Data Governance · Whitepaper · 2026

The Data Foundations Behind Trusted AI

What organisations need to understand about data quality, access, provenance and control before AI can be trusted at scale.

Read Whitepaper

Executive Summary

Almost every organisation is running AI. Almost none can say their data is actually ready for it.

Dun & Bradstreet's 2026 AI Momentum Survey, drawing on responses from 10,000 businesses across 32 countries, found that 97% of organisations now report active AI initiatives, yet only 5% say their data is adequately ready to support them. Cloudera's report with Harvard Business Review Analytic Services, surveying more than 230 members of the HBR audience directly involved in AI data decisions, found that only 7% describe their data as completely ready for AI, while 73% say their organisation should be prioritising data quality more than it currently does.

Cloudera's separate Data Readiness Index, surveying nearly 1,300 IT leaders across the Americas, Europe, the Middle East, Africa and Asia-Pacific between January and March 2026, uncovered what it calls an "AI readiness illusion": 96% of organisations report integrating AI into core business processes and 85% say they have a clear data strategy, yet nearly four in five, around 80%, admit their AI initiatives are still constrained by limited data access, and only 18% say their data is fully governed despite 84% expressing confidence in its accuracy and completeness.

The stakes of getting provenance wrong were made concrete on 4 November 2025, when the UK High Court handed down judgment in Getty Images (US) Inc v Stability AI Limited [2025] EWHC 2863 (Ch), one of the first AI copyright disputes to reach trial anywhere in the world. Tellingly, even Getty, the party that owned the data and brought the case, abandoned its primary copyright infringement claims during the trial itself, unable to establish the direct evidential chain it needed between specific training images and the model built from them.

This whitepaper sets out why trusted AI at scale depends on four distinct data foundations, quality, access, provenance and control, and why an organisation strong in three of the four still cannot fully trust what its AI produces.

01 · The AI Readiness Illusion

Nearly every organisation is running AI. Almost none of them are running it on data built to support it.

Cloudera and Harvard Business Review Analytic Services surveyed more than 230 members of the HBR audience directly involved in their organisation's AI data decisions in October 2025, for a report bluntly titled "Taming the Complexity of AI Data Readiness." Only 7% described their organisation's data as completely ready for AI adoption; more than a quarter, 27%, said their data was not very or not at all ready. Seventy-three percent said their organisation should prioritise AI data quality more than it currently does, and an equal 73% said processing and preparing data for AI has been genuinely challenging.

The obstacles respondents cited follow a consistent pattern: siloed data and difficulty integrating sources (56%), lack of a clear data strategy (44%), data quality and bias issues (41%), and regulatory constraints on data use (34%). Only 23% said their organisation had an established data strategy for AI adoption, though a further 53% were actively developing one. Dun & Bradstreet's 2026 AI Momentum Survey, gathering responses from 10,000 businesses across 32 countries, found the gap this creates in its starkest form: 97% of organisations report active AI initiatives, while just 5% say their data is actually ready to support them at scale.

Ninety-seven percent adoption against five percent readiness is not a rounding error. It is the clearest possible evidence that most organisations have been running AI initiatives well ahead of building the data foundation those initiatives depend on to produce trustworthy results.

02 · Access: You Cannot Govern Data You Cannot Reach

A clear data strategy on paper means very little if the AI system itself cannot get to the data the strategy describes.

Cloudera's Data Readiness Index, surveying nearly 1,300 IT leaders at organisations with more than 1,000 employees between January and March 2026, found a striking paradox: 96% of organisations report integrating AI into core business processes, and 85% say they have a clear data strategy, yet nearly four in five, around 80%, admit their AI and data initiatives remain constrained by limited data access across environments. Cloudera's own framing for this gap is "the AI readiness illusion": the belief that an organisation is prepared to scale AI even while the underlying access to its own data remains unresolved.

The survey also found a confidence gap sitting directly behind the access gap: 84% of respondents felt confident in the accuracy, completeness and alignment of their organisation's data, yet only 18% said their data was fully governed, with a further 71% saying most of their data was governed. Data that looks reliable in isolation frequently breaks down the moment it is used across teams, systems or AI applications, exposing exactly the silos and inconsistent access that respondents in the HBR study also identified as their top obstacle.

The gap is not evenly distributed. Cloudera's industry breakdown found that 54% of telecommunications respondents said it was "extremely true" that they had full visibility into where their data resides, against only 30% in financial services and 31% in the public sector. On access specifically, 51% of telecommunications respondents said they could reach all their data at any time, compared with just 24% in financial services and 16% in the public sector, precisely the industries where AI decisions carry some of the highest regulatory and reputational stakes.

