The 2026 State of AI and Data Privacy Report

Contributing Editor

Do you have a corporate data privacy compliance mandate for AI/ML and analytics workflows?

While 86% have a mandate for AI/ML and analytics environments, that's still less than the 99% who have a mandate for non-production environments in general. This could be because of three reasons:

1. AI programs are new, and security/compliance teams haven't caught up.
2. AI innovation is seen as so important/strategic that no one wants to stand in the way.
3. Regulations haven't caught up yet, or teams don't yet understand implications of existing laws on AI programs.

The top use case (cited by 64%) for mandating the protection of sensitive data is analysis and reporting to inform business operations. Only 37% cited AI/ML model training and fine-tuning as a use case for protecting sensitive data. This is likely because while everyone has well-established analysis and reporting workflows in place, not everyone is doing significant model training and tuning at scale.

For which of the following use cases does your organization mandate the protection of sensitive data? (Select all that apply.)

Confidence in AI/ML & Data Privacy is Good — But Only if You Can Back It Up 

Our research proves that enterprises are making efforts to support data privacy, and as a result, enterprises are growing increasingly confident that they’re compliant. 97% say that they’re moderately to extremely confident in their ability to identify every instance of sensitive data residing in non-production environments. The remaining 3% describe themselves slightly confident, meaning all enterprises have at least somewhat confident in how they maintain data privacy. 

Another surprising amount of confidence: 98% are confident in their enterprise’s ability to protect sensitive data in AI/ML.

But confidence doesn’t mean your organization is safe from risk, especially if your data privacy practices aren’t airtight. Confidence could mean enterprises aren’t maintaining a critical eye when it comes to assessing their data privacy risk. While our research shows that these organizations do have compliance and masking policies, we also found that many organizations don’t stick to those mandates.

All enterprises we surveyed (100%) have data subject to regulation in their non-production environments, and 57% report an increase in the volume of sensitive data in them. That’s not too surprising to us, considering 84% have data compliance exceptions.

But what does that mean for these confident enterprise leaders? Many of them sacrifice data privacy in the name of speed and innovation. In their eyes, masking and data protection processes slow down processes. However, it’s only the manual processes that will. If you leverage these — rather than automated processes — you’ll likely experience the kind of slowdown innovative organizations fear. This only compounds for AI/ML.

What is your level of concern with the following involving AI/ML development and training environments at your organization?

When it comes to addressing these fears, preparation is key. Let’s discuss the core solutions to minimizing potential damage:

Identifying the “Why” Behind Non-Compliance 

While there’s never a “perfect” excuse for not protecting sensitive data, enterprises do have their reasons. When asked why they don’t, our respondents cited concerns such as data quality degradation (24%), implementation burden (23%), cost (18%), and slowing down innovation (14%).

What is preventing your organization from protecting all your sensitive data in non-production? (Select all that apply.)

Especially as organizations continue to ramp up agentic development, they need high-quality data and effective management that also includes protection. They need to know that they have compliant, production-like data that will move at the speed of AI.

Many organizations often fall victim to two pitfalls:

In short, organizations take shortcuts vs. adopting a comprehensive approach. Data ends up being a bottleneck that only gets worse as AI workflows demand more data, faster.

But why do enterprises make exceptions and end up non-compliant in AI/ML and analytics workflows, specifically? Our research found that 32% say it’s hard to protect unstructured data sources, 26% say protecting data prohibits getting realistic, production-like data, and 25% say protecting data does not preserve relationships — among other reasons.

What challenges do you experience or foresee in trying to achieve data privacy in AI/ML and analytics workflows? (Select all that apply.) 

Which solution do you consider the most purpose-fit approach to protect data for the following use cases?

Static masking also tops the charts for AI/ML and analytics across criteria and above counterparts such as synthetic data and dynamic masking. Respondents cited it as top in terms of referential integrity (41%), realism (38%), cost (38%), scalability (32%), ease of use (31%), and speed (29%).

Which of the following approaches do you believe supports your needs best on each criterion for delivering privacy-compliant data to AI/ML and analytics workflows and data sources?

Analytics teams are specifically looking for certain qualities in their data protection solution, including security (46%), ease of us (28%), and scale/speed (22%), among others.

What are the most important criteria you use to evaluate a data protection solution for your organization?

Many organizations use a portfolio approach for data protection — selecting between and combining tokenization, synthetic data, dynamic/static masking, etc. — to meet their specific needs. That way, they may be able to meet their security and scalability requirements.

Analytics professionals are specifically looking for the right solution to protect and mask their platforms like Microsoft SQL Server (47%), Microsoft Azure (44%), Databricks (41%), and Oracle (30%).

What data sources does your organization need to mask when used in non-production environments? (Select all that apply.)

This just goes to show how many different sources could hold data relevant to AI/ML workflows — and how important it is that they’re secured. The tools and techniques used to do so should work in a platform-agnostic manner, so you can achieve your analytics team’s top priorities (ease of use, scale/speed, sensitive data discovery across sources, etc.) across your organization.
 

Perception vs. Reality: What Tools Enterprises Actually Use, Prefer, & Need 

Teams have a wide assortment of approaches to choose from, and many enterprises leverage a plethora of approaches to meet their needs. But which is their best or preferred approach for their use cases? 

Respondents ranked synthetic data as most purpose-fit for AI/ML workflows, according to our research, but as we’ve seen, actual use of it in AI/ML lags perception. Only 28% use synthetic data extensively in AI/ML workflows. Despite this, most organizations (77%) across all focuses have used synthetic in some capacity. 

To what extent has your organization used synthetic data in AI/ML workflows?

Evaluating Data Protection Outlook & Needs 

Static data masking leads the charts across all facets. Synthetic unexpectedly ranks on the lower end in some cases. Nevertheless, synthetic and data masking together can cover bases for data protection. For providing irreversible protection, 65% of enterprises cite static data masking and 42% cite synthetic data as proficient. They also rank highly for data realism: 60% say static masking and 36% say synthetic provides it.

Which solution(s) would be sufficient to meet your organization’s needs if you required a data protection method that ...

Some of these stats aren’t too surprising. Subsetting is driven by legacy tools and not purpose-built for security or compliance, so it erodes data quality and delivery speeds. Tokenization is also more niche and specifically used for things like sharing data with partners.

However, the numbers surrounding synthetic data and data realism give us pause. Let’s talk about them.

The Synthetic Data Disconnect: What’s Your Solution Missing? 

Despite the optimistic outlook on synthetic data for AI workflows and high adoption rates, enterprises aren’t as confident in its overall data protection qualities:

With a somewhat negative outlook on these, we worry that enterprises are simply not getting effective solutions that will meet their needs. The right synthetic data solution should give enterprises confidence that the data is high quality, a great tool for preventing data breach/theft, and able to maintain referential integrity across databases.

Especially if it’s considered the top option for AI/ML workflows, synthetic data must maintain high standards for quality. What happens if bad data goes into AI? You get bad outcomes like software defects. AI workflows therefore become useless without good data. If you don’t have the right solution, that’s what will happen.

Referential Integrity Isn’t Just a Positive. It’s Essential. 

Let's go back to a stat shared earlier in the report: 25% of enterprises say that preserving relationships is one of the top challenges they face when trying to achieve data privacy in AI/ML and analytics environments.

This data reflects a similar sentiment and outlook. When asked which solution(s) would be sufficient to meet their needs if they required a data protection method that provides referential integrity within and across databases, here’s what enterprises said: