9 AI Governance Case Studies: Wins, Failures, Lessons

AI governance case studies show what organizations put in place, what broke, and what it cost. This guide names nine organizations and cites a source for each.

I traced each case to the best source I could open, and I checked what has changed since. Three cases show governance working, and six show where it broke or fell short.

Each case uses the same format so you can scan them, and a cross-case section pulls out what they share.

How I chose these AI governance case studies

The four selection rules:

• Named organization: Each case names its organization, with no composites or "large financial services firm" examples.
• Authoritative source: Each case cites a regulator, tribunal, journal, news outlet, or the organization itself.
• Date: Each case gives a date and says what has changed since.
• Stated outcome: Each case reports the published outcome, or says none was published.

Several accounts are second-hand. Mastercard and Canada's DFO come from conference talks as reported by Dataversity, and the Air Canada account comes from an American Bar Association commentary, because I could not open the tribunal's decision. Samsung and Deloitte rest on news reports. Treat company-reported outcomes as unaudited.

For shorter, anonymized examples by industry, see our responsible AI examples. Our AI governance guide covers how to build the program that these cases describe.

The nine cases at a glance:

Three AI governance case studies where governance worked

1. Mastercard: a five-person team that made compliance easy

Who and when: Mastercard's global AI governance team is led by John Hearty. The account is a Dataversity case study, updated in August 2026 and based on Hearty's conference talk. The page gives no original publication date.

Trigger: Staff may launch or buy new AI systems without always telling the governance team, which leaves a backlog of older products to review. Bank customers also expect to understand how Mastercard's models perform.

What they put in place: The team asks the product owner to complete a scorecard before a system is built or a contract is signed. They also built a bias-testing API and mitigation requirements for LLM evaluation with developers, and they took a model documentation template to customers before contracts to confirm it met their information needs.

Outcome: Five specialists cover the program. The number of AI systems they assess, advise on, and monitor doubled each year until 2024, then grew 60%. The case study reports workload growth but provides no incident or cost figures.

What has changed since: The 2024 growth numbers are the newest public figures I found.

Lesson: Make compliance easy to do. The team gained influence by working with other teams and building tools, and Hearty's rule is "If risk might be present, treat it as though it is."

2. Duke Health: each patient-care algorithm registered and reviewed

Who and when: The program belongs to Duke University Health System and School of Medicine. Duke's ABCDS page says Duke Health leadership ordered a structured approach to AI tools in 2020, and the results come from a JAMIA paper published online on November 29, 2023.

Trigger: Algorithms were entering clinical workflows while the rules stayed uncertain. The authors list misdiagnosis, inappropriate treatment decisions, loss of patient trust, and care disparities as possible harms.

What they put in place: Duke formed a 14-member oversight committee. All algorithms intended for patient care must be registered with the committee and evaluated, whether built locally or bought from a vendor. The committee reviews them against five principles, which are transparency and accountability, clinical value and safety, fairness and equity, usability and adoption, and regulatory compliance.

Outcome: The program lists 54 registered algorithmic technologies, 17 of them AI algorithms in clinical use, and the committee has completed 36 reviews of 32 technologies. Most reviews finish within 3 to 7 weeks.

In one review, the committee found a model whose predicted risk was not proportional to clinical probability, and the team recalibrated it. In another review, the committee asked a team to test performance with and without sex as an input, and the team removed the variable after confirming the model still performed well.

What has changed since: The authors say Duke is extending the approach to cover large language models. They also warn that the process may not scale in settings without dedicated AI and data engineering staff. I found no newer program figures.

Lesson: Duke paired mandatory registration with lifecycle checkpoints, and most reviews take 3 to 7 weeks. Teams first saw the documentation as a burden, so the committee invested in internal education. Our guide to healthcare AI governance covers the sector's frameworks.

3. Canada's DFO: let a maturity assessment decide what to build first

Who and when: Canada's Department of Fisheries and Oceans (DFO) shared its account through Riham Elhabyan, senior advisor for AI and data policy. The account is a Dataversity case study, updated in July 2026 and based on a conference talk. The talk's date isn't stated.

Trigger: DFO needed a systematic way to turn Canada's AI strategy into operational models. Several use cases succeeded as proofs of concept, then failed in the proof-of-value and production phases.

What they put in place: DFO ran a maturity assessment across five dimensions (AI governance, data management, talent, process, and technology). It then built a roles matrix, wrote responsible AI principles with playbooks and a self-assessment questionnaire, and set up an intake process for AI projects.