03 · Provenance: What Getty v Stability AI Actually Proved

Even the party that owned the data struggled to prove exactly where it ended up.

Getty Images alleged that Stability AI's Stable Diffusion model had been trained on millions of Getty's copyrighted images, scraped without a licence, and brought one of the first AI copyright disputes anywhere in the world to actually reach trial in the UK's High Court. On 4 November 2025, in Getty Images (US) Inc v Stability AI Limited [2025] EWHC 2863 (Ch), the court delivered its judgment, and the outcome was instructive well beyond its legal significance. Getty abandoned its primary copyright infringement claims during the trial itself, and on the remaining secondary copyright issue the court found that models such as Stable Diffusion contain no reproductions of the relevant works: there are, in the court's assessment, no copies inside the model. Getty's trade mark claim under section 10(3) of the Trade Marks Act was dismissed outright, though the court did find "extremely limited" infringement under sections 10(1) and 10(2), specific to early versions of Stable Diffusion that reproduced a visible Getty watermark in their outputs.

The significance of this case for data governance has little to do with which side technically prevailed. Getty owned the images in question, had direct commercial and legal interest in tracing them, and still could not sustain the evidential chain connecting specific training inputs to specific model behaviour once the claims were tested at trial. If the organisation with the clearest possible ownership stake in the data struggled to prove where it went, most organisations buying or building AI, with no comparable ownership claim over the data used to train the systems they now rely on, have essentially no practical ability to verify it after the fact.

Getty v Stability AI is not an isolated dispute. More than 35 distinct AI training-data lawsuits were active in major Western jurisdictions by the second quarter of 2026, including The New York Times against OpenAI and Microsoft, the Authors Guild class action, and Universal Music Group against Anthropic. Provenance has moved from a theoretical governance concern to a live, unresolved legal battleground, and organisations deploying AI built on data whose provenance they cannot independently verify are inheriting that uncertainty, whether or not they are ever named in a courtroom.

The Foundations Gap

Confidence in data is running well ahead of governance over it.

Independent 2026 research consistently shows organisations adopting AI faster than they are securing the data foundations that make its outputs trustworthy.

Enterprises With AI-Ready Data

Of enterprises say their data is completely ready for AI, despite widespread AI adoption already underway.

Cloudera & Harvard Business Review Analytic Services, 2026

Held Back by Data Access

Of enterprises say their AI initiatives are constrained by limited data access across environments.

Cloudera, Data Readiness Index, 2026

Data Fully Governed

Of enterprises say their data is fully governed, despite 84% expressing confidence in its accuracy.

Cloudera, Data Readiness Index, 2026

Together, these figures show that quality, access and governance are three separate gaps, not one, and closing any single one of them does not close the others.

04 · Control: Confidence Is Not the Same as Governance

Feeling confident about your data and being able to prove control over it are two different claims, and only one of them can be verified.

The gap between Cloudera's 84% confidence figure and its 18% full-governance figure is the clearest illustration in this research of what control actually means. Confidence is a belief people hold about their data. Governance is a demonstrable, auditable fact about what controls actually exist, who can access what, and how that access is tracked, and the data shows these two things diverging sharply as soon as data moves across teams, systems or AI applications rather than sitting in a single, isolated store.

This divergence becomes more urgent, not less, as agentic AI expands. The Cloudera and HBR study found that 65% of respondents expect many of their organisation's business processes to be augmented or replaced by agentic AI within the next two years, yet 47% said their organisation believes agentic AI can solve its own data quality issues. That belief inverts the actual relationship between the two: an agent given broader autonomy over ungoverned data does not fix the governance gap beneath it, it operates on top of that gap at greater speed and with less human review at each step, compounding whatever quality, access or provenance issues already existed.

Genuine control means an organisation can state, at any given moment, exactly what data a specific AI system can reach, under what policy, for what purpose, and can produce evidence of that on request, not simply report feeling confident that its data is broadly in order.

05 · Building the Four Foundations Together

Quality, access, provenance and control are four separate foundations. None of them substitutes for another.

Treat data quality as a named workstream with its own owner and its own budget, not a line folded into a broader AI strategy document, a distinction that matters given only 23% of organisations currently have an established data strategy for AI at all. Build a unified access and governance layer across hybrid environments before scaling agent-based use cases further, since access, not model capability, is the constraint cited by roughly 80% of surveyed leaders.

