Veeam Research Finds ‘Shadow Agents’ Outpacing AI Governance Across EMEA
Organisations across EMEA are struggling to keep pace with the rapid adoption of autonomous AI, with new research from Veeam Software highlighting a growing “shadow agent” problem. The research found that 70% of organisations admit automated AI workflows are interacting with sensitive corporate data without full oversight. At the same time, 67% say employees are creating autonomous AI workflows that IT teams cannot fully track.
The findings point to a growing gap between the speed at which organisations are deploying AI and their ability to govern the data and workflows supporting it. Without adequate visibility, governance and protection, businesses face increased risks around sensitive data exposure, compliance and the reliability of the information being used by AI systems.
AI governance is also becoming a leadership issue as regulatory requirements and corporate accountability increase across EMEA. Nearly one-third of organisations surveyed, 32%, say growing regulatory and corporate accountability pressures are already creating tension or conflict among executives. Meanwhile, 58% report being subject to new corporate accountability laws, although 12% say individual responsibilities remain unclear.
The increased accountability is having a measurable impact on executives. Forty per cent are concerned about personal liability or consequences, 39% report greater board-level scrutiny and 37% say the issue has increased personal stress or anxiety. However, 45% believe increased accountability has improved leadership alignment and focus.
“Executives have never had more to think about around data governance and cyber resilience regulations,” said Tim Pfaelzer, General Manager and Senior Vice President for EMEA at Veeam. “While the increased stress and tension are completely understandable, if the result is better alignment at the board level, the organisation will be far better positioned to trust its data and AI governance in the agentic era.”
The governance challenge varies across EMEA. Germany reported particularly high levels of unmanaged AI activity, with 81% of leaders saying automated workflows interact with sensitive data without oversight and 79% reporting employee-created “shadow workflows” that IT cannot track. The UK faces a similar challenge, with 75% of organisations reporting insufficient oversight of AI agents interacting with sensitive information.
Some organisations are responding by bringing AI workloads closer to home. Across EMEA, 41% are developing local or sovereign AI models to address Shadow AI concerns, while 49% are adopting hybrid approaches that use local or sovereign models for sensitive workloads and global models for more general applications. MEA organisations differ from this trend, with 41% relying entirely on global AI providers across all use cases.
“EMEA organisations are still getting to grips with governance in the new agentic era,” Pfaelzer said. “Trying to control thousands of autonomous agents one-by-one simply doesn’t scale. To make AI safe at the enterprise level, organisations need to secure, govern and understand the data those agents depend on.”
The EU AI Act is adding further pressure as organisations prepare for compliance requirements that will continue to roll out through 2028. While 83% of respondents believe the legislation will have a positive impact on organisations and the wider technology landscape, 62% are concerned that ambiguities and grey areas could create compliance risks. A further 63% fear unintended operational or legal consequences.
Concerns are particularly high in the UK and Germany, where 74.4% and 73.6% respectively view regulatory ambiguity as a compliance risk. The findings suggest that as AI moves from experimentation to autonomous enterprise operations, trust, visibility and governance of the underlying data may become as important as the AI models themselves.
