We asked 155 practitioners who are scaling AI inside their organizations one question the category keeps dodging: now that AI is live, who actually governs the data behind it? The answer is reshaping the buying center, the budget, and the vendor landscape — and the tools built for the old owner are getting left behind.
For a decade, governing sensitive data was the privacy office's job. In 2026 it isn't. 57% of organizations say IT / Engineering now owns data governance for AI — the privacy office / DPO is named by just 2%. The work followed the AI: whoever ships the models inherits the obligation to govern what they touch.
This isn't a category waiting on pilots. 79% already have AI scaling across functions or deeply embedded, and 85% say that adoption is materially reshaping their privacy and governance priorities. The result is a market that is actively shopping: 73% are in-market within 12 months, 89% with budgets increasing. The pressure is real and the money is moving.
Ask organizations to rate themselves and 81% say their governance is already “automated” or “managed.” Ask what actually happened in the last twelve months and the swagger thins: 63% took at least one hit — an audit finding, a breach, a regulatory inquiry, or a missed data-rights deadline. Maturity is being self-declared faster than it is being earned, and the gap is where new tools get bought.
Here is the opening. Awareness peaks with the one legacy enterprise brand respondents already know from everything else — then collapses. Recognition for the purpose-built specialists clusters low and spreads thin; no challenger has claimed the AI-governance slot in buyers' heads. In a market this in-market, the absence of a default is the whole opportunity — recall is defaulting to incumbency, not fit.
When buyers do go looking, a new AI or data initiative is the most common trigger — not a compliance deadline. They vet credibility through independent reviews, certifications and analyst rankings before they will talk; they want case studies with real metrics and technical depth, not narrative; and the decision runs through a committee that now seats engineering, security and the data team side by side. The motion is technical, proof-led, and multi-threaded.
Governance now sits with engineering and security. Messaging and product built for the privacy office alone are aimed at a 2% minority of the decision.
73% in-market with rising budgets is a buying wave, not a forecast. The cost of being unknown is highest in exactly the year buyers are choosing.
Buyers feel mature and still got hit. Proof that surfaces the blind spots they can't see — coverage of what AI is actually touching — beats another maturity pitch.
No specialist owns the AI-governance category in buyers' minds. Recall is defaulting to incumbency. Whoever plants the flag with proof and reach takes the default.
This is an independent benchmark, not a vendor survey. Vendor questions measure the category at large; no product is presented as the study's sponsor, and no respondent is identifiable in any published output.
42 Research runs independent benchmarks on the questions B2B categories keep dodging. We can walk your team through the data behind this report.
