Stanford’s 2026 AI Index highlights rapid growth and widening governance gaps

Editor’s Note: Stanford’s 2026 AI Index, released April 14, lands at the exact moment cybersecurity, information governance, and eDiscovery leaders are being asked to stand behind AI systems they cannot fully inspect. Documented AI incidents rose to 362 in 2025 from 233, the Foundation Model Transparency Index average fell from 58 to 40 out of 100, and 80 of 95 notable 2025 models shipped with no published training code — even as organizational adoption climbed to 88 percent and generative AI crossed 53 percent population-level use in three years.

For regulated industries, the regulatory floor shifted, too. The EU AI Act’s first prohibitions and general-purpose-model obligations took effect in 2025, California’s SB 53 took effect Jan. 1, 2026, and ISO/IEC 42001 is now cited by 36 percent of surveyed organizations as an influence on their responsible AI practice, with the NIST AI Risk Management Framework at 33 percent.

Watch three indicators next: AI Incident Database volume, the next Foundation Model Transparency Index scoring cycle, and California SB 53 rulemaking. Together, they will signal whether 2026 tightens or loosens the disclosure floor that cyber, IG, and eDiscovery programs depend on.

Industry News – Artificial Intelligence Beat

Stanford’s 2026 AI Index highlights rapid growth and widening governance gaps

ComplexDiscovery Staff

AI now scales faster than the institutions built to govern it. That is the through-line of Stanford’s 2026 AI Index Report, the ninth edition of the Institute for Human-Centered Artificial Intelligence’s annual audit, and the finding carries direct consequences for cybersecurity teams, information governance leaders, and discovery professionals who are being asked to stand behind technology whose inner workings their vendors disclose less and less about.

Released April 14, the 423-page report was compiled by a Stanford-led steering committee chaired by Yolanda Gil of the University of Southern California, with co-chair Raymond Perrault of SRI International. In their opening message, Gil and Perrault said the data does not point in a single direction — it reveals a field scaling faster than the systems around it can adapt. The 2025 numbers bear out that framing. Generative AI reached 53 percent population-level adoption within three years, global corporate AI investment in 2025 roughly doubled its 2024 level, and organizational adoption climbed to 88 percent of surveyed firms. U.S. private AI investment reached approximately $285.9 billion in 2025, against approximately $12.4 billion in China, according to the Index.

Against that backdrop, the data on oversight points the other direction. Documented AI incidents rose to 362 in 2025, up from 233 in 2024, according to the AI Incident Database figures cited by the report. The separately maintained OECD AI Incidents and Hazards Monitor reached 435 reports in January 2026, a six-month moving average of 326.

Transparency is also eroding. The Stanford Center for Research on Foundation Models’ 2025 Foundation Model Transparency Index, published in December 2025 and incorporated into the 2026 Index, showed average scores dropped from 58 in 2024 to 40 in 2025 on a 100-point scale, Stanford researchers said. Training data, compute, and post-deployment usage were the most opaque categories, with xAI and Midjourney at 14 and IBM at 95.

Disclosure at the model level followed the same trend. The Index reports that 80 of 95 notable models released in 2025 came out without corresponding training code, compared to four with open-source training code. Reported parameter counts from OpenAI, Anthropic, and Google have effectively stopped, even as Epoch AI’s training-compute estimates continue to rise. Industry produced 91.6 percent of notable AI models in 2025, with OpenAI leading releases at 19, Google at 12, and Alibaba at 11.

The 2026 Index characterizes the most capable modern models as among the least transparent and notes that frontier labs are disclosing less, a pairing that complicates auditability and safety validation. For corporate legal and cybersecurity teams whose obligations include proving how a model was built, where its data came from, and whether it behaves within sanctioned boundaries, that closure is the subtext of every adoption decision.

The U.S.-China model performance gap has effectively closed. As of March 2026, the top U.S. model leads its top Chinese competitor by just 2.7 percent on benchmark comparisons tracked in the Index, and DeepSeek-R1 briefly matched — and, by some Index language, briefly surpassed — top U.S. systems on Arena in February 2025. For practitioners running cross-border engagements, this convergence matters when vendor selection brushes up against the Pax Silica Declaration, signed Dec. 11, 2025, at a summit convened by the U.S. Department of State, and the broader cluster of export-control and data-residency regimes those negotiations reflect.

The report also tracks what has moved in at the regulatory layer. ISO/IEC 42001, the world’s first AI management system standard, published in December 2023, was cited by 36 percent of surveyed organizations as an influence on their responsible AI practice in 2025, and the NIST AI Risk Management Framework by 33 percent. GDPR remained the most-cited regulatory influence but slipped from 65 percent to 60 percent year over year, and the share of organizations reporting no regulatory influence at all fell from 17 percent to 12 percent. AI-specific governance roles grew 17 percent in 2025, and businesses with no responsible AI policy in place fell to 11 percent from 24 percent.

Legislative activity ran hot. The EU AI Act’s first prohibitions took effect Feb. 2, 2025, and obligations for providers of general-purpose AI models began to apply Aug. 2, 2025, requiring technical documentation, copyright-compliance policies, training-data summaries and, for systemic-risk models above 10 to the 25th power FLOP, European Commission notification and safety measures. On Sept. 29, 2025, California Gov. Gavin Newsom signed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, requiring large frontier developers to publish safety frameworks and incident reports and protecting whistleblowers, with key provisions taking effect Jan. 1, 2026. Italy became the first EU member state to pass a national AI law in September 2025, and the Texas Responsible Artificial Intelligence Governance Act took effect in 2026.

In the United States, federal policy moved the other way. A Jan. 23, 2025, executive order rescinded earlier AI directives in favor of a deregulatory stance, and a Dec. 12, 2025, order sought to curb state-level AI rulemaking. The result for practitioners is a fragmented regulatory picture in which compliance obligations vary by jurisdiction and by model tier.

For eDiscovery teams, a distinct challenge surfaces in the data on synthetic content. Research from Graphite, a content analytics firm whose findings the Index cites with a methodology caveat, reported that beginning in January 2025, over 50 percent of newly published online content was AI-generated. Hallucination rates across 26 top models range from 22 percent to 94 percent on a new accuracy benchmark, and models handle false statements presented as something a user believes far worse than the same statements framed as another person’s belief — an authenticity problem when the record itself is the artifact under review.

Staffing is a quieter dimension of the same story. The Index reports that the number of AI researchers and developers moving to the United States has dropped 89 percent since 2017, with an 80 percent decline in the last year alone. For U.S.-based governance teams at law firms, corporations, and providers hiring from the same pool, that contraction is already showing up in recruiting timelines.

Practitioners who want to act on the report should read the Responsible AI and Policy and Governance chapters first, then track three indicators through the next quarter: incident volume in the AI Incident Database, the next Foundation Model Transparency Index score publication cycle, and the rulemaking docket for California SB 53. Teams running discovery engagements that touch AI-generated communications should also budget for authenticity challenges.

The deeper point is structural. The Index reports that frontier AI is now overwhelmingly produced by a small set of U.S. and Chinese industry labs, and that the hardware that trains them runs almost entirely through a single Taiwanese foundry, with TSMC fabricating almost every leading AI chip. The Index also reports that the United States hosts 5,427 data centers, over 10 times any other country, and that AI data center power capacity rose to 29.6 gigawatts, comparable to New York state at peak demand. The 2026 Index supplies the scoreboard and the warning that institutional oversight has not caught up with technical production.

Implications for cybersecurity, information governance, and eDiscovery professionals

The analysis below is editorial, drawing on the Stanford report’s data to frame practitioner implications. The recommendations are not findings of the AI Index 2026.

For cybersecurity teams in law firms, corporations, and service providers, the report’s transparency and incident data translate into a procurement exercise. Insist on model cards, third-party safety evaluations, jailbreak-resistance testing, and breach-response commitments as terms of any AI deployment. Map vendor disclosures against the Foundation Model Transparency Index categories — training data, compute, capabilities, risks, usage policy, impact — to flag gaps before contracting. Providers selling into this market should assume their buyers will ask those questions and build standing disclosure packages that answer them.

For information governance professionals in corporate legal departments, law firm knowledge management teams, and provider governance groups, the ISO/IEC 42001 and NIST AI Risk Management Framework adoption curves offer a starting framework for AI-specific retention, provenance, and auditability controls alongside traditional records and privacy programs. The addition of AI-specific standards alongside GDPR tells governance leaders that the control environment auditors will want to see in 2026 looks different from the one they built in 2024.

For eDiscovery providers and practitioners working in law firms, corporate legal operations and service provider organizations, the combination of the Graphite baseline of roughly 50 percent AI-generated content, widely varying hallucination rates and state-level disclosure regimes should accelerate investment in authenticity workflows, training-data provenance tracking, and defensibility documentation that holds up in court and before regulators. Matter teams should revisit preservation protocols to cover AI prompts, outputs and agent logs, update collection workflows to capture provenance metadata, and train review attorneys on how to spot and flag synthetic content. Authenticity-challenge posture should draw on legal-profession guidance, including American Bar Association Formal Opinion 512 on a lawyer’s use of generative AI, issued July 2024, and Federal Judicial Center resources on authenticating AI-generated evidence under Federal Rule of Evidence 901.

Is your AI governance program built to the 2025 baseline Stanford just published, or to the one Stanford’s 2026 data has already moved past?

News Sources

• The 2026 AI Index Report (Stanford HAI)
• Artificial Intelligence Index Report 2026 (PDF) (Stanford HAI)
• The 2025 Foundation Model Transparency Index (Stanford CRFM)
• Welcome to the Artificial Intelligence Incident Database (AIID)
• Governor Newsom signs SB 53, advancing California’s AI industry (Office of Gov. Gavin Newsom)
• EU rules on general-purpose AI models start to apply (European Commission)
• ISO/IEC 42001:2023 — AI management systems (ISO)
• Stanford’s 2026 Report: AI Safety Benchmarks Are Falling Behind (AI News)
• Stanford AI Index 2026: Why 62% Say Security Blocks Agentic AI Scaling (Kiteworks)
• Stanford’s 2026 AI Index: US Leads China by 2.7% (Crypto.news)

Assisted by GAI and LLM Technologies

Additional Reading

• When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.