Outcome: The first scores were disappointing and showed minimal data management capability, which told DFO what to build first. The article says DFO got feedback quickly and saved resources it would have spent scaling up the project. No numeric results are reported.

What has changed since: The case study lists production risk monitoring and a responsible AI center of expertise as additions DFO still needs. The article carries no later update.

Lesson: Test in a live setting early, and let an assessment decide what governance to build first. DFO started with data quality use cases built on unclassified data.

Six AI governance case studies where it failed or fell short

Our AI governance failure guide covers five failure modes, including unclear ownership and missing visibility. These six cases show some of those failure modes in practice.

4. Dutch Tax Administration: an algorithm that flagged families by nationality

Who and when: The Dutch Tax and Customs Administration ran the childcare benefits system. A parliamentary committee reported in December 2020 that an "unprecedented injustice" had been done to accused parents, and the Rutte cabinet resigned on January 15, 2021.

Trigger: Families were wrongly accused of fraud and told to repay large sums. An algorithm that built risk profiles used nationality as a factor, and the Dutch Data Protection Authority later found that use unlawful and discriminatory.

What was missing: Controls on nationality data. The authority said the Tax Administration should have deleted dual-nationality data in January 2014. It called using nationality to assess applications and combat fraud unlawful, and it found that keeping the data was discriminatory.

Outcome: The government resigned. The authority issued a €2.75 million fine in 2021 for the nationality processing. On April 12, 2022, it announced a €3.7 million fine for a fraud blacklist that broke privacy law in six ways.

What has changed since: Both fines came after the resignation. I did not check the current status of the compensation scheme for affected families.

Lesson: An algorithm that uses a protected characteristic needs a lawful basis and a way for the people it flags to challenge the result.

5. Goldman Sachs and Apple Card: cleared on fair lending, faulted on transparency

Who and when: The case involves Goldman Sachs Bank, which issued the Apple Card, and Apple. Public complaints surfaced in November 2019, and the New York State Department of Financial Services published its report on March 23, 2021.

Trigger: Consumers complained that women got lower credit limits than men, and one said he was offered a limit 20 times higher than his wife's.

What was in place: The regulator found the bank had a fair lending program and could identify the factors behind each credit decision it examined. The regulator reviewed underwriting data for nearly 400,000 New York applicants.

Outcome: The regulator found no fair lending violations, and women and men with equivalent credit characteristics had similar outcomes. The investigation did show deficiencies in customer service and transparency, and the report says requiring account holders to wait six months to appeal credit terms frustrated applicants.

What has changed since: The report says the bank eliminated the six-month waiting period for appeals. I did not check later program changes.

Lesson: Fair outcomes also need a clear explanation for customers. Governance covers transparency, appeals, and customer service.

6. iTutorGroup: age cutoffs built into hiring software

Who and when: iTutorGroup is a tutoring company. The EEOC sued on May 5, 2022; the parties filed notice of a settlement on or about August 9, 2023; and the EEOC announced the settlement in a September 2023 press release.

Trigger: A rejected applicant resubmitted her application with a later birth date and received an interview. The EEOC then alleged the application software was programmed to automatically reject women aged 55 or older and men aged 60 or older.

What was missing: The EEOC says the age cutoffs were built into the screening software. The public record I reviewed does not show whether anyone checked them against age-discrimination law before use.

Outcome: iTutorGroup agreed to pay $365,000 to more than 200 applicants rejected for their age. It also agreed to a new anti-discrimination policy, training, a ban on requesting birth dates, and EEOC monitoring for at least five years. A settlement resolves the claims without a trial.

What has changed since: Commentators often call this the first AI hiring settlement. The EEOC's release describes "application software" and does not use the term AI. The 2023 EEOC guidance on AI has since been removed from the agency's website.

Private lawsuits now test age-discrimination claims against AI hiring tools. In Mobley v. Workday, the court granted preliminary certification of a collective action on the age claim on May 16, 2025, and Workday denies responsibility for individual employment decisions.

Lesson: Automated screening, simple or machine-learned, falls under existing anti-discrimination law. Test what it does to each group of applicants.

7. Samsung: from a ChatGPT restriction to a governed rollout

Who and when: Samsung Electronics engineers leaked internal source code by uploading it to ChatGPT in April 2023, according to a company memo, and Bloomberg reported the resulting ban on May 2, 2023.

