Share with your CISO
A Veeam-commissioned survey of 1,000 EMEA enterprise IT, data, and security decision-makers reveals a governance gap that’s now producing boardroom friction: 70% of EMEA organisations admit automated AI workflows are touching sensitive corporate data without full oversight, and 67% have employees building autonomous workflows that IT can’t fully track. Thirty-two percent of respondents report that rising regulatory pressure is already generating executive-level conflict, while 40% of leaders say they’re personally worried about liability for autonomous AI deployments.
What this means for your business
The number that should concentrate minds isn’t the 70% oversight gap, it’s the 58% of surveyed enterprises now operating under new corporate accountability laws, paired with 12% saying individual liability remains undefined. If your organisation sits in that overlap, your CISO isn’t just managing technical risk anymore. Regulatory exposure has migrated upward, and the question of who signs off on an autonomous AI workflow that mishandles customer data has become a personal legal question for named executives, not an abstract compliance checkbox.
The Veeam framing here, shaped by a vendor whose commercial interest lies in selling data protection and governance tooling, tilts the prescription toward data-layer controls rather than process controls or organizational design. That’s worth noting because the finding that “controlling thousands of agents one-by-one doesn’t scale” is correct, but the conclusion that you therefore secure the underlying data is only one valid architectural response. Restricting what data agents can access in the first place, through data minimization and access tiering, is equally viable and doesn’t require a new platform purchase. The survey’s numbers are credible; the implied solution path is narrower than the problem warrants.
The 41% of EMEA organisations building local or sovereign AI models specifically to address shadow AI concerns signals something beyond a technical preference. When nearly half your peer set is restructuring model deployment to regain visibility, that’s a leading indicator that the compliance environment has already hardened enough to override the convenience of global SaaS AI. CISOs whose budget cycles run 12 to 18 months out should weigh whether their current vendor stack actually delivers the audit trail that personal accountability laws will eventually require, because “we relied on the vendor’s logging” is not a defensible answer when a regulator asks who authorized a specific data interaction.
Based on reporting from AI governance fuels boardroom tension, originally published 2026-09-10 06:59:00.
