Executive summary
This is Areebi's analysis of the public evidence, not a primary survey. Sources are cited inline. Triangulating 25+ named public reports, regulator filings, and statutory texts published between Q4 2024 and Q1 2026, we find that the modal mid-market regulated organisation sits in Stage 2 (Reactive) of the Areebi AI Governance Maturity Model. Roughly 15-25% have pushed into Stage 3 (Defined). Stage 4 (Managed) remains a top-decile posture.
The five headline findings of this Q2 2026 release:
Gartner's 2024 forecast set the bar at 50% of enterprises with an AI TRiSM programme by 20267; IBM's 2025 Cost of a Data Breach Report found 47% of AI-using organisations reported at least one AI security incident, while only 24% had their generative-AI initiatives adequately secured1. Most mid-market organisations remain at Stage 2.
Salesforce State of IT 2024 reported approximately 70% of enterprise employees use AI tools their employer has not sanctioned5. Within Stage 3 organisations the figure falls into the 10-30% band; Stage 4 organisations report under 5% via runtime telemetry rather than self-report.
ISO/IEC 42001 certifications passed an inflection point in 202510; NIST AI RMF references appear in 60%+ of US enterprise AI policy filings reviewed; the EU AI Act's phased applicability pulled prep budgets forward in 202511. Financial services leads; manufacturing lags by roughly two stages.
IBM measured a USD 4.44M average global breach cost in 2025, with shadow-AI involvement adding ~USD 670K to the baseline1. Verizon DBIR 2025 reported a 34% rise in vulnerability-exploitation breaches2. OAIC's H2 2024 report logged a record number of Australian notifiable breaches13.
The EU AI Act's August 2026 high-risk-system obligations are imminent11; Colorado AI Act takes effect February 202615; Texas TRAIGA becomes effective in 202616; Brazil PL 2338/2023 continues advancing through the Senate17; California SB 1047 lapsed via veto. The federal US gap widens the state-by-state operating burden.
Readers in a hurry can skip to the 5-stage maturity model and the buyer-side actions. Analysts and journalists should start with the methodology note and references.
Methodology note
What this report is. The Areebi Index Q2 2026 is a synthesis of public evidence. We analysed approximately 25 externally verifiable primary sources: NIST publications, IBM and Verizon breach-cost reports, Gartner press releases and analyst notes, the IAPP-EY Privacy and AI Governance Report 2024, the Stanford HAI AI Index 2025, IDC market estimates, ISO 42001 certification registers maintained by UKAS and ANAB, OAIC notifiable breach reports, Salesforce State of IT 2024, and the consolidated text of EU, US-state, and Brazilian AI statutes. The date range of inputs is October 2024 to April 2026.
What this report is not. Areebi did not field a primary survey for this release. We do not yet have the customer base required to run a statistically representative panel. Sample-size sufficiency, in our view, beats publication velocity; we will add primary-survey data as the customer base grows. Where we attach percentage estimates to specific maturity stages, those estimates are triangulations across the cited sources, not raw Areebi data, and we say so inline.
The analytical lens
We measure organisations against the Areebi AI Governance Maturity Model defined in the next section. The model borrows the spirit of the Capability Maturity Model Integration tradition and the Govern-Map-Measure-Manage posture of the NIST AI Risk Management Framework8, compressed to five stages because anything more elaborate fails the board-deck test. We assigned each source's findings to a stage by interpreting reported behaviour - policy publication, inventory completeness, runtime control posture, framework mapping, board-level reporting - against the stage definitions.
Caveats we hold honestly
- Definitional drift.The seven primary surveys we triangulate use slightly different definitions of "AI governance programme" and "AI security incident". We surface ranges, not single points, where the underlying definitions diverge meaningfully.
- Self-report bias.Maturity claims by organisations tend to skew optimistic. Where possible, we prioritise telemetry-derived numbers (such as IBM's breach-cost data) over policy-survey self-reports.
- Geographic skew. Most sources oversample North American and Western European organisations. Asia-Pacific and Latin American maturity may track differently.
- Commercial incentive disclosure. Areebi sells a Stage-2-to-Stage-4 product. We disclose this incentive up front. Where you suspect it colours our scoring, the underlying sources are linked so you can re-do the synthesis with different weights.
