Data governance in the AI era: protection that follows the file

Only 37% of the organizations that suffered a breach in 2026 were encrypting sensitive data both at rest and in transit. Another 53% were not, and 10% did not know (IBM, Cost of a Data Breach Report 2026, p. 21). In more than half of those cases, whoever reached the files found readable documents.

That number matters more now, because data has started moving far more than it used to. Since 2 August 2026 the transparency obligations in Article 50 of the AI Act, Regulation (EU) 2024/1689, apply across Europe. They close a framework that already included GDPR, NIS2, DORA, the Cyber Resilience Act and the Cyber Solidarity Act. For anyone designing a data architecture, one question decides everything else: does the document stay protected, and does that protection stay provable, once it leaves the systems that hold it?

Key takeaways

• The AI Act completes a European framework that GDPR, NIS2 and DORA had already shaped around one requirement: protect the data itself, know who accesses it, prove it afterwards.
• The human element appears in 62% of breaches, and breaches involving third parties grew 60% in a year to 48% of the total (Verizon, DBIR 2026). An attacker using valid credentials triggers no perimeter alert.
• Encryption is still the single largest cost reducer in a breach, worth 213,478 dollars per incident (IBM 2026, p. 50-51), and Article 34 of the GDPR can remove the duty to notify individual data subjects.
• FileGrant, the file-centric platform from CyberGrant, encrypts the document at creation and keeps permissions, revocation and audit trail active after the file has left the company. AIGrant, the private AI extension built into FileGrant, runs on-premise RAG over corporate documents without exposing them to public models.
• Shadow AI incidents rose from 20% to 43% of organizations, at an average cost of 5.39 million dollars (IBM 2026, p. 46).
• Ten years of European compliance work produced the discipline that AI adoption now requires everywhere. It is a technical starting position, not a compliance expense.

Why do AI investors now study data security?

Kevin Jiang is Co-Founder and General Partner at Mangusta Capital, a fund focused on Vertical AI, and an investor in CyberGrant. His career runs through Goldman Sachs, Soros Fund Management, Apollo Global Management and SoftBank Vision Fund, where he worked on deals including Flexport, ShipBob and Wiz.

His argument starts from a method he learned at Vision Fund scale: what decides the outcome of a technology is whether it stays niche or becomes something everyone depends on without thinking about it. That shift, he says, is now happening to AI and to the data security AI makes mandatory. For two years the industry measured one thing, model capability. Capability is no longer the constraint. Trust is: whether a company can bring its most sensitive data close to these systems without losing control of it. For twenty years enterprises built walls around data, and walls assume the data sits still. AI assumes the data moves. Two assumptions in conflict, inside the same company.

He also reads Europe differently from most American investors, who treated GDPR and everything that followed as a brake on innovation. Europe spent a decade building the strictest privacy and data governance rules in the world, and for a long time the rest of the world saw only the cost. Then came a technology cycle decided by who controls the data and under which rules. European companies were forced to build discipline around data, and that discipline is now what everyone needs.

Why does the perimeter no longer protect files in motion?

That reading has a precise technical counterpart, and it is the ground I have worked on for twenty years. Most Data Loss Prevention deployments rest on one assumption: data lives inside the perimeter and must be intercepted on its way out. That held when files sat on internal servers and the exit routes were few and watchable. That world is gone.

A document is now created in the cloud, opened on a personal device, shared with a supplier, pasted into an AI assistant, synced to services IT never sees. Boundary controls still help. The premise underneath them is what fails. Once the content crosses the boundary in readable form, nothing is left protecting it, and an incident that exposes readable data has no closing date: that information stays usable for years. I covered this in more detail in Traditional DLP is obsolete.

Perimeter and file: what each layer covers

Perimeter controls remain necessary. File-centric protection covers the rows where the data has already left the controlled environment.

What do GDPR, NIS2, DORA and the AI Act actually require?

None of these texts names a product. All of them repeat the same technical requirement in different words.

Article 32 of the GDPR asks for measures appropriate to the risk and lists encryption among the first examples. NIS2, transposed in Italy through Legislative Decree 138/2024, names access control and cryptography among its risk management measures and sets tight notification windows: early warning within 24 hours, update within 72, final report within one month. DORA, Regulation (EU) 2022/2554, applicable since 17 January 2025, requires financial entities to encrypt data at rest and in transit, to apply least privilege access, and to supervise ICT providers closely. Even the AI Act guidance on marking generated content points to cryptographic methods for proving origin and authenticity.

Four frameworks written for different purposes, one shared denominator: protect the data as such, know who accesses it, be able to demonstrate it later.

What protects a document when the attacker already has valid credentials?

Attackers rarely climb the wall now. They walk through the front door, with working credentials or by convincing someone to open it. The human element appears in 62% of breaches, and third-party involvement grew 60% in a year to 48% of the total (Verizon, DBIR 2026). In the IBM sample the leading initial attack vector is voice or SMS phishing at 17% of breaches, with supply chain compromise second and a breach originating at a partner adding an average 227,250 dollars to the cost (IBM 2026, p. 22-23 and 50-51).

Someone entering through the official door sets off no perimeter alarm, because the access is legitimate. That is why protection has to move onto the document. If the file stays encrypted and under policy while an intruder is already inside, the open door costs far less.

Shadow AI: how do you govern data before it reaches the model?

The same pattern applies to public AI tools. An employee pastes a confidential contract into an assistant to get the clauses summarized, and at that moment the data leaves company control without triggering anything. The numbers stopped being marginal: shadow AI incidents went from 20% to 43%, at an average cost of 5.39 million dollars against 4.63 the year before, and 92% of AI-related breaches happened in organizations without adequate access controls (IBM 2026, p. 46 and 64). Among breached organizations, 68% had no AI governance policy at all.

Banning the tools achieves little. The work sits upstream, in governing the data before it reaches the model, and in giving people an internal alternative that actually works. More on this in Shadow AI and confidential data.

How do FileGrant and AIGrant handle data that keeps moving?

FileGrant, the file-centric platform from CyberGrant, applies the principle described above: the document is encrypted at creation with quantum-safe cryptography, and the protection stays attached to the file for its entire life cycle. Permissions, post-sharing revocation, screen capture blocking and audit trail keep working when the document already sits on a supplier’s device or inside a cloud service IT does not administer. Anyone reaching the file without authorization gets unreadable content, and the company keeps the record of who did what, which is precisely what NIS2 and DORA require it to demonstrate.

On the AI side, AIGrant is the private AI extension built into FileGrant. It indexes and classifies corporate documents and answers in natural language through a private RAG pipeline, installable on-premise, where documents, index and model stay on company servers and the data never feeds public models. While retrieving documents it applies FileGrant’s RBAC permissions, before composing the answer, so a user cannot extract from an answer what sits in a file they are not cleared to open. That is how you give people the tool they would look for anyway, without the confidential contract ending up in a public assistant. The technical detail is in On-premise enterprise RAG.

Neither replaces the existing stack. Both sit alongside Microsoft 365 and the collaboration tools already in place and close the protection gap left there, the way Connector does for files in SharePoint and OneDrive, without migration.

What is encryption worth once prevention has failed?

Here is the lever every regulation names and few companies use fully. Exfiltrated data that stays encrypted and unintelligible is worthless to whoever took it, and Article 34 of the GDPR can remove the obligation to communicate the breach to individual data subjects, which means fewer notification duties and lower incident costs, from fines to legal fees.

The figures support it. In IBM’s Cost of a Data Breach Report 2026, encryption ranks among the largest cost-reducing factors at 213,478 dollars per breach (p. 50-51), against a global average cost that reached 4.99 million dollars (p. 10-11). Mean time to identify and contain a breach is still 247 days. Encryption contains the damage once prevention has already failed.

Why is quantum-safe cryptography a governance decision?

There is also a quiet deadline that rarely makes it into budget planning. Data encrypted today with classical algorithms is being collected by actors who expect to decrypt it later, once computing power allows: the harvest now, decrypt later logic. For information that must stay confidential for a decade, clinical records, industrial designs, multi-year contracts, migrating to quantum-safe cryptography with the NIST standards, CRYSTALS-Kyber and FIPS 203 (ML-KEM, August 2024), stops being a laboratory topic.

The progress data shows how little margin is left: 26% of organizations have a post-quantum cryptography project under way, 69% have none, and only 34% run structured controls over keys and certificates (IBM 2026, p. 63 and 65). Which data to migrate first is covered in the 2026 guide to post-quantum encrypted file sharing.

Who answers for data security now?

Recent regulation pushes accountability upward. NIS2 assigns direct responsibility to management bodies, with personal sanctions reaching temporary suspension from managerial duties, and DORA places ultimate responsibility for ICT risk with the management body.

In Italy the move from declaration to proof was set by ACN Determination 379907/2025, signed on 18 December 2025 and applicable from 15 January 2026: entities added to the register during 2025 must adopt the baseline security measures within 18 months of receiving their inclusion notice, which means by October 2026, while incident notification started in January 2026. For entities added during 2026, Determination 127434/2026 moves the deadlines to 31 July 2027 for the measures and 1 January 2027 for notifications. The exact dates differ by entity, because they depend on when each notice arrived. The operational detail is in NIS2 deadline October 2026.

Under the AI Act, failing the transparency obligations carries fines up to 15 million euros or 3% of total worldwide annual turnover, whichever is higher.

Europe’s advantage stays theoretical until someone uses it

Jiang closes with something that sounds, from an investor, like an assignment handed across the table: real change does not happen in a presentation or an investment memo. It happens the day a CIO or a CISO, in an ordinary meeting room, decides that protecting the data itself is the foundation the AI strategy rests on. Boards make that decision, and the market follows them.

Here is my own part. For years the question for anyone designing security was how to keep attackers out. The question that matters now is what happens when they get in anyway, or when an AI system handