Kiteworks Survey Finds Europe’s AI Governance Score of 33 Trails Its Security Score of 40

29% of European Organizations Rank AI Regulation Their Top Compliance Concern, Highest of Any Region

AMSTERDAM, NORTH HOLLAND, NETHERLANDS, July 29, 2026 /EINPresswire.com/ -- Kiteworks, which empowers organizations to effectively manage risk in every send, share, receive, and use of private data, today released European findings from its 2026 Data Security and Compliance Risk: Annual Survey Report, based on primary research with 459 security, compliance, risk, and IT professionals across 10 industries and three global regions. The findings expose a specific regional imbalance. Europe leads the survey on general security infrastructure but trails on AI governance.

Europe’s mean Data Security Maturity Score (DSMS), which tracks deployed controls protecting everyday human-driven data access alongside AI-specific safeguards, is 40 out of 100, the highest of the three regions measured, ahead of North America’s 38 and the Middle East’s 37. Its mean AI Governance Maturity Score (AIGMS), which measures governance capability for AI systems and agents, is 33, the lowest of the three, behind North America’s 39 and the Middle East’s 34. Read together, the two scores show whether controls are keeping pace with both people and agents. The combination produces a mean Data Security and Compliance Readiness Index (DSCRI) of 15, tied with the Middle East for the lowest of any region and well behind North America’s 19.

“Europe has security infrastructure other regions lack, and it still isn’t ahead on readiness,” said Tim Freestone, Chief Strategy Officer at Kiteworks. “The path forward is architectural. It requires a data policy engine that enforces controls at the data layer for every person and every agent alike, not behavioral policy people can route around. Europe’s gap isn’t security. It’s AI governance.”

EU/UK organizations rank AI-specific regulatory requirements as their top compliance challenge more than any other region, with 29% naming it their single biggest concern, compared to 24% in North America and 7% in the Middle East. Yet EU/UK organizations report the lowest compliance consequence rate of any region, at 57%, compared to 69% in North America and 76% in the Middle East. Regulatory concern has not translated into stronger AI governance.

Europe’s detection posture follows the same pattern. EU/UK organizations discover shadow AI usage monthly at 11%, compared to 24% in North America, and report AI tool data exposure incidents at 20%, compared to 36% in North America. Lower numbers reflect more controlled environments, though lower detection can also mean exposures go longer unnoticed.

“Europe is producing compliance activity, not governance architecture,” said Patrick Spencer, SVP of Americas Marketing and Industry Research at Kiteworks. “The region has the strongest regulatory pressure of any market in this survey and still isn’t converting it into AI governance capability. GDPR, DORA, NIS2, and the EU AI Act all demand evidence from the same teams. The organizations closing the gap are building one policy engine and one audit log that governs people and agents alike to meet all four at once.”

The control gap behind these numbers is global, not only European. Seventy-four percent of organizations worldwide lack purpose binding for AI data use, and no AI containment control measured in the survey is deployed by more than 31% of organizations. DORA, NIS2, and EU AI Act audit obligations now run on timelines that 50% of organizations cannot meet.

The gap between the top and bottom of this survey is 38 DSCRI points. The 19% of organizations in the Resilient quadrant (DSMS and AIGMS both at least 50) carry a mean DSCRI of 46. The 66% in the Exposed quadrant (both below 50) carry a mean DSCRI of 8, despite similar industry and size mixes. The difference is deployed AI governance controls. At the survey mean DSMS of 39, raising AIGMS from 35 to 60 adds roughly 10 DSCRI points, nearly double the gain from adding four security controls while AIGMS stays fixed. The report identifies seven priorities for closing that gap:

- Classify and enforce sensitive data
- Deploy AI-specific DLP through a centralized policy engine
- Integrate MFT and AI infrastructure with a SIEM
- Implement and test an AI kill switch
- Build audit trails that meet regulatory production timelines
- Assign dedicated AI data governance ownership
- Consolidate sensitive data exchange platforms

The full 2026 Data Security and Compliance Risk: Annual Survey Report includes global, industry, regional, and organization-size breakdowns.

Download the 2026 Data Security and Compliance Risk: Annual Survey Report.

The research was conducted by Centiment on behalf of Kiteworks in Q2 2026.


About Kiteworks

Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies.

Martin Brindley
Martin Brindley PR Ltd
+44 1256 762811
martin.brindley@gmail.com
Visit us on social media:
LinkedIn
Facebook
YouTube
TikTok
X

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.