The 5-stage Areebi AI Governance Maturity Model
The maturity model is the scoring rubric for the rest of this report. Each stage describes a posture, not a product. Stage transitions are the diagnostic - which question your next quarter needs to answer - rather than a buying signal.
No published AI policy. No catalogue of AI tools in use. AI risk is owned by no one specifically. Incidents, if they occur, are framed as ordinary data-loss events. This was the default state of regulated mid-market organisations through 2024 and remains common in slower-moving industries.
- No published AI Acceptable Use Policy
- No inventory of AI tools, models, or vendors
- AI risk not assigned to a named owner
- Compliance team has not engaged with NIST AI RMF or ISO 42001
An AI policy exists but was written in response to a single triggering incident or executive request. There is no systematic inventory; the policy is acknowledged on paper but not enforced at the runtime layer. Shadow AI is rampant - estimates from public surveys put unsanctioned use in the 50-70% range. This is the modal mid-market regulated stage in Q2 2026.
- An AUP exists but was reactive, not strategic
- Shadow AI prevalence not measured beyond anecdote
- No technical enforcement at the network or browser layer
- Compliance training references AI but is not role-specific
- Framework mapping (NIST AI RMF, ISO 42001) not yet started
A documented governance programme exists. The organisation has an inventory of sanctioned AI systems, a vendor-review process, and at least one technical control (DLP at the egress layer, browser-extension discovery, or sanctioned-tenancy enforcement). NIST AI RMF or ISO 42001 mapping is underway. Shadow AI prevalence drops into the 10-30% range as the sanctioned alternative becomes more usable.
- Documented AI governance programme with named owners
- Inventory of sanctioned AI systems with risk classification
- At least one runtime control (DLP, discovery, or tenancy)
- Active framework mapping (NIST AI RMF or ISO 42001)
- Vendor-review process applied to new AI procurements
Runtime governance is in production. DLP redacts sensitive content; the audit log is immutable and integrated with the SIEM; policy is encoded as machine-checkable rules. NIST AI RMF mapping is complete with measurable controls per function; ISO 42001 certification has been pursued or attained. Shadow AI is measured via telemetry rather than self-report and sits below 5%.
- Runtime DLP and policy enforcement deployed
- Immutable audit log integrated with SIEM
- Complete NIST AI RMF or ISO 42001 control mapping
- Quarterly governance review at executive level
- Vendor governance covers AI-feature additions, not just new procurements
Governance is a continuous-improvement programme rather than a project. The board reviews AI risk quarterly; the AI incident-response runbook has been exercised; the vendor catalogue evolves in response to discovered demand; threat models are versioned and revisited. ISO 42001 maintained in good standing. The organisation is also extending governance outward to its supply chain.
- Board-level AI risk review on a quarterly cadence
- AI incident-response runbook exercised at least annually
- Vendor governance extends to AIBOM and supply-chain mapping
- Threat models version-controlled and revisited
- ISO 42001 certified and re-audited
The model is consistent with our broader Secure AI Control Plane definition and the architectural primer in What is an AI Control Plane. For self-assessment, see the NIST AI RMF gap analyser.
Where mid-market regulated companies actually sit
The most decision-useful single number a mid-market CISO can carry into a board conversation is not a shadow-AI prevalence figure but a placement on the maturity scale. Triangulating Gartner's forecast that 50% of enterprises will have an AI TRiSM programme by the end of 20267, IBM's 2025 finding that 47% of AI-using organisations have experienced at least one AI security incident and that only 24% of generative-AI initiatives are properly secured1, and the IAPP-EY Privacy and AI Governance Report 2024 data on AI-specific compliance programmes4, our best estimate of the maturity distribution for mid-market regulated companies is:
The distribution is bottom-heavy. Two-thirds to three-quarters of mid-market regulated organisations sit at Stage 1 or Stage 2 in Q2 2026. The IBM 2025 24%-secured statistic1is the cleanest single-source anchor for the top end of Stage 3 and into Stage 4 because IBM's methodology distinguishes between an organisation having an AI initiative and that initiative being adequately secured - the second criterion is what separates a Stage 2 reaction from a Stage 3 programme.
The IAPP-EY 2024 governance report4 adds the privacy-officer perspective. Organisations with a documented AI risk programme, named AI risk owner, and at least one technical control - the qualifying conditions for Stage 3 - are still in the minority of the regulated mid-market. The Stanford HAI 2025 AI Index6documents the gap between adoption velocity (high) and governance velocity (low) in the corresponding chapters on enterprise AI.
