AI is already in production at 97% of organizations. Two thirds of them have experienced at least one AI-related incident in the past twelve months, from data privacy breaches to biased outputs and shadow AI. The question is no longer whether you need an AI governance framework. It is whether your framework actually controls what AI does in production.
Most framework guides list principles: fairness, transparency, accountability. This one starts from data. The 2026 BARC study “The State of Data and AI Governance”, based on a global survey of 234 data, AI, IT and business leaders, shows where organizations stand, where their controls stop, and what the AI Leaders do differently. From those findings, we derive six building blocks for an AI governance framework that holds up in production.
What an AI governance framework is
An AI governance framework is the set of roles, rules, controls and metrics that determines how an organization builds, deploys, monitors and takes responsibility for its AI systems, including the data, models and agents behind them.
Reference frameworks such as the EU AI Act, the NIST AI Risk Management Framework or ISO/IEC 42001 define what has to be achieved. Your own framework defines how it happens in your organization: who decides, which controls apply to which AI workload, and how you prove that they work. A framework that exists only as a policy document reduces little risk. BARC puts it plainly: policies only reduce risk when they are translated into controls inside live AI workflows.
An AI governance framework also builds on data governance. AI is only as reliable as the data and context it works with, which is why data governance is the foundation for AI. But as the study shows, data governance alone is not enough.
Build a trustworthy data foundation to enable AI-driven automation and reliable decision-making. Download the whitepaper to learn how to establish Data Governance as a strategic capability — and unlock scalable automation and AI.
Where AI governance stands in 2026: six findings
1. AI is in production, and so are its incidents
AI runs across business processes, analytics, data management, integration, coding and customer-facing work. Document analysis leads with 62% deployment, followed by data management and integration (55%) and AI-infused analytics (54%). This breadth makes governance a business operating requirement rather than a specialist compliance task.
The incidents are already here. In the past twelve months, data privacy breaches and biased or harmful outputs each affected 23% of respondents. Unauthorized or shadow AI followed at 22%, and incorrect AI outputs reaching end users or customers at 21%.
2. Most organizations overestimate their maturity
BARC classifies an organization as an AI Leader when its AI program is mature on seven dimensions: security, data access and use controls, executive leadership, legal framework, project oversight, enterprise architecture, and standards and policies. After two years at around 20%, the share of AI Leaders has risen to 29%.
Yet 60% of respondents rate their data and AI governance as better than their main competitors. Twice as many organizations believe they are ahead as actually qualify as mature. IT stakeholders are even more confident than business stakeholders, which matters because IT often owns the budget needed to close the gaps.
3. AI adopters centralize governance
More than two thirds of organizations (69%) run either a fully centralized governance program (31%) or a center of excellence that sets standards centrally and lets distributed teams execute (38%). Among AI Leaders, the share is even higher: 40% fully centralized and 48% using a center of excellence. Federated and decentralized models have fallen to 14% and 7%.
4. The tools govern data, not AI
Governance tooling still focuses on data fundamentals. AI-specific tools trail far behind:
| Governance technology in use | Share of organizations |
|---|---|
| Data quality management | 58% |
| Data catalog, lineage and metadata management | 38% |
| AI model monitoring and observability | 26% |
| AI/ML model registry and inventory | 23% |
| LLM and GenAI guardrails | 23% |
| Dedicated AI governance platforms | 20% |
| Agent governance | 10% |
Data governance tools remain the right foundation. But they do not automatically govern model behavior, AI outputs, agent actions or AI-driven decisions.
5. Controls stop at the data layer
62% of governance teams focus their controls on the data layer. Model-layer controls reach only 45%, infrastructure-layer controls 43%. Yet prompts, context, retrieval, outputs, agent actions and deployment environments span all of these layers. Governance that stops at isolated checkpoints leaves the rest of the AI workload uncontrolled.
6. Agent governance depends on human oversight
To control AI agents in production, 59% of organizations require human-in-the-loop approval for sensitive actions. 40% define action boundaries, 38% use tool or API whitelisting and 38% monitor agent behavior continuously. Only 16% have kill switches and 9% use lineage views.
“Humans cannot compensate for the lack of automated control systems.” BARC, The State of Data and AI Governance, 2026
Human oversight is a sensible first step. It will not scale as more agents reach production.
The BARC study “The State of Data and AI Governance” is based on a global survey of data, AI, IT and business leaders. It shows what separates the AI Leaders from the rest of the market, and which steps turn governance from a compliance exercise into an operating model that lets AI scale with confidence.
Six building blocks of an AI governance framework
BARC closes the study with six recommendations. Read together, they describe the building blocks of an AI governance framework that works in production.
1. An operating model, not a policy project
Define clear ownership, decision rights, escalation paths and monitoring routines for every AI workload. The study shows how roles split today: CxOs set direction, business owners oversee, engineers execute. But oversight is thin at the top. Only 39% of respondents name the chief data officer as overseeing governance, 38% the chief AI officer and 29% the CISO. BARC recommends that these roles oversee governance jointly, while AI/ML engineers, data engineers and developers build the controls into models, pipelines and agents.