Trigger: The memo told staff in one of Samsung's biggest divisions not to use generative AI tools. CSO Online reported that an internal survey about a month earlier found about 65% of respondents said ChatGPT posed serious security threats.

What they put in place: Samsung temporarily restricted generative AI use while it prepared internal AI tools and ways to block uploads of sensitive information to outside services.

Outcome: The sources I found report no measured result from the restriction. Until the 2026 change, the Korea Times says, employees were allowed only Samsung's internal model, Gauss.

What has changed since: In May 2026, Samsung told staff they could use outside models such as ChatGPT after security training, starting with its device experience division. Use in the semiconductor division stayed limited.

On June 21, 2026, OpenAI announced that ChatGPT Enterprise and Codex are available to all Samsung Electronics employees in Korea and all device experience employees worldwide, with data protection and access management controls.

Lesson: A temporary ban gives a company time to prepare, and Samsung's later move paired access with security training and enterprise controls.

8. Air Canada: the chatbot is part of your website

Who and when: The British Columbia Civil Resolution Tribunal decided Moffatt v. Air Canada on February 14, 2024. The American Bar Association summarizes the decision.

Trigger: After a family death, Jake Moffatt asked the website chatbot about bereavement fares, and it said he could apply for the discount within ninety days of ticket issuance. A linked Air Canada policy page said the bereavement rate did not apply to requests made after travel was completed, and the airline refused his refund.

What was missing: The tribunal found Air Canada did not take reasonable care to ensure its chatbot provided accurate information. It also rejected the argument that the chatbot was a separate legal entity responsible for its own actions.

Outcome: Air Canada was liable for negligent misrepresentation and owed about C$650 in damages, plus pre-judgment interest and filing fees. The commentary calls it a tribunal decision.

What has changed since: After the ruling, eDiscovery Today relayed Ars Technica's finding that Air Canada's site appeared to have no chatbot support, "suggesting that Air Canada has disabled the chatbot." I found no confirmation from the airline.

Lesson: You own what your AI tells customers. Validate its answers against the authoritative policy source, and keep a fast way to correct or remove it.

9. Deloitte Australia: AI-assisted work that reached a government unchecked

Who and when: Deloitte Australia was paid AU$440,000 for a 237-page review for the Department of Employment and Workplace Relations. The report was published in July 2025, and errors were reported in late August.

Trigger: University of Sydney researcher Chris Rudge found fabricated references and a fabricated quote from a Federal Court judgment, as Fortune reports.

What was missing: The errors made it into a published government report. The revised version disclosed that a generative AI language system (Azure OpenAI) was used, and Deloitte did not respond when asked whether AI generated the errors.

Outcome: Deloitte agreed to repay the final installment of its contract, according to an AP report of October 7, 2025. The refund is partial, and the amount will be made public after repayment. Deloitte said it resolved the matter directly with the client.

What has changed since: In November 2025, The Independent reported that a nearly C$1.6 million Deloitte health workforce plan for Newfoundland and Labrador contained at least four citations that do not, or appear not to, exist.

A Deloitte spokesperson said the firm used AI "to support a small number of research citations" and stands behind the recommendations. In March 2026, the province's accounting regulator, CPANL, opened an investigation after a complaint.

Lesson: AI governance extends to suppliers. Require disclosure of AI use in contracts, and verify citations and facts before you accept a deliverable.

What the nine AI governance case studies have in common

The six shared patterns:

• Visibility came first, or its absence caused the problem: Mastercard's backlog of unreported systems, Samsung's uploads to a public tool, DFO's assessment, and Duke's mandatory registration all began by finding out what AI was running.
• Review had to happen where the decision is made: The age cutoffs at iTutorGroup and the nationality factor in the Dutch system were built into automated decisions about people. Duke's checkpoints and Mastercard's pre-build scorecard put review before launch.
• Ownership had to be named: Air Canada's separate-entity argument failed, Deloitte repaid part of its fee, and the Dutch cabinet resigned. Mastercard and Duke each gave the program to a named team.
• Explanation mattered to the people affected: Goldman could identify the factors behind each credit decision, and the regulator still cited deficiencies in transparency and customer service. Duke's reviews and Mastercard's documentation templates create records others can inspect.
• Strategy and maturity set the pace: The ICIS 2024 study of six European multinationals found that AI governance maturity differs significantly depending on whether a company treats responsible AI as a strategic resource and aligns it with corporate strategy. The authors argue that this alignment can turn EU AI Act compliance into a lasting competitive advantage.
• Leaders and affected staff had a role in the decision: The Berkeley CLTC report on 35 efforts to apply AI principles says executive-level support is critical, and it adds that employees, experts, and legal teams should be involved in these decisions.