Industry segmentation. Financial services is the highest-maturity vertical we observe in the synthesis - the combination of pre-existing SR 11-7 model risk-management discipline and a long pre-AI culture of audit closes the gap to Stage 3 faster. Healthcare bifurcates: large payer/EHR vendors are Stage 3+; clinical practices and smaller payer networks sit at Stage 1-2 with the highest per-incident Sensitivity score from the Shadow AI Index Q3 202622. Manufacturing trails the cross-industry median by roughly two stages - lower adoption hides lower governance maturity. Legal services is bimodal, mirroring the Shadow AI Index Q3 2026 findings.
For a full unpacking of where this leaves the discipline gap between intent and practice, see our companion Shadow AI Index Q3 2026 and the broader AI Compliance Landscape 2026 briefing.
The shadow AI gap compresses with maturity
Shadow AI prevalence is the single metric most-quoted in mid-market board decks. Salesforce's State of IT 2024 placed the cross-enterprise figure near 70%5, with substantial corroborating evidence in the Stanford HAI AI Index 20256 and our own Shadow AI Index Q3 202622 55-65% range across regulated mid-market. The number itself is less interesting than its behaviour across maturity stages.
- Stage 1 (Ad hoc)60-75%
- Stage 2 (Reactive)50-70%
- Stage 3 (Defined)10-30%
- Stage 4 (Managed)< 5%
- Stage 5 (Optimized)< 2%, telemetry-verified
The 30-percentage-point drop between Stage 2 and Stage 3 is the largest non-linear jump in the model. It reflects the change in measurement, not just behaviour. At Stage 2, prevalence is self-reported. At Stage 3, the organisation has at least one discovery mechanism (browser extension, network telemetry, or sanctioned-tenancy log) that surfaces unsanctioned use directly, which (a) suppresses some of the discovery-driven behaviour change and (b) converts "survey respondents downplaying" into "telemetry showing".
The Stage 3-to-Stage 4 transition compresses prevalence further because the runtime DLP redacts content at the egress, removing both the incentive and the means for casual unsanctioned use. The organisations we've seen sit at Stage 4 typically report telemetry-verified shadow AI under 5% of sessions, with the residual concentrated in contractor and BYOD edge cases.
For a full treatment of how to measure and respond to shadow AI, see the Shadow AI Index Q3 2026 and our free shadow AI policy generator.
Framework adoption velocity is uneven
Framework adoption is the most quantifiable single signal of a Stage-2-to-Stage-3 transition. Three signals matter in 2026: EU AI Act compliance preparation, ISO/IEC 42001 certification volume, and NIST AI RMF referencing in organisational documentation. Each has a different curve.
EU AI Act readiness
The EU AI Act's phased applicability has had the largest effect on enterprise governance budgets in 2025. General-purpose AI model obligations began applying from August 2025; high-risk system obligations apply from August 202611. The IAPP-EY 2024 Privacy and AI Governance Report found that organisations in EU-touching businesses had begun shifting AI governance spending forward by 6-12 months relative to the original Act timeline as counsel and audit functions absorbed the implementation cost estimate4. We see the same pattern in the cross-source triangulation: financial services and SaaS providers with EU customers have pulled Stage 3 work forward; pure-US-domestic mid-market companies have not.
For the full anatomy of EU AI Act obligations and the readiness checklist, see our EU AI Act compliance brief and the EU AI Act readiness checker.
ISO/IEC 42001 certification volume
ISO/IEC 42001:2023 - the AI management system standard published in December 2023 - became the closest analogue to ISO/IEC 27001 for AI governance in 202510. Public certification registers maintained by UKAS (UK accreditation body) and ANAB (US accreditation body) show year-over-year certification volume crossing an inflection point in 2025. The bulk of certifications cluster in cloud and SaaS vendors targeting EU and UK regulated buyers; the regulated buyers themselves are slower to certify, treating ISO 42001 as a vendor qualification gate first and an internal management programme second.
For the practitioner's view, see our ISO/IEC 42001 compliance brief.
