New research from Veeam Software has revealed a growing ‘shadow agent’ crisis across EMEA enterprises, with organisations struggling to maintain visibility and control as autonomous AI adoption accelerates.
According to the findings, 70% of organisations admitted that automated AI workflows were interacting with sensitive corporate data without full oversight, while 67% reported that employees were creating autonomous AI workflows that IT teams could not fully track.
As organisations race to operationalise AI, the findings highlighted a critical challenge: ensuring the data powering AI agents remains trusted, secure and resilient. Without appropriate governance, visibility and protection, businesses risk exposing sensitive information, increasing compliance risks and undermining the trusted data foundations required to scale AI safely.
Rising regulatory pressure and corporate accountability are also pushing AI governance beyond the technical back office and into the boardroom. Nearly one-third of organisations, 32%, said this pressure was already creating tension or conflict among executives.
AI governance becomes a C-suite liability
As compliance obligations across EMEA become more complex, including greater personal responsibility for senior executives around cyber resilience and regulatory compliance, business leaders are facing growing pressure.
The research found that 58% of enterprises surveyed were now subject to new corporate accountability laws. However, 12% said individual responsibilities remained shared and unclear.
The increased responsibility is having a clear impact on executive teams. Some 40% were concerned about personal liability or consequences, 39% reported increased board-level scrutiny and 37% said accountability had increased personal stress or anxiety. Almost a third, 32%, said it had created tension or conflict with other executives.
However, the research also pointed to a positive shift, with 45% saying increased accountability had improved alignment and focus at leadership level.
Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam, said: “Executives have never had more to think about around data governance and cyber resilience regulations. While the increased stress and tension are completely understandable, if the result is better alignment at the board level, the organization will be far better positioned to trust its data and AI governance in the agentic era. With greater alignment ultimately comes better data governance, visibility and protection across the organization.”
‘Shadow agents’ spread faster than governance
The findings revealed a fragmented approach to AI governance across EMEA. Germany faces particularly acute challenges, with 81% of leaders admitting that automated workflows were interacting with sensitive data without oversight, while 79% reported employees creating ‘shadow workflows’ that IT teams could not track.
The UK faces similar challenges, with 75% of organisations saying they lacked adequate oversight of AI agents interacting with sensitive data.
This is happening despite significant investment in more controlled AI environments. Across EMEA, 41% of organisations are building their own local or sovereign AI models specifically to combat shadow AI. Nearly half, 49%, are adopting a hybrid approach, combining local and sovereign models for sensitive data with global models for general tasks.
MEA organisations stood out, with 41% relying entirely on global AI providers for all use cases, suggesting differences in regulatory environments are influencing AI governance strategies across EMEA.
Pfaelzer said: “EMEA organisations are still getting to grips with governance in the new agentic era. But the data shows the industry is having the wrong conversation about AI trust. Trying to control thousands of autonomous agents one-by-one simply doesn’t scale. To make AI safe at the enterprise level, organisations need to secure, govern and understand the data those agents depend on.”
EU AI Act confidence gap
Adding to the pressure is the EU AI Act, with compliance requirements continuing to take effect through to 2028.
While 83% of leaders believed the Act would have a positive impact on organisations and the wider landscape, 62% said ambiguities or grey areas could create compliance risks. A further 63% feared it could introduce unintended operational or legal risks.
Concerns were particularly pronounced in the UK and Germany, where 74.4% and 73.6% respectively viewed ambiguities within the legislation as a potential compliance risk.
