AI Governance and Data Sovereignty: From Policy to Enforcement in European Enterprises

The latest report from Antal in partnership with MakoLab, AI Governance and Data Sovereignty: From Policy to Enforcement in European Enterprises, examines how organisations can see where AI is being used, control what data it receives and demonstrate that the safeguards are working.

Deloitte’s data show the scale of the gap between growth and readiness. 74% of the surveyed organisations plan to implement agentic AI within two years, yet only 21% report having a mature governance model for autonomous agents.¹ The challenge is translating AI policies into controls that will continue to work as adoption expands.

Can an organisation demonstrate how its AI policy is applied in practice? The report examines the controls, responsibilities and evidence needed to answer that question.

Shadow AI involves tools used without organisational approval and approved tools used outside their authorised scope. The problem can remain hidden even when managers believe they have full visibility in terms of AI use.

Okta’s AI Agents at Work 2026 study, conducted by Apprize360, illustrates this gap. 96% of the respondent British managers are confident about the visibility of AI usage within their organisation, while 55% of the British knowledge workers surveyed admit to using unauthorised AI tools.²

Employees may choose external tools because they are faster, better suited to their needs or more readily available. Simply locking access can shift usage to personal devices, alternative accounts or informal integrations. Effective controls therefore need to be supported by approved tools that people can use to get their work done effectively.

A prompt can contain the same sensitive information as a protected document, such as personal data, source code, contract details or company strategy. Data classification needs to cover what employees enter into AI tools and what they store in corporate systems.

When prompts, files or retrieved content are sent to an AI service outside the organisation’s controlled environment, they should be assessed as external data sharing. The report explores which data can be used in which tools, which have to stay within the controlled environment and who approves any exceptions.

Data residency describes where data are stored. Data sovereignty also encompasses who can access them, which jurisdiction applies and how suppliers and sub-processors handle them.

Choosing a European cloud region leaves some of these questions unresolved. Organisations also need to understand the provider’s legal obligations and the wider chain of services involved in processing their data.

Strategic priority is not always translatable into action. SUSE finds that 98% of the surveyed organisations regard digital sovereignty as a strategic priority, but only 52% are taking concrete action.³

An audit trail needs to connect an AI output with the data, model and configuration that produced it. Policies alone cannot provide that evidence.

Models change and prompts are modified. Without records, it may become impossible to establish the conditions behind a specific recommendation. The report explains why organisations should retain inputs, outputs and configuration details from the outset. Reconstructing those conditions supports an investigation; however, it does not guarantee that a model will generate an identical response.

The report sets out five steps towards enforceable governance, with safeguards matched to the risk of each application. Three practical priorities are:

·       identifying the current status, including a register of tools used organically by teams;

·       appointing a business owner to be responsible for each significant AI application, its purpose, scope, risk and compliance;

·       building evidence from the outset, so that auditability is part of the architecture rather than a reaction to an audit.

The full framework also covers risk categorisation and technical controls, helping organisations connect policy with day-to-day practice.

Download the report to explore the five steps, the evidence organisations should retain and the questions that help assess their control over their data.

AI Governance and Data Sovereignty: From Policy to Enforcement in European Enterprises is the third publication in a research series by Antal in partnership with MakoLab. It was preceded by AI-Ready Infrastructure: Observability and Operations and A New Way of Working: Managing Software Delivery Using Agentic Engineering.

Designed for IT leaders and decision-makers, the programme maps the operational reality behind enterprise AI adoption. Forthcoming reports will cover:

·       The practical applications of neuro-symbolic AI;

·       AI adoption and readiness across European enterprises; a comprehensive quantitative study tracking the current state of play.