what evidence supports AI recommendations and how logical that reasoning is? When, how, and by whom are recommendations validated.
- What can AI decide? Procurement organizations already use approval thresholds, delegation of authority, and policy rules to distinguish routine decisions from those that require more scrutiny. AI should operate within equally explicit boundaries.
- What can AI execute? An agent that can create a sourcing event, modify a PO, communicate with a supplier, resolve an invoice exception, or trigger another system is no longer simply aiding a procurement pro. It is participating directly in the process, and the controls surrounding those actions need to be as clear as they would be for any other actor in the workflow.
- When must AI escalate? Every autonomous system needs defined stopping points. Ambiguity, conflicting data, unusual transaction values, policy exceptions, low-confidence outputs, sensitive suppliers, or events outside established parameters should trigger an escalation, at least for now.
Human-in-the-Loop Is Too Vague
Human oversight remains essential, but CPOs need to define exactly what it means. Only 4% favor total autonomy, which tells me that CPOs are not rushing toward some fully autonomous end state. The more realistic model is graduated autonomy, where different activities have different levels of independence based on risk, complexity, confidence, and the consequences of mistakes.
But governance should evolve over time based upon performance. One process that requires approval today may gain more autonomy after months of consistent, auditable results. Another may remain heavily managed because the downside of a bad decision is too high.
Governance Is Becoming Part of Procurement Design
For years, procurement governance focused primarily on talent, policies, and systems. AI introduces another consideration. This means CPOs need to think about AI governance with the same seriousness they apply to other key areas like approval authority and segregation of duties. The objective is to define clear decision rights, access boundaries, accountability, traceability, and escalation paths before autonomy begins expanding across the function.
Today’s decisions will shape how quickly procurement can expand their AI footprint. With the right governance foundation, AI risk is mitigated (not eliminated) and more AI value can be generated.
This article is the third in a six-part series based on the Ardent Partners report The Path to AI-First Procurement: Closing the Gap Between AI Ambition and Execution, one of the most comprehensive studies conducted to date on how AI is reshaping procurement. The full report, produced by Ardent Partners in partnership with Ivalua, is available from Ivalua.
In Part Four: As AI begins absorbing more of the tactical work that has defined procurement for decades, what happens to the people, roles, and operating model around it?
