Key points
- Smarsh Inc. reports that only 26% of enterprises have governance keeping pace with AI deployment.
- Financial institutions remain liable for agent actions even when built outside compliance platforms.
- AI can now analyze a year of email, messages, and prompts to create business context.
Financial institutions are facing a governance gap as artificial intelligence moves beyond pilot programs into core operations. According to a study released by Smarsh Inc., only 26% of enterprises say their governance frameworks are keeping pace with AI deployment. This statistic emerged during the Smarsh EDGE event in New York, where industry experts discussed the shift from archiving communications for regulators to using them as business intelligence.
By the numbers
- 26% of enterprises report governance frameworks keeping pace with AI deployment.
- 1 year of email, messages, and AI-prompt traffic can now be analyzed by AI.
- Regulations are technology-agnostic, yet institutions remain liable for agent actions.
What the figures mean
The low adoption rate of aligned governance suggests a significant operational risk for managed service providers supporting financial clients. Customers are building their own agents outside compliance platforms and accessing data through Model Context Protocol servers. Because regulations remain technology-agnostic, financial institutions remain liable for their agents’ actions. Gemma Allen, host at theCUBE, stated that data is a huge moat for companies in 2026, emphasizing that the move to a system of intent is won or lost in the data battleground.
What should you do?
Managed service providers must assess whether their clients have visibility into AI-generated communications. Check if clients are using Model Context Protocol servers to access data outside standard compliance tools. Ensure that logging mechanisms capture not just final outputs but also the prompts and agent-to-agent interactions. Verify that current governance policies explicitly cover autonomous agents, as traditional archiving methods may not apply to these dynamic systems.
Operational impact
Teams usually need to verify if external AI agents are operating within defined compliance boundaries. Check whether current logging captures agent-to-agent communications, which often bypass standard email archiving. Inform legal and compliance departments about any autonomous tools accessing sensitive data, as liability remains with the institution. Ensure that governance frameworks are built into the foundation of new AI deployments rather than added as an afterthought, preventing regulatory gaps.
What to do and how to stay safe: Smarsh
- Audit all AI tools used by staff to ensure they are integrated with compliance platforms.
- Implement logging for AI prompts and outputs to maintain a traceable record.
- Review governance policies to explicitly include autonomous agents and their actions.
- Monitor for data accessed via Model Context Protocol servers outside standard channels.
Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of enterprises have governance keeping pace with AI?
According to Smarsh Inc., only 26% of enterprises say their governance frameworks are keeping pace with AI deployment.
Are financial institutions liable for actions taken by autonomous agents?
Yes, financial institutions remain liable for their agents’ actions, even if those agents are built outside compliance platforms.
Can AI analyze historical communications for business intelligence?
Yes, AI can now analyze a year of email, messages, and AI-prompt traffic to turn it into business context.