2. Tooling that covers AI, not just data
Use existing data governance investments as the foundation, then add AI-specific capabilities: model registries, monitoring, guardrails, agent governance, audit logging, lineage and workflow accountability. Evaluate tools by one criterion: do they make governance enforceable across the AI lifecycle? BARC calls for a central control plane that provides consistent policies, visibility and accountability across environments, instead of a collection of disconnected tools.
3. Human oversight as part of a control system
Decide explicitly where human approval is required, which agent actions are permitted, how exceptions are escalated and how activity is audited. Then add operational controls such as audit logging, risk assessment, rate limiting, kill switches and lineage views. Human oversight should be one part of the control system, not the control system itself.
4. Controls on every architecture layer
Use the data layer as the starting point, not the end point. Map where AI workloads use data, context, models, outputs and actions, then define controls for each layer:
| Layer | Controls |
|---|---|
| Data | Access and quality |
| Application | Workflow and output controls |
| Model | Testing and monitoring |
| Infrastructure | Deployment, identity, network and cloud controls |
5. Data quality for the data AI actually uses
Document analysis, knowledge retrieval, coding support and agentic workflows depend on unstructured and contextual information, not just structured tables. Extend quality controls to documents, knowledge bases, code, contracts, metadata, embeddings, retrieval pipelines and context sources. Check whether information is current, correctly classified, authorized, traceable and fit for AI use. Poor context can be just as damaging as inaccurate structured data.
6. Metrics based on the risks governance reduces
Today, organizations mostly measure governance by the coverage of AI use cases (37%), the reduction of data quality incidents (33%) and the business value of governed AI projects (31%). One gap stands out: 41% name a lack of skilled personnel or training as their top obstacle, but only 12% measure employee training completion. Translate the main failure risks into a small set of operating metrics, such as incident reduction, regulatory compliance, business value, adoption of required controls and employee training.
EMEA and North America: two stages of maturity
The study shows clear regional differences. In North America, 37% of organizations qualify as AI Leaders and 79% have centralized governance structures. In EMEA, the figures are 17% and 50%.
The obstacles differ too. EMEA organizations struggle with fundamentals: 40% name inadequate data quality as a top obstacle (North America: 15%) and 35% cite siloed data (North America: 17%). EMEA respondents also report more shadow AI incidents (29% vs. 18%), and only 30% have formal sovereignty policies for AI processing and storage, compared with 56% in North America. North American organizations, by contrast, worry more about scaling risks such as changing regulations and controlling AI agents.
For European organizations, this sets the order of work. An AI governance framework starts with connected, trustworthy data and clear data sovereignty, and only then scales to models and agents.
Shadow AI shows how these gaps play out in daily work. Where governance is not organized centrally and the approved route to data is slow or blocked by silos, employees turn to AI tools that nobody has approved. BARC expects shadow AI to become a pervasive problem as more knowledge workers deploy their own agents. We look at the figures, the risks and five steps to bring it under control in our article Shadow AI: why EMEA reports more unsanctioned AI incidents.
How SoftProject puts the framework into practice
The study’s core message matches what we see in customer projects: governance has to act, not just document. SoftProject brings the building blocks together on one converged platform instead of a stack of separate tools:
- Connect: integration, ETL and API management bring data from all systems together and break up the silos that hold back 35% of EMEA organizations.
- Trust: data governance with data catalog, master data management and data quality makes data and context reliable, traceable and fit for AI use.
- Act: process automation and governed agent workflows turn policies into controls, with approvals, boundaries and audit trails built into the process.
Across all three layers, governance works as one control plane: meaning, quality, lineage, policies, access and evidence in one place. That is what lets AI move from pilot to production. Learn more about AI enablement with SoftProject.
Edouard Cante is responsible for the strategic direction and further development of SoftProject’s product portfolio as Chief Product Officer. With a strong understanding of the market and a high level of innovative drive, he advances customer-centric solutions and ensures the company’s long-term competitiveness.
FAQ AI Data Governance
What is an AI governance framework?
An AI governance framework is the set of roles, rules, controls and metrics that determines how an organization builds, deploys, monitors and takes responsibility for its AI systems, including the data, models and agents behind them. It translates requirements from regulation and internal policies into controls inside live AI workflows.
What should an AI governance framework include?
Based on the 2026 BARC study, a framework needs six building blocks: an operating model with clear ownership and decision rights, tooling that covers AI and not just data, human oversight embedded in a control system, controls on the data, application, model and infrastructure layers, data quality for the unstructured data AI uses, and metrics based on the risks governance reduces.
Who should own AI governance?
BARC recommends that chief data officers, chief AI officers and CISOs oversee data and AI governance jointly, while business and product owners take an oversight role and technical experts such as AI/ML engineers, data engineers and developers execute the controls. Today, only 39% of organizations name the CDO as overseeing governance.
How do organizations govern AI agents today?
Most rely on human oversight: 59% require human-in-the-loop approval for sensitive agent actions, 40% define action boundaries and 38% use tool or API whitelisting. Only 16% have kill switches. BARC concludes that human oversight alone will not scale and must become part of an automated control system.
How do you measure the success of AI governance?
Organizations most often measure the coverage of AI use cases (37%), the reduction of data quality incidents (33%) and the business value of governed AI projects (31%). BARC recommends a small set of operating metrics tied to the main risks: incident reduction, regulatory compliance, business value, adoption of required controls and employee training.