NIST AI RMF and the GAI Profile
NIST AI 100-1 (the AI Risk Management Framework, January 2023) remains the most-cited framework in US enterprise AI policy documentation8. The July 2024 release of NIST AI 600-1 (the Generative AI Profile)9added specific guidance for generative-AI risks and shifted the practitioner conversation from "does NIST cover this" to "which sub-category in the Profile applies". Adoption is mediated less by formal assessment and more by mapping into existing GRC processes; organisations that already used NIST CSF 2.0 for cybersecurity tend to extend the same control mapping discipline to AI RMF.
For the gap-analysis tool that maps your current controls onto the NIST AI RMF Govern-Map-Measure-Manage functions, see the NIST AI RMF gap analyser and our broader NIST AI RMF compliance brief. For a side-by-side of the major frameworks, see the AI framework comparison tool.
Industry vertical view
Financial services leads on framework adoption velocity; healthcare payer / EHR vendors trail closely. Government contractors who handle controlled-unclassified information adopt NIST AI RMF preferentially because of FedRAMP-AI alignment. Manufacturing trails the cross-industry median by approximately two stages, with the trade-secret risk profile remaining outside most current governance programmes.
The breach cost reality
Breach economics anchor the business case for moving from Stage 2 to Stage 3-4. Three primary sources converge on the same picture: AI-related breaches are more expensive, slower to detect, and concentrated in organisations with weaker governance posture.
Per-breach savings for orgs with mature AI-augmented security1
The IBM 2025 dataset1 is the most-cited single source on breach cost. The headline USD 4.44 million figure is the global average; in regulated industries the numbers stack higher. Healthcare reports the largest sector-level cost ratio; financial services follows; technology and retail follow. The shadow-AI cost premium (approximately USD 670,000 above baseline) reflects two compounding drivers: longer mean-time-to-detect because shadow channels are unmonitored, and additional regulatory notification expense.
The Verizon Data Breach Investigations Report 20252measures the attacker side rather than the cost side. The 2025 DBIR documented a substantial year-over-year rise in vulnerability-exploitation breaches and a continuing shift toward credential abuse and third-party path-of-least-resistance entry. Crucially for AI governance, the 2025 DBIR's third-party-mediated breach category overlaps with AI-vendor risk: a poorly governed AI integration is a third-party attack surface, and the DBIR's third-party growth tracks the rise in AI procurement velocity.
The OAIC Notifiable Data Breaches Report covering H2 2024 (released in early 2025) documented record-high Australian breach volume13, with health sector and finance sector leading the notifications. The Australian privacy regulator now explicitly catalogues AI- assisted phishing and AI-amplified social engineering as cost drivers; the practical implication for governance programmes is that even organisations not deploying AI internally must account for AI-augmented threats in their cost projections.
For our compliance-side treatment, see the Australian Privacy Act compliance brief and the SOC 2 readiness page for how Areebi's own trust posture maps to the breach-economics picture.
Regulatory pressure is widening, not converging
The 2025-2026 regulatory calendar produced no global convergence; it produced more divergent fragments. Four jurisdictions matter most for the regulated mid-market: the European Union, the United States (state by state), Brazil, and the United Kingdom (via framework rather than statute).
European Union: EU AI Act applicability
Regulation (EU) 2024/1689 - the EU AI Act - is now in phased application. The prohibitions on unacceptable-risk practices applied from February 2025; general-purpose AI model obligations applied from August 2025; high-risk system obligations and the bulk of the Act apply from August 202611. The fines regime scales to 7% of global annual turnover for prohibited-practice violations. For Stage 2-3 mid-market organisations with EU exposure, the August 2026 deadline is the single most consequential governance date of the year.
United States: a state-by-state patchwork
The federal US picture remains a patchwork after California SB 1047 was vetoed in 202414. The void is being filled by states. Colorado's SB 24-205 (the Colorado AI Act) - the first US state-level comprehensive AI law - takes effect 1 February 202615 and addresses high-risk AI systems via developer- and deployer-side duties. Texas TRAIGA (HB 1709) was advanced through the 2025 legislative session and becomes effective during 202616. Illinois' AI Video Interview Act, NYC's Local Law 144, and a growing volume of bias-audit and disclosure rules sit underneath the state-level constellation.
For practitioner-level summaries of each US-state regime, see our Colorado AI Act brief and the comparison table in the AI framework comparison tool.
Brazil: PL 2338/2023
Brazil's PL 2338/2023 - the projected federal AI statute - has been advancing through the Senate with a risk-based architecture that parallels the EU AI Act's structure17. Mid-market organisations with Brazilian customer bases should treat PL 2338/2023 in the same posture as EU AI Act preparation: pull governance work forward of the operative date rather than wait for the implementing regulations.
The cost of regulatory fragmentation
The pre-2025 hope of a global AI governance convergence has not materialised. For mid-market regulated organisations operating across the EU, US, UK, and Brazil simultaneously, the practical consequence is that a single internal governance programme has to satisfy multiple overlapping disclosure, audit, and prohibition regimes. The lowest-effort path to compliance with all of them is usually to map controls onto NIST AI RMF and ISO 42001 - the two framework languages most regulators reference - and then layer the statute-specific overlays on top.
For an end-to-end walk through the 2026 landscape, see the companion briefing AI Compliance Landscape 2026.
What this means for a mid-market CISO this quarter
We've framed these as commitments rather than tasks because they require named ownership and a measurement plan. Pick the one that closes your biggest stage transition first.
- Publish an inventory by 30 June 2026. The Stage 1-to-Stage 2 transition is gated on the existence of an evidence-backed inventory of AI tools in use, sanctioned and unsanctioned. Measurement: presence of a board-visible artefact with discovery evidence. Internal tool that helps: NIST AI RMF gap analyser.
- Map controls onto NIST AI RMF or ISO 42001 by 30 September 2026. The Stage 2-to-Stage 3 transition is gated on framework mapping. Measurement: the number of NIST AI RMF sub-categories or ISO 42001 clauses with named, evidenced controls in your GRC system. See the NIST AI RMF compliance brief and the ISO 42001 compliance brief.
- Deploy a runtime control by 31 December 2026. The Stage 3-to-Stage 4 transition is gated on a runtime control: DLP at the AI-egress layer, browser-extension discovery, or a sanctioned-tenancy enforcement gate. Measurement: the percentage of AI-touching sessions covered by the runtime control. The Areebi platform is purpose-built for this transition.
- Run an AI incident-response exercise before year-end. The Stage 4-to-Stage 5 transition is gated on tested IR. Measurement: a documented tabletop or live exercise that touched the AI control plane specifically. The IBM Cost of a Data Breach Report 2025 documents the per-breach savings associated with a tested IR plan1.
- Brief the board on the EU AI Act August 2026 obligations. If your organisation has any EU exposure, the August 2026 high-risk-system obligations are the most consequential compliance event of 202611. Measurement: a board-visible applicability assessment with named gaps. See the EU AI Act compliance brief.
What this means for Areebi
We built Areebi to compress the path from Stage 2 to Stage 4 from years into weeks. Stage 2 to Stage 3 is mostly inventory and framework mapping; Stage 3 to Stage 4 is runtime enforcement and audit-trail integration. Those are tractable problems with the right platform; they should not require a multi-year programme.
We are pre-customer at the time of publishing this Q2 2026 Index. That is the honest position, and we are publishing the Index anyway because we believe citation density beats publication velocity. The mid-market does not need another vendor whitepaper that quotes Gartner once and a single anonymous customer; it needs a synthesis with named sources you can re-run with different weights. That is the artefact we've tried to build.
We commit to a quarterly cadence. The Q3 2026 release will include a machine-readable dataset version, a refreshed maturity distribution from the next quarter of public-source releases, and - as our customer base grows - the first primary-survey segment. The Q4 2026 release will introduce regional cuts (APAC, LATAM) that this Q2 release deliberately did not attempt.
If you are a researcher, analyst, or journalist who wants the underlying analysis spreadsheet - sources, scoring, the cross- source mapping decisions - we are happy to share it under the same CC BY 4.0 licence. Email research@areebi.com and we will send it.
For the platform overview, see the Areebi platform; for our security posture and the underlying SOC 2 readiness roadmap, see SOC 2 readiness.
References and dataset
The following primary sources underpin the analysis. Each is publicly accessible at the URL listed. We have not modified any number from its original source; where we report a range across sources, the underlying single-source numbers are recoverable from the citations below.
- 1. IBM & Ponemon Institute, Cost of a Data Breach Report 2025, July 2025. ibm.com/reports/data-breach
- 2. Verizon, Data Breach Investigations Report 2025, May 2025. verizon.com/business/resources/reports/dbir
- 3. IDC, Worldwide AI and Generative AI Spending Guide and AI Adoption Surveys 2025. idc.com (Worldwide AI Spending Guide)
- 4. IAPP & EY, Privacy and AI Governance Report 2024. iapp.org/resources
- 5. Salesforce, State of IT 2024 (and successor State of the AI Connected Worker). salesforce.com/news/stories
- 6. Stanford Institute for Human-Centered AI, AI Index Report 2025. aiindex.stanford.edu/report
- 7. Gartner, Press release on AI Trust, Risk, and Security Management (AI TRiSM) adoption forecast, 2024. gartner.com/en/newsroom
- 8. National Institute of Standards and Technology, AI Risk Management Framework (NIST AI 100-1), January 2023. nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
- 9. National Institute of Standards and Technology, Generative AI Profile (NIST AI 600-1), July 2024. nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
- 10. International Organization for Standardization, ISO/IEC 42001:2023 - AI management system, December 2023. iso.org/standard/81230.html
- 11. European Union, Regulation (EU) 2024/1689 - the EU AI Act, OJ L of 12 July 2024. eur-lex.europa.eu/eli/reg/2024/1689
- 12. Stack Overflow, Developer Survey 2025. survey.stackoverflow.co/2025
- 13. Office of the Australian Information Commissioner, Notifiable Data Breaches Report (H2 2024 release). oaic.gov.au
- 14. California Legislature, SB 1047 - Safe and Secure Innovation for Frontier AI Models Act (vetoed), September 2024. leginfo.legislature.ca.gov
- 15. Colorado General Assembly, SB 24-205 - Colorado AI Act, effective 1 February 2026. leg.colorado.gov/bills/sb24-205
- 16. Texas Legislature, HB 1709 - Texas Responsible AI Governance Act (TRAIGA), 2025 session. capitol.texas.gov
- 17. Senado Federal do Brasil, Projeto de Lei n. 2338, de 2023. www25.senado.leg.br (PL 2338/2023)
- 18. United Kingdom Accreditation Service (UKAS), ISO/IEC 42001 certification register. ukas.com
- 19. ANSI National Accreditation Board (ANAB), Accredited certification body directory for ISO/IEC 42001. anab.ansi.org
- 20. Federal Reserve, SR 11-7 Guidance on Model Risk Management. federalreserve.gov/supervisionreg/srletters/sr1107
- 21. Illinois General Assembly, AI Video Interview Act. ilga.gov
- 22. Areebi Research Team, The Shadow AI Index Q3 2026, May 2026. areebi.com/resources/research/shadow-ai-index-q3-2026
- 23. New York City Department of Consumer and Worker Protection, Local Law 144 - Automated Employment Decision Tools. nyc.gov (Local Law 144)
- 24. US Office of Management and Budget, OMB Memorandum M-24-10 on Federal Agency Use of AI. whitehouse.gov/omb
- 25. Department for Science, Innovation and Technology (UK), A Pro-innovation Approach to AI Regulation. gov.uk/government/publications
A machine-readable JSON version of the Areebi Index dataset - maturity-stage distribution, citation map, shadow-AI prevalence by stage, framework-adoption signals - will be published as /resources/research/areebi-index-q2-2026.json in the Q3 2026 release. The Q2 release defines the dataset schema conceptually; the Q3 release will publish the structured emit alongside the next quarterly narrative.
How to cite this report & license
Recommended citation:
Areebi Research Team. The Areebi Index Q2 2026 - State of the Secure AI Control Plane. Areebi, May 20, 2026. https://www.areebi.com/resources/research/areebi-index-q2-2026
This report is released under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. You may copy, redistribute, remix, transform, and build upon the report for any purpose, including commercially, with attribution to Areebi Research and a link back to this page. Where your reuse materially changes our findings, please make that clear to your readers. Researchers wanting the raw analysis spreadsheet can email research@areebi.com.
Get the full Areebi Index Q2 2026 as a PDF
Drop your email and we will unlock a print-optimised PDF of the full Q2 2026 Areebi Index for citation in board materials, regulator briefings, or analyst notes. We will also let you know when the Q3 2026 release is published.
By unlocking the PDF, you agree to our Privacy Policy. The report itself remains free to read on this page without an email.
Next steps in the Areebi Index
Run a NIST AI RMF gap analysis, compare AI frameworks side by side, or talk to the team building the runtime enforcement layer.