Maintain a defensible, ongoing record of where training and grounding data originated, its licence status and its consent basis, rather than assuming this can be reconstructed later if it is ever challenged, Getty v Stability AI shows that even a rights holder with direct ownership of the data in question can struggle to establish that chain once it is tested under legal scrutiny. Replace subjective confidence in data with objective, verifiable governance coverage: the gap between 84% confidence and 18% full governance is precisely the gap an organisation needs to close, and closing it requires evidence, not reassurance.

Sequence the expansion of agentic AI deliberately. With 65% of leaders expecting agentic AI to take on significantly more process ownership within two years, and only 18% of organisations currently able to claim full data governance, autonomy should expand only as governance closes the gap behind it, not in parallel with a governance gap that remains wide open, and certainly not on the assumption, held by 47% of leaders today, that the agent itself will resolve the underlying data problem.

06 · What Trusted AI at Scale Demands of Leadership

The evidence points toward five practical changes in how organisations should build the data foundations beneath their AI.

Name an owner and a budget for data quality specifically. With only 23% of organisations having an established AI data strategy, quality cannot remain an unstated assumption folded into a broader initiative.

Fix access before scaling autonomy. Roughly 80% of leaders cite data access as the actual constraint on AI value; closing that gap will do more for trustworthy AI than any amount of additional model capability.

Treat provenance as something to prove continuously, not reconstruct later. Getty v Stability AI shows that even the party owning the data can struggle to establish where it went once the question is actually tested.

Replace confidence with verifiable governance. The gap between 84% who feel confident in their data and 18% who can prove full governance over it is exactly the gap that needs closing, with evidence rather than reassurance.

Let governance maturity set the pace of agentic autonomy, not the reverse. Expanding what agents can access and do should follow demonstrated control over the data beneath them, not run ahead of it on the assumption the agent will sort it out.

Conclusion

Trusted AI was never a model problem. It was a data foundations problem wearing a model's face.

Ninety-seven percent of organisations have active AI initiatives; five percent say their data is actually ready for them. Eighty percent say data access, not model capability, is what is really holding AI back, and only eighteen percent can say their data is fully governed despite most feeling confident about it. And in a UK courtroom, even the party that owned the data in question could not fully reconstruct where it had gone once that claim was tested under scrutiny. These are four different findings, from four different studies, describing the same underlying condition from four different angles.

What closes the gap is treating quality, access, provenance and control as four distinct foundations that all have to be built, not one problem that a single fix, better tooling, a new policy, or the agent itself, can resolve on its own. An organisation strong in three of the four still cannot fully trust what its AI produces, because the fourth gap is exactly where the next failure, the next lawsuit, or the next silent error will surface.

AI can only be trusted at scale once the data beneath it can be. Everything else, the model, the interface, the use case, is built on top of that foundation, not instead of it.

References & Sources

Research and evidence informing this whitepaper.

This whitepaper draws on enterprise data readiness surveys and a landmark court judgment. Statistics and case details are attributed to their originating source wherever directly cited.

Cloudera, with Harvard Business Review Analytic Services. Taming the Complexity of AI Data Readiness. March 2026.

Referenced for findings on enterprise data readiness, prioritisation of data quality, and the obstacles organisations face preparing data for AI.

View source

Cloudera. The Data Readiness Index: Understanding the Foundations for Successful AI. April 2026.

Referenced for findings on data access constraints, the gap between data confidence and full governance, and industry-level differences in data visibility.

View source

Dun & Bradstreet. AI Momentum Survey. May 2026.

Referenced for the global finding that 97% of businesses have active AI initiatives while only 5% consider their data ready to support them.

View source

Bird & Bird. Stability AI Defeats Getty Images Copyright Claims in First of Its Kind Dispute Before the High Court. November 2025.

Referenced for the outcome and significance of Getty Images (US) Inc v Stability AI Limited [2025] EWHC 2863 (Ch).

View source

Research sources were reviewed for relevance to the themes examined in this whitepaper. Survey findings reflect the populations, methodologies and reporting periods of their respective source publications. Case details reflect the published judgment in Getty Images (US) Inc v Stability AI Limited [2025] EWHC 2863 (Ch) as reported by legal commentators at the time of writing and should be verified against the full judgment before being relied upon. This whitepaper is provided for general informational purposes and does not constitute legal advice.

Scroll