What an AI governance team needs

The staffed programs in this set differ in size. Mastercard's governance team has five specialists, and Duke's oversight committee has 14 members. Both cover several disciplines.

What each team covers:

• Mastercard: The five specialists cover architecture, model risk, technology solutions, and communications and networking, and the leader comes from data science R&D.
• Duke: The 14-member committee registers and evaluates each algorithm intended for patient care against five principles.
• DFO: A roles matrix defines who is responsible for each stage of the AI model lifecycle, and the chief data steward became responsible for developing an AI literacy program.

Mastercard's John Hearty recommends hiring for curiosity and self-awareness.

Finding qualified people is a real constraint. The 2025 IAPP report says near 90% of organizations already using AI are working on AI governance, and it names access to qualified AI governance talent as a significant challenge.

What to copy from these cases

The six practices:

• Build an inventory and require registration: Duke makes teams register each patient-care algorithm, and Mastercard began with the systems it did not yet know about.
• Review before launch: Use lifecycle checkpoints and a pre-build scorecard, as Duke and Mastercard do.
• Test outcomes by group: The iTutorGroup cutoffs and the Dutch nationality factor would likely show up in a simple group-level check.
• Write AI disclosure into supplier contracts: Deloitte's fabricated citations show the cost of skipping it.
• Give people an explanation and an appeal: The Apple Card report cited transparency gaps and a six-month wait to appeal.
• Staff across disciplines: Mastercard's five specialists and DFO's roles matrix both cover several functions, and Hearty recommends hiring for curiosity and self-awareness.

My take on these AI governance case studies

In the successes, a named team owned the program, kept a registry or scorecard, and reviewed AI before launch. In the failures, the system's output reached people before anyone checked what it did.

The failures mostly stemmed from the gap between what a system did and what anyone knew it did. Start by closing that gap.

Where Superblocks fits

These cases cover AI that organizations bought, built, or let employees use. Superblocks is a governed enterprise vibe coding platform, and it covers one part of the problem: the internal apps and agents that business teams build with AI. Our guide to the AI app flood covers that risk in depth.

The Superblocks MCP gives admins programmatic access to builders, apps, integrations, permissions, and audit logs. RBAC comes with Teams, while SSO, audit logs, and VPC deployment are Enterprise features.

At Flex, a business user built an app holding company IP on a personal Replit account, according to Superblocks' vibe coding curve report. After moving to Superblocks in its own AWS account, Flex built 150+ apps in the first 30 days, with 16 of 18 departments building.

Superblocks does not address bias testing for models, regulatory classification, or vendor-run AI such as a customer chatbot, and those are the risks behind most of the failure cases above.

Start with the Introduction to Superblocks to build a governed app on your own data.

Or book a demo to see how Superblocks fits your AI governance program.

Frequently asked questions

What are AI governance case studies?

AI governance case studies are documented examples of organizations governing AI, or failing to, with the trigger, controls, outcome, and lessons. The most useful ones name the organization and cite a regulator, court or tribunal, or published paper.

What is an example of successful AI governance?

Duke Health's ABCDS Oversight is a documented example. It requires registration of all algorithms intended for patient care and reviews each one, with 54 registered technologies and 36 reviews reported in a 2023 peer-reviewed paper. Mastercard's five-person team is another.

What is an example of an AI governance failure?

The Dutch childcare benefits scandal is among the best documented. An algorithm that built risk profiles used nationality as a factor; families were wrongly accused of fraud, the cabinet resigned in January 2021; and the data protection authority fined the tax agency twice.

What can organizations learn from AI governance failures?

Most failures trace to unchecked automated decisions, unclear ownership, or a lack of visibility into what AI was running. Common fixes are an AI inventory, pre-launch review, supplier disclosure clauses, and clear explanations for affected people.

What tool helps govern AI-built internal apps?

Superblocks helps govern AI-built internal apps, applying RBAC to apps built on the platform, with SSO and audit logs on Enterprise. It does not replace model validation or governance for vendor AI such as customer chatbots.