AI governance strategy: Beyond the compliance facade

AI is creating urgency at the board level and a definitional problem in the market. In June 2026, Gartner published its inaugural Magic Quadrant for AI Governance Platforms, offering a framework for evaluating the platforms organizations can use to oversee their AI estates: cataloging AI use cases, managing model risk, enforcing responsible AI policies, and demonstrating compliance with emerging regulations like the EU AI Act. But any governance strategy built entirely around model oversight is missing the foundation. Before you can govern AI systems, you need to govern what those systems can touch.

Across conversations with CIOs and CISOs, a different concern keeps surfacing. They need to govern the sensitive data AI ingests and reuses, and the agentic identities proliferating in their environments. These distinct but urgent problems are not the focus of Gartner’s report.

The stakes are real: Netwrix’s 2026 Data & Identity Security Report, which surveyed 2,317 security and IT leaders worldwide, found a 43% breach rate across organizations where AI significantly increased the identity footprint over the past 12 months. That’s nearly four times the 11% breach rate across organizations where it hadn’t. A compliance framework alone won't close that gap.

Organizations are scaling AI with insufficient data and identity controls

AI governance has two dimensions, and most frameworks only address one

Gartner's definition is accurate, but incomplete.

Following Gartner’s definition, AI Governance Platforms are designed to govern the AI system itself: what models are in use, how they behave, whether they comply with policy, and whether the organization can demonstrate accountability to regulators. That's one dimension of AI governance.

For most organizations, the more urgent concerns to address first are (1) getting their data house in order, and (2) shoring up their identity controls. In an AI context, this includes governing what data AI can access, and the identities AI assumes across their environments. Every AI initiative, from a simple Copilot deployment to a complex agentic workflow, operates on data. If that data is overexposed, misclassified, or accessible to over-permissioned identities, no amount of model-card documentation or bias testing will prevent a breach. And as AI agents are granted their own access rights, including service accounts, tokens, and persistent permissions, they become identities themselves, with all the attack surface that implies.

Non-human identities: The governance gap attackers will find first

One question deserves particular attention: how well are you governing non-human identities? AI agents are no longer a future concern. They’re being deployed today, and they’re acquiring access rights to data, systems, and APIs at a pace most identity governance programs were not designed to track. An AI agent with standing, always-on access to sensitive data is an identity risk as real as any privileged human user, and in many environments far less scrutinized. If your identity governance program doesn't explicitly cover non-human identities and AI agents, it has a gap that attackers will find before your auditors do.

Our survey data underscores the urgency: 74% of organizations do not have a single, unified view of sensitive data and which identities can access that data. Organizations racing to deploy AI on top of that foundation may be accelerating their business, but they're also amplifying their risk.

Data and identity security: The prerequisite for AI governance strategy

While Gartner’s report focuses on governing AI usage, it’s imperative that CIOs, CISOs, and compliance officers embarking on an AI governance program prioritize data security and governance, as well as identity security and governance. Every IT and security leader should start today with an appraisal of their own readiness for AI, starting with a review of their data and identity posture.

To help in this effort, Netwrix has compiled a checklist of questions to ask your teams:

AI governance checklist for data security and identity security readiness

• Have we discovered and classified all of our data?
• Do we have a complete inventory of where sensitive data resides across our environment?
• Do we have a single, unified view of where our sensitive data is and what identities (human, service accounts, AI agents, etc.) can access it?
• How quickly can we determine which identities have access to a specific piece of sensitive data?
• Can we identify excessive or unnecessary data access permissions?
• Are our data access rights as tight as they could be (e.g., are we applying least privilege, or do we have some overprovisioning)?
• How quickly can non-human identities gain access to sensitive data in our environment?
• How well can we discover, track, and monitor identities with data access rights?
• How mature are we in governing non-human identities?
• Are our data access controls for non-human identities (including AI agents) as tightly managed as those for our human identities?
• Can we immediately revoke access to sensitive data when it is no longer needed?
  • For humans? For AI agents?
• Can we execute continuous discovery of the data, and which identities can access it, or are we still performing periodic reviews that leave potential exposure gaps?
• Can we detect risky or toxic access combinations (e.g., approve + modify + delete)?
• When excessive or risky access is identified, how quickly can we remediate it?
• How often are privileged accounts granted standing, always-on access to sensitive systems or data?
• Are we confident that our directory environment (e.g., Active Directory, Entra ID, etc.) is free of misconfigurations that could enable privilege escalation?
• Can we block sensitive data and source code from flowing to non-sanctioned LLMs at our endpoints?
  • How about beyond Windows (e.g., for Mac or Linux devices)?
• Do we have visibility into what data Copilot can access, and is the data governed properly so sensitive data is not inadvertently exposed to employees via Copilot?
• Do we have visibility and control over use of plaintext tokens and credentials in our AI coding environments (a common practice exploitable by attackers)?
• How confident are we that we can demonstrate compliance with emerging AI regulations (e.g., the EU AI Act, or other national/local/industry regulations)?
• Who is accountable for AI-related risks in our organization?
  • Are they equipped with sufficient visibility and control to answer board or auditor questions?

Answers to questions like these provide a sense of where your gaps are and areas to prioritize to ensure AI readiness.

IT and security teams are stretched to the limit

In the Netwrix survey, we learned that 60% of organizations name either budget constraints or a skills and staffing gap as the biggest barrier to improving identity and data security today. Even as AI creates new urgency, resource-constrained IT and security teams still have options to streamline identity and data governance and security.

One pressing challenge for small and large teams alike is tool fragmentation: 20% of survey respondents named this as their top barrier to improving identity and data security, which places it just behind budget constraints and skills and staffing gaps.

Reducing tool sprawl to strengthen your AI governance strategy

Netwrix is making it easier for stretched teams to succeed by reducing tool sprawl with Netwrix 1Secure™, which unifies critical data and identity security and compliance capabilities in one SaaS environment. 1Secure can generate reports in as little as 20 minutes to highlight exposure risks and provide remediation guidance.

You can also benchmark your security maturity versus peer organizations using the free Security Maturity Assessment tool. To see how Netwrix approaches AI governance for Copilot and LLM data protection, visit the AI Governance platform page.

AI governance without data and identity security is a compliance facade

An AI governance program that only governs AI systems, without governing the data AI can access and the identities AI assumes, is an incomplete strategy. The organizations that get ahead of this aren’t waiting for a governance platform to tell them how their models are behaving. They're starting today by understanding their data posture, tightening their identity controls, and treating AI agents as the identities they are. That's the work that makes the difference between a governance program that checks an auditor’s boxes and one that actually reduces risk.