AI in 2026 – three risk and security considerations

AI will send software supply chain security back by years

Many enterprises will say they have learnt supply chain security lessons after 2023’s SolarWinds breach – but that doesn’t mean their AI has. With AI expanding software supply chain volume and complexity, similar incidents will become more likely and severe, as a single compromised component could cascade across thousands of enterprises.

Most modern AI coding tools are trained on historical repositories. They lack real-time CVE awareness and will happily draw from vulnerable libraries. AI-generated code also typically lacks clear provenance; developers can’t trace where suggestions originated or whether they incorporate licensed code or vulnerable components. That makes it near-impossible to work backwards and identify if an organization’s software is affected by issues like Log4Shell.

In 2026, scalable supply chain security will become non-negotiable. Software Composition Analysis must scan every dependency, SBOMs must be maintained in real time, and remediation needs to be automated. Policy-as-code capabilities will be required to block insecure dependencies at source, backed by continuous monitoring to keep pace with AI-accelerated delivery. Only then will organizations achieve supply chain security that scales with AI-augmented velocity.

Cloud costs will skyrocket without automated controls in place

With AI and ML workloads still growing exponentially, many enterprises will see their cloud costs spike in 2026. Those lacking visibility into how AI workloads consume resources will be hit with overspends of up to 50%. Given cloud is now the second-largest line item after salaries for many enterprises, they simply cannot afford to leave spending to guesswork.

To manage cloud costs in the era of AI, moving from monthly cost reporting to real-time FinOps will be vital. This includes using real-time anomaly detection and AI-powered cost optimisation techniques to analyse usage patterns and automatically right size resources. By automating cloud cost management, organizations can dynamically control spend, eliminate waste, and realise savings. This intelligent approach also removes the burden of managing resource scheduling for engineers, allowing them to focus on delivery while avoiding unnecessary consumption.

In 2026, AI-driven code and new regulations will force enterprises to upgrade governance

In 2026, compliance and security will shift from background concerns to central pillars of AI adoption. Organizations will face a complex regulatory landscape: the EU AI Act, alongside NIS2, and DORA creating a more unified European framework, while US regional regulations in states like Colorado and California will demand more transparency, risk assessments, and algorithmic accountability.

At the same time, reliance on AI-generated or ‘vibe’ coding will continue to create high-stakes risks. Research shows up to 45% of AI-generated code contains vulnerabilities, with issues ranging from hallucinated dependencies to language-specific failures. Large organizations that lean heavily on AI without robust guardrails face inevitable breaches.

To stay ahead of compliance, forward-looking companies will adopt automated policy enforcement, continuous security scanning, and comprehensive audit capabilities. Meanwhile, companies that embed security as code, automated testing, and runtime verification across their development pipelines will reduce the risk of AI-generated code, while enabling innovation to scale safely. These trends will make 2026 the year that security and compliance drive the future of AI.