70% of organisations admit that AI workflows are interacting with sensitive corporate data without full oversight.
New research from Veeam® Software, the Data and AI Trust Company, reveals a growing ‘shadow agent’ crisis across EMEA enterprises. According to the findings, organizations are battling unmanaged AI on two fronts. On the data security front, 70% of organizations admit that automated AI workflows are interacting with sensitive corporate data without full oversight. Meanwhile, on the governance side, IT is losing control, with 67% reporting that employees are creating autonomous AI workflows that IT cannot fully track.
As organisations race to operationalise AI, the findings highlight a critical challenge: ensuring the data powering AI agents remains trusted, secure and resilient. Without the right governance, visibility and protection, businesses risk exposing sensitive information, increasing compliance risks and undermining the trusted data foundation required to scale AI safely and confidently.
Rising regulatory pressure and ‘corporate accountability’ are also pushing AI governance out of the technical back office and into the boardroom. Nearly one-third of organizations (32%) say this pressure is already creating tension or conflict among executives.
AI Governance is now a C-suite liability
As compliance obligations across EMEA become more complex with the introduction of personal legal responsibility on C-level executives for cyber resilience and regulatory compliance, senior leaders are feeling the heat. The research found that 58% of the enterprises surveyed now find themselves under new corporate accountability laws. Worryingly however, one in ten respondents (12%) stated that exact individual responsibilities are shared and unclear.
This increased responsibility is having a clear impact on executive teams:
- 40% are concerned about personal liability or consequences.
- 39% report increased board-level scrutiny.
- 37% say it has increased personal stress or anxiety.
- 32% say it has created tension or conflict with other executives.
However, the research also points to a positive shift: 45% say increased accountability has improved alignment and focus at the leadership level.
“Executives have never had more to think about around data governance and cyber resilience regulations,” said Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam.
“While the increased stress and tension are completely understandable, if the result is better alignment at the board level, the organization will be far better positioned to trust its data and AI governance in the agentic era. With greater alignment ultimately comes better data governance, visibility and protection across the organisation.”
‘Shadow agents’ are spreading across EMEA faster than governance can keep up
The findings reveal a fragmented approach to AI governance across EMEA. Germany faces particularly acute challenges, with 81% of leaders admitting that automated workflows are interacting with sensitive data without oversight, while 79% report employees creating “shadow workflows” that IT teams cannot track. The UK is facing similar challenges, with 75% of organisations saying they lack adequate oversight of AI agents interacting with sensitive data.
This is happening despite significant investment in more controlled AI environments. Across EMEA, 41% of organizations are building their own local or sovereign AI models specifically to combat Shadow AI. Nearly half (49%) are adopting a hybrid approach to do this, using a blend of local and sovereign models for sensitive data and global models for general tasks.
MEA organisations are the outlier here, with 41% relying entirely on global AI providers for all use cases – suggesting the EU regulatory landscape is having a major impact on AI governance within EMEA enterprises.
“EMEA organisations are still getting to grips with governance in the new agentic era,” added Pfaelzer.
“But the data shows the industry is having the wrong conversation about AI trust. Trying to control thousands of autonomous agents one-by-one simply doesn’t scale. To make AI safe at the enterprise level, organizations need to secure, govern and understand the data those agents depend on.”
EU AI Act confidence gap exposes governance risk
Adding to this pressure is the EU AI Act. The Act is already beginning to take effect, with further compliance deadlines rolling out through to 2028. The research revealed that while the overwhelming majority (83%) of leaders feel the Act will have a positive impact on organizations and the wider landscape, 62% feel ‘ambiguities or grey areas’ may create compliance risk, while a further 63% fear it may introduce unintended operational or legal risks. The UK and Germany are particularly concerned here, with 74.4% and 73.6%, respectively, viewing the ambiguities as a compliance risk.
Source: Tahawul Tech