AWS Report Urges Enterprises to Build Security Governance Into AI Systems
Summary
AWS’s Reimagine 2026 report, based on interviews with 154 executives, identifies shadow AI, data leakage and weak oversight as risks. It recommends risk-based controls, human approval for agents and privacy safeguards.
Key points
- AWS’s report draws on 45-to-60-minute interviews with 154 executives at 128 organizations across 23 industries.
- The authors warn that slow approval processes can push employees toward shadow AI, increasing the risk of unmonitored data exposure.
- The report identifies proprietary data, customer information and confidential business intelligence as potential leakage risks, including through third-party tools.
- A survey cited in the report found that only 24% of participating European businesses had a documented responsible-AI approach, and 10% had a data-governance strategy.
- Organizations described risk-based reviews, human approval for AI agents and external security limits; the report advises expanding agent autonomy only after reliability is demonstrated.
- The report says organizations should protect privacy when AI processes employee communications, including by redacting sensitive information and being transparent about data use.
- High AI adoption does not necessarily mean useful results: one organization reported better work in fewer than one in 5,000 sessions despite 88% adoption.
Article Details
- Publisher
- AWS (Reimagine 2026)
- Report Period
- Interviews conducted over nine months; dates not specified
- Scope
- Confidential interviews with executives at organizations across 23 industries; also cites a Strand Partners survey of European businesses
- Sample Size
- 154 executives at 128 organizations
- Key Statistics
- The interviews covered 154 executives at 128 organizations in 23 industries.
- A Strand Partners survey cited in the report found that more than half of surveyed SMEs and large enterprises use AI; 24% had a documented responsible-AI approach and 10% had a data-governance strategy.
- A Boston University executive estimated that 40–50% of people at the university use AI at least weekly.
- One organization appeared 88% adopted, but produced better work in fewer than one in 5,000 sessions.
- Recommendations
- Build governance into AI systems and keep humans accountable for outcomes.
- Classify AI use cases by risk and apply controls suited to factors such as personal-data use, live versus batch processing, and human oversight.
- For AI agents, begin with human approval and expand autonomy only after reliability is demonstrated; retain the ability to narrow autonomy.
- Set security limits outside the agent rather than relying on embedded rules alone.
- Redact salary data, HR decisions, or personal communications before processing where needed, and be transparent with employees about data use.
People
Chris SedoreBoston University VP of Information Services and Technology and CIO; estimated weekly AI use at the university.Duncan MacdonaldStandard Bank CTO of Cloud Enablement; discussed challenges posed by regulatory differences across jurisdictions.Rafael CavalcantiBradesco Chief Data Officer and Director of Data and AI; built a risk-classification tree for AI use cases.Rashed IqbalRAK IDO CTO; discussed the need for a plan to use time saved through AI.Roberta SchwartzHouston Methodist Main Campus CEO and Chief Innovation Officer; described employee concerns about an AI project and message privacy.