Notifications
Clear all
Topic starter
02/08/2026 11:34 am
TL;DR: Only 1 in 5 AI projects met their KPIs in MIND’s research, and the failures were traced less to model quality than to data debt, incomplete classification, unscanned storage, and ungoverned access. The security issue is that AI inherits whatever governance already exists, so weak data controls become operational failures fast.
NHIMG editorial — based on content published by Mind: Why most AI projects are failing
Questions worth separating out
Q: How should security teams govern AI classification for unstructured data?
A: Treat it as a control plane, not a metadata feature.
Q: Why do AI projects fail when the underlying data estate has weak governance?
A: AI projects fail because the model can only work with the data it receives, and untrusted data produces unreliable output even when the model is technically sound.
Q: What breaks when AI systems inherit broad repository access?
A: Broad inherited access lets AI systems reach data that was never intended for machine-scale retrieval, including stale, duplicated, or sensitive content.
Practitioner guidance
- Classify data before model rollout Require every AI use case to map the source repositories, ownership, sensitivity, and business purpose of the data it will consume before it is approved for production.
- Review machine access as part of AI design Identify the service accounts, API keys, and delegated permissions that AI tools will use, then verify they are scoped to the minimum data needed for the use case.
- Measure trust, not just usage Add controls that report on classification coverage, lineage completeness, and access exceptions alongside prompt volume and query counts.
What's in the full report
Mind's full blog covers the operational detail this post intentionally leaves for the source:
- The research context behind the 1 in 5 KPI result and the seven findings in the wider series.
- CISO quotes that explain how teams distinguished model problems from data governance failures.
- Practical recommendations for prioritising data trust controls before scaling AI use cases.
- Examples of the governance gaps that caused projects to be re-architected, paused, or walked back.
👉 Read Mind's analysis of why most AI projects are failing →
AI data trust gaps: what security teams need to fix first?
Explore further
02/08/2026 12:48 pm
Data trust debt is now an AI governance failure, not a data quality nuisance. When organisations feed AI systems from repositories they have not classified, validated, or reviewed, they create a structural failure mode that security tools alone cannot correct. AI inherits the trust state of the underlying data estate, so weak classification and unclear ownership become programme-level risk. Practitioners should treat data trust as a prerequisite control, not a post-deployment optimisation.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.
👉 Read our full editorial: AI projects fail when data trust and access governance lag
