Kiteworks has released its Data Security and Compliance Risk: 2026 Forecast Report – a comprehensive analysis revealing that most organizations cannot answer a fundamental question regulators and auditors are asking: where does your data live, and can you prove it?
The research, based on a survey of 225 security, IT, compliance, and risk leaders across 10 industries and 8 regions, exposes a systemic visibility and accountability crisis.
Only 36% of organizations have visibility into where their data is processed, trained, or inferred by external partners. Meanwhile, 61% have fragmented audit trails that can’t produce evidence-quality documentation, and 57% lack the centralized data gateways needed to track, control, and prove data flows across their environment.
“Organizations have spent years building governance frameworks on paper. Now they’re being asked to prove those frameworks work — and most can’t,” said Tim Freestone, Chief Strategy Officer, Kiteworks. “When a regulator asks where customer data was processed, when a board asks how AI systems are accessing sensitive information, when a sovereignty audit demands proof of data residency — nearly two-thirds of organizations will struggle to produce a clean answer. That’s not a technology gap. It’s an accountability gap.”
Data sovereignty laws now span more than 100 countries, each with distinct requirements for where data can be stored, processed, and transferred. Yet the report finds that most organizations lack the infrastructure to demonstrate compliance. Without centralized gateways and unified audit trails, proving data residency becomes a manual, error-prone exercise — if it’s possible at all. The gap between regulatory expectations and operational capability is widening, not closing.
AI adoption is accelerating the problem. Every organization surveyed has agentic AI on their roadmap, but 63% can’t enforce purpose limitations on AI agents, 60% lack kill-switch capabilities, and 72% have no software bill of materials (SBOM) for AI models in their environment. AI systems are accessing, processing, and learning from sensitive data — while the governance infrastructure underneath them can’t track where that data goes or prove how it’s being used.
Third-party relationships compound the visibility problem. Organizations are extending sensitive data to AI vendors, cloud providers, and partners without the contractual mechanisms or technical visibility to verify where that data ends up.
The report also finds that 89% have never practiced incident response with third-party AI partners, and 78% can’t validate training data quality. Trust is being extended without the ability to verify.
“The organizations that can answer these questions share one thing in common: board engagement,” said Patrick Spencer, SVP of Americas Marketing and Industry Research, Kiteworks. “Organizations with engaged boards score up to 28 points higher on every governance metric—data visibility, AI controls, audit readiness, all of it. But 54% of boards aren’t engaged on these issues. The difference between organizations that can prove where their data lives and those that can’t starts in the boardroom.”
