BARC Measured the Governance Gap. It’s Where We Said It Was.

Pillar 01 · Security

BARC released its State of Data and AI Governance study. 234 data, AI, IT and business leaders, surveyed in July and August. It’s worth reading.

The headline numbers are rough.

97% of organizations have AI in production. Two thirds had an AI-related incident in the past 12 months. Privacy breaches hit 23% of them. Shadow AI hit 22%. Wrong outputs reaching customers, 21%.

Meanwhile 60% of respondents rate their governance as better than their competitors’. BARC counts 29% as actually mature. Somebody is wrong. Probably a lot of somebodies.

Where the controls sit

The number that matters most to me is in the middle of the report. 62% of governance teams focus their controls on the data layer. Model-layer controls sit at 45%. Infrastructure at 43%. Agent governance tooling at 10%.

Lineage views on agents in production: 9%.

So we’ve built a very good set of rules about data. Then we handed the data to systems that don’t read the rules.

A catalog tells you where the data is. A policy says who should touch it. Neither one stops anything. When a model pulls a contract into its context window, the policy is a PDF on SharePoint and the catalog is a record that it happened.

BARC says it plainly in their recommendations. Move governance deeper into the architecture. Put controls at the infrastructure layer.

I agree. I’d go one step further.

Put the control where the data physically lives

Encrypt on the client. Split the data into shards across independent jurisdictions. Only let it reassemble inside a boundary the owner controls.

Now the policy is enforced by math. An unsanctioned agent can’t read what it can’t reconstruct. A breached storage node holds fragments. A compelled operator has nothing to hand over.

Two of BARC’s top four incident types stop being detection problems.

Same logic for AI workloads. Run the model against data reconstructed inside the owner’s boundary. Write the output back into custody. You end up with a record of what ran, on what, and where the result went. That’s the lineage gap BARC is worried about.

The word that barely shows up

Sovereignty appears a couple of times in the report. Once in the executive summary as a multilayered concern in a volatile geopolitical environment. Once in a regional comparison, where North America leads EMEA on formal sovereignty controls.

That’s it. For a report on governing AI in 2026.

I understand why. Most governance frameworks assume the ground under them is stable. Your provider answers to your laws. Your data stays where the contract says it stays.

Anyone who has read the CLOUD Act knows how much of that is assumption.

Data privacy is the #1 Responsible AI priority in the survey at 60%. You can’t deliver privacy on infrastructure a foreign court can open. That layer is still missing from most governance conversations.

What I’d take from it

Keep your data governance tools. They’re the foundation. Keep human approval on sensitive agent actions. 59% rely on it, and BARC is right that it won’t scale.

Then ask one question about every control you own. If someone ignores it, what happens?

If the answer is “we’d find out later,” you have a policy. If the answer is “they get ciphertext,” you have a control.

Bias declaration: I run SkyeConnex. We build the data custody infrastructure described above, so I have an obvious interest in this argument. The numbers are BARC’s. Read the report and check my reading of it.