Obstacles to Governance and Protection
Comprehensive data and AI governance are absolute necessities for protecting data in today’s environment. However, a number of obstacles need to be overcome, including the following:
Scattered and siloed data ownership. “Legal owns compliance,” said Rajhans. “IT owns infrastructure. Business units own the AI tools they bought. Security tries to cover everything, but unfortunately controls none of it. That’s where failure in policy happens.”
This fragmented data estate—complicated by accelerating AI adoption—stymies any efforts at governance. “Governance technologies cannot be applied effectively if the underlying data estate isn’t unified, classified, or curated in the first place,” said Wade Tsai, distinguished technologist with EY. “Organizations are deploying AI solutions broadly on top of their respective data domains, often without full consideration of the controls needed to ensure data is used responsibly and securely.” This includes granular access controls and full audit trails of how that data was used.
The variety of vendors and offerings seen within today’s data shops also make a unified governance approach challenging. “You can’t write one meaningful policy that covers Oracle, SQL Server, a Databricks lakehouse, and Salesforce analytics all at once,” said Kellyn Gorman, multiplatform and AI advocate and engineer for Redgate Software. “Each platform has different access primitives, different metadata models, and often completely different teams running them, so any real policy has to sit above every single platform, and most organizations haven’t built that layer yet.”
Pace outstripping accountability. “AI adoption is moving faster than most organizations can define who owns a decision, who signs off on risk, and who’s responsible when something goes wrong,” said Erin Hamm, senior director and chief field data officer at DataBee, a Comcast company. “Governance conversations tend to happen after the fact, once a new AI use case is already in production, instead of shaping how it gets built in the first place. Add to that the pressure to show AI results quickly, and governance ends up treated as a brake instead of a wheel. The organizations that get this right are the ones building policy and adoption in parallel, not sequencing one after the other and hoping to catch up.”
Hard-to-control agents. With the rise of agentic AI, greater governance and runtime controls “over agentic memory, vector databases, and even prompts that govern agentic behavior” are needed, Tsai added. This is critical infrastructure integral “to rely on to respond quickly to issues such as emerging threats in the age of [Anthropic] Claude Mythos, privacy concerns, and regulatory changes.”
Policies and approvals out of sync. Issues often arise as “policy also gets written by people who cannot see what agents do at runtime,” said Robert Wood, chief information security officer with TiDB. “Without query-level visibility into what an agent actually reads, governance becomes a document rather than a control.”
In addition, there is a velocity mismatch, Wood noted. “AI teams ship weekly. Governance review cycles run quarterly. Any process that requires the second to approve the first gets routed around, quietly and immediately.”
Insufficient executive support. “When senior leaders do not recognize these areas as enterprise-level risks, they are often treated as technical or legal issues rather than as responsibilities shared across the organization,” said Herold. “That lack of executive commitment creates a domino effect. It can result in inadequate budgets, insufficient staffing, competing priorities, and too little time to establish and maintain a comprehensive governance program.”
Overall, the pace of AI innovation far outstrips the development of adequate governance, standards, and security frameworks. “Clear accountability for data validation and protection is often missing,” said Jayaram. “There are also no unified global regulatory standards. Organizations are required to navigate a patchwork of regional rules, making it difficult to establish consistent, thorough safeguards.”