New research from Veeam® Software, the Data and AI Trust Company, reveals a growing ‘shadow agent’ crisis across EMEA enterprises. According to the findings, organizations are battling unmanaged AI on two fronts. On the data security front, 70% of organizations admit that automated AI workflows are interacting with sensitive corporate data without full oversight. Meanwhile, on the governance side, IT is losing control, with 67% reporting that employees are creating autonomous AI workflows that IT cannot fully track.

As organizations race to operationalize AI, the findings highlight a critical challenge: ensuring the data powering AI agents remains trusted, secure and resilient. Without the right governance, visibility and protection, businesses risk exposing sensitive information, increasing compliance risks and undermining the trusted data foundation required to scale AI safely and confidently.

Rising regulatory pressure and ‘corporate accountability’ are also pushing AI governance out of the technical back office and into the boardroom. Nearly one-third of organizations (32%) say this pressure is already creating tension or conflict among executives.

AI Governance is now a C-suite liability

As compliance obligations across EMEA become more complex with the introduction of personal legal responsibility on C-level executives for cyber resilience and regulatory compliance, senior leaders are feeling the heat. The research found that 58% of the enterprises surveyed now find themselves under new corporate accountability laws. Worryingly however, one in ten respondents (12%) stated that exact individual responsibilities are shared and unclear.

This increased responsibility is having a clear impact on executive teams:

  • 40% are concerned about personal liability or consequences.

  • 39% report increased board-level scrutiny.

  • 37% say it has increased personal stress or anxiety.

  • 32% say it has created tension or conflict with other executives.

However, the research also points to a positive shift: 45% say increased accountability has improved alignment and focus at the leadership level.

“Executives have never had more to think about around data governance and cyber resilience regulations,” said Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam. “While the increased stress and tension are completely understandable, if the result is better alignment at the board level, the organization will be far better positioned to trust its data and AI governance in the agentic era. With greater alignment ultimately comes better data governance, visibility and protection across the organization.”

‘Shadow agents’ are spreading across EMEA faster than governance can keep up

The findings reveal a fragmented approach to AI governance across EMEA. Germany faces particularly acute challenges, with 81% of leaders admitting that automated workflows are interacting with sensitive data without oversight, while 79% report employees creating “shadow workflows” that IT teams cannot track.

The UK is facing similar challenges, with 75% of organisations saying they lack adequate oversight of AI agents interacting with sensitive data.

This is happening despite significant investment in more controlled AI environments. Across EMEA, 41% of organizations are building their own local or sovereign AI models specifically to combat Shadow AI. Nearly half (49%) are adopting a hybrid approach to do this, using a blend of local and sovereign models for sensitive data and global models for general tasks.

EMEA organizations are the outlier here, with 41% relying entirely on global AI providers for all use cases – suggesting the EU regulatory landscape is having a major impact on AI governance within EMEA enterprises.

“EMEA organizations are still getting to grips with governance in the new agentic era,” added Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam. “But the data shows the industry is having the wrong conversation about AI trust. Trying to control thousands of autonomous agents one-by-one simply doesn’t scale. To make AI safe at the enterprise level, organizations need to secure, govern and understand the data those agents depend on.”

EU AI Act confidence gap exposes governance risk

Adding to this pressure is the EU AI Act. The Act is already beginning to take effect, with further compliance deadlines rolling out through to 2028.

The research revealed that while the overwhelming majority (83%) of leaders feel the Act will have a positive impact on organizations and the wider landscape, 62% feel ‘ambiguities or grey areas’ may create compliance risk, while a further 63% fear it may introduce unintended operational or legal risks. The UK and Germany are particularly concerned here, with 74.4% and 73.6%, respectively, viewing the ambiguities as a compliance risk.

About the Research

The research was commissioned by Veeam and conducted by independent polling company Censuswide. The survey explores the perspectives of 1,000 enterprise IT, data, and security decision-makers at organizations with 500+ employees across the United Kingdom, Germany, France, and the Middle East and Africa (including Turkey, Israel, UAE, KSA, Nigeria, South Africa, and Kenya). The data was collected between April 21 and April 27, 2026. Censuswide abides by and employs members of the Market Research Society, which is based on the ESOMAR principles.

For more information, visit www.veeam.com.

About Veeam Software

Veeam®, the Data and AI Trust Company, delivers a unified data and AI trust layer that connects security, governance, compliance, privacy and resilience, powered by shared intelligence across the entire data estate. Veeam helps organizations establish, operationalize and continuously validate trust in their data so it can be used safely to accelerate AI at scale.

In an agentic era, security starts with data. As the market leader in both data resilience and data security, Veeam helps organizations reduce risk and strengthen control across the full data lifecycle by unifying policy-based access and protection controls, governance workflows, privacy safeguards and compliance reporting with resilience built in. Veeam provides deep contextual intelligence across data and identities, automates governance actions and remediation, and enables precision recovery so organizations can rapidly restore operations with clean, trusted data after ransomware, disasters, insider threats, rogue agents or human error.

Headquartered in Seattle with offices in more than 30 countries, Veeam protects over 550,000 customers worldwide, including 80% of the Fortune 500. Learn more at www.veeam.com or follow Veeam on LinkedIn @veeam-software and X @veeam.

Media gallery

About The Author
Business Wire