What context and control governed organizations do differently

Across nearly every question in this survey, one line consistently separated the decision-makers at enterprises further along from the ones still catching up: Revenue, and with it, how early governance was built into the operating model rather than bolted onto it after the fact. Decision-makers at organizations at $100 million or more are consistently ahead on ownership, verification and regulatory readiness. In other words, revenue is a proxy rather than a cause. The pattern holds whether the topic is ownership, verification or regulation.

Source: Collibra/Harris Poll survey, p.3 (Q1), p.4 (Q2), p.5 (Q3), p.7 (Q6), p.8 (Q7)

Among those whose organizations use AI agents, decision-makers at larger enterprises are not immune to the problems described in this report: they are, if anything, more likely to have experienced agents accessing unauthorized data (37% vs 22%) and to be under real pressure to show ROI when the data foundation isn't ready to support it (52% vs 26%). Scale does not eliminate risk, it simply multiplies the number of agents capable of carrying it.

What these enterprises have done is make governance an architectural property of how they run AI rather than a step they revisit afterward. This is the same lesson enterprise AI keeps relearning at every stage of maturity: governance tends not to slow an organization down as it scales, but to be what makes that scaling possible in the first place.