New research from Veeam Software has highlighted that EMEA enterprises are struggling with unmanaged AI, particularly in two key areas. On the data security front, 70% of organizations admit that automated AI workflows are interacting with sensitive corporate data without full oversight. Meanwhile, on the governance side, IT is losing control, with 67% reporting that employees are creating autonomous AI workflows that IT cannot fully track.
As organizations race to operationalise AI, the findings highlight a critical challenge: ensuring that the data powering AI agents remains trusted, secure, and resilient. Without the right governance, visibility, and protection, businesses risk exposing sensitive information, increasing compliance risks, and undermining the trusted data foundation required to scale AI safely and confidently.
Rising regulatory pressure and ‘corporate accountability’ are also pushing AI governance out of the technical back office and into the boardroom. Nearly one-third of organizations (32%) say this pressure is already creating tension or conflict among executives.
AI governance is now a C-suite liability
As compliance obligations across EMEA become more complex with the introduction of personal legal responsibility on C-level executives for cyber resilience and regulatory compliance, senior leaders are feeling the pressure. The research found that 58% of the enterprises surveyed now find themselves under new corporate accountability laws.
This increased responsibility is having a clear impact on executive teams: · 40% are concerned about personal liability or consequences. · 39% report increased board-level scrutiny. · 37% say it has increased personal stress or anxiety. · 32% say it has created tension or conflict with other executives.
However, the research also points to a positive shift: 45% say increased accountability has improved alignment and focus at the leadership level.
“Executives have never had more to think about around data governance and cyber resilience regulations,” said Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam. “While the increased stress and tension are completely understandable, if the result is better alignment at the board level, the organization will be far better positioned to trust its data and AI governance in the agentic era. With greater alignment ultimately comes better data governance, visibility, and protection across the organization.”
‘Shadow agents’ are spreading faster than governance can keep up
The findings reveal a fragmented approach to AI governance across EMEA. Germany faces particularly acute challenges, with 81% of leaders admitting that automated workflows are interacting with sensitive data without oversight, while 79% report employees creating ‘shadow workflows’ that IT teams cannot track.
The UK is facing similar challenges, with 75% of organizations saying they lack adequate oversight of AI agents interacting with sensitive data.
This is happening despite significant investment in more controlled AI environments. Across EMEA, 41% of organizations are building their own local or sovereign AI models specifically to combat shadow AI. Nearly half (49%) are adopting a hybrid approach to do this, using a blend of local and sovereign models for sensitive data and global models for general tasks.
MEA organizations are the outlier here, with 41% relying entirely on global AI providers for all use cases – suggesting the EU regulatory landscape is having a major impact on AI governance within EMEA enterprises.
“EMEA organizations are still getting to grips with governance in the new agentic era,” added Tim Pfaelzer. “But the data shows the industry is having the wrong conversation about AI trust. Trying to control thousands of autonomous agents one by one simply doesn’t scale. To make AI safe at the enterprise level, organizations need to secure, govern, and understand the data those agents depend on.”
Adding to this pressure is the EU AI Act. The Act is already beginning to take effect, with further compliance deadlines rolling out through to 2028.
The research revealed that while the overwhelming majority (83%) of leaders feel the Act will have a positive impact on organizations and the wider landscape, 62% feel ‘ambiguities or grey areas’ may create compliance risk, while a further 63% fear it may introduce unintended operational or legal risks. The UK and Germany are particularly concerned here, with 74.4% and 73.6%, respectively, viewing the ambiguities as a compliance risk.
About the research
The research was commissioned by Veeam and conducted by independent polling company Censuswide. The survey explores the perspectives of 1,000 enterprise IT, data, and security decision-makers at organizations with 500+ employees across the United Kingdom, Germany, France, and the Middle East and Africa (including Turkey, Israel, UAE, KSA, Nigeria, South Africa, and Kenya). The data was collected between April 21 and April 27, 2026.
