Most companies cannot trace an AI decision back to its data. Can yours?

The PrompX BriefingN° 0419 October 2026On the table in AmsterdamMost companies cannot trace an AI decision back to its data. Can yours? As AI begins to act on company data, the quality of that data has become a board matter. The evidence says the weakness is not technology. It is ownership. By the PrompX Editors · 4 min read In September, Ireland’s data protection regulator fined the country’s health service €645,000. Patient records had turned up in derelict buildings, and one breach came to light on social media. The regulator’s finding was dry and devastating: the records “could not be deemed to be filed in any organised or accessible manner”. Few companies leave files in derelict buildings. Many are now asking AI to act on data they could not vouch for. In a study published on 2 October, IBM found that only 14% of companies have the unified, governed, real-time data that AI agents need. Nearly 60% say inconsistent data is already causing their agents to make errors, and only 39% can trace an AI-driven decision back to its source. The consequences have reached the top. In IBM’s survey of 3,221 executives at large companies in six European countries and the Gulf, 80% say an AI incident reached their board or C-suite in the past year. Only 40% of them changed their governance as a result. The figures 39% of companies can trace an AI-driven decision back to the data behind it. Only 14% have the governed, real-time data foundation that AI agents need.IBM Institute for Business Value with Oxford Economics: 1,000 executives in 14 countries and regions, 2 October 2026 80% of executives at large companies say an AI incident, from agent failures to data exposure, reached their board or C-suite in the past year. Only 40% of them changed their governance policy afterwards.IBM with Censuswide: 3,221 executives at companies with 1,000+ staff in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE, 14 October 2026 60% of data and analytics leaders cite cultural resistance as a key reason their data governance programmes fail; 40% cite a lack of funding. Gartner predicts that by 2027, 60% of organisations that ignore governance culture will fail to govern AI.Gartner: 223 data and analytics leaders, 21 September 2026 59% of chief executives say they are increasing their focus on internal data governance and controls.KPMG, Global CEO Outlook 2026: 1,400 CEOs, 15 October 2026 Where trust in data breaks The problem is upstream. AI does not create data problems; it inherits them and acts on them faster. When six in ten companies say inconsistent upstream data already causes their agents to err, the issue is not the model. It is the definitions, ownership and controls that sit long before it, in the systems where customers, orders and margins are first recorded. Governance fails on culture, not cash. Gartner’s finding is the most useful number in this briefing. Data governance programmes fail more often because people resist them than because they lack funding. More tools will not fix that. Clear ownership, in the business rather than in IT, will. Boards hear about incidents. Few change course. Eight in ten executive teams have now been told about an AI incident, yet most of them did not change their governance policy. Only 37% of companies in IBM’s EMEA sample have a board-reviewed estimate of the financial risk their governance gaps create, and where the business wants to move faster than governance allows, 56% press ahead within agreed risk limits. Regulators are checking the basics. Enforcement is increasingly about whether a company knows its own data. Ireland’s regulator fined Google €403 million in September over location data. Since 12 September, the EU Data Act requires connected products placed on the market from then on to give users access to their data by design, and Germany has named the Bundesnetzagentur to enforce it, with fines of up to 2% of worldwide turnover for certain breaches by the largest firms. AI does not fix bad data. It acts on it, at speed, and with confidence.Three moves for the next ninety days Give every critical dataset an owner in the business. Customer, product, revenue and margin data each need a named owner who answers for their quality and definitions. Ownership that sits only in IT is ownership no one can enforce. Make the decisions that matter traceable. For every AI-driven decision with financial, legal or customer consequences, require that you can show which data, which version and which model produced it. Put a price on the gap. Ask for a board-reviewed estimate of what your data and governance gaps could cost. A risk with a number attached gets managed; a risk without one gets discussed. For your next leadership meeting Which AI-driven decision from last month could we trace back to the exact data behind it? Who owns the definitions of customer, revenue and margin in our company, and do they agree? When an AI or data incident reached us this year, what did we change as a result? Now, two minutes. Below this briefing are five statements. Answer them for your organisation as it is today, and see where you stand. Sources Data Protection Commission, Decision following inquiry into the Health Service Executive, 2 September 2026. IBM Institute for Business Value, Closing the data architecture gap (with Oracle), 2 October 2026. IBM, Eight in ten EMEA enterprises escalate AI incidents to the board or C-suite, 14 October 2026. Gartner, Prediction on data governance culture, 21 September 2026. KPMG, Global CEO Outlook 2026, 15 October 2026. Data Protection Commission, Google fined €403 million over location data, 21 September 2026. Matheson, The Data Act access-by-design requirement comes into force, 18 September 2026. Potomac Law, EU Data Act one year in, 16 September 2026. The PrompX Editors

Where does your organisation stand?

Can your business trust its data?

More briefings

Europe postponed its high-risk AI rules. It did not postpone the rest.

What each euro of AI must buy in 2027

Your AI agents are already making decisions. Who signed off?

The new ransomware playbook starts with your backups