Australia and New Zealand organisations are accelerating AI adoption at pace, but many lack the governance and resilience controls needed to manage the growing risks tied to agentic AI and AI-driven environments, according to new research from Commvault.

The company’s latest State of Data Resilience – Australia and New Zealand, 6th Edition (2026), found that more than 30 per cent of organisations across the region are already trialling or deploying agentic AI across hybrid and multi-cloud environments, while 36 per cent are increasing AI investment by more than 25 per cent this year.

At the same time, data estates across ANZ have expanded by 30 per cent year-on-year, driven largely by AI deployment and adoption.

The report suggests this rapid growth is making governance, oversight and resilience significantly harder to maintain.

The research highlights a widening disconnect between AI rollout and operational readiness.

While 66% of organisations now have policies governing AI-generated data and content — up sharply from 29% — many have yet to implement the controls needed to enforce those policies in practice.

The report found that 58 per cent of respondents lack high confidence in their ability to respond when AI systems are compromised or operating outside approved guardrails.

Only one-third of organisations said they had rigorously assessed security and governance risks before deploying AI systems, while just 36 per cent have extended resilience planning to AI agents.

According to Martin Creighan, organisations risk undermining AI outcomes if they fail to address the integrity and governance of the data underpinning these systems.

“AI is now central to how organisations operate but its value depends on the integrity of data behind it,” Creighan said.

“That data must be understood, validated, and free of sensitive information. Without strong governance and resilience across the AI lifecycle, organisations risk losing confidence in the business-critical outcomes AI delivers.”

The report also indicates organisations are prioritising AI explainability and transparency ahead of core resilience capabilities.

Explainability and transparency ranked as the top focus area at 22 per cent, while foundational resilience capabilities such as integration (14 per cent), incident response automation (12 per cent) and scalability (8 per cent) lagged behind.

Gareth Russell said resilience planning must evolve beyond traditional backup and recovery models as AI systems become increasingly interconnected across identities, infrastructure and applications.

“Agentic environments are inherently dynamic, with AI continuously interacting across data, identities, and infrastructure,” Russell said.

“Today, recovery isn’t just about restoring data, but bringing systems, configurations and dependencies back to a known good state. That level of control is critical to operating AI at scale.”

The findings come as Australian organisations face increasing regulatory pressure around operational resilience, governance and cyber preparedness, particularly under frameworks such as APRA CPS 230 and CPS 234.

The independent survey was conducted by TRA, now part of Omdia, and included responses from 411 organisations across Australia and New Zealand, including CIOs, CISOs, IT leaders and senior technology decision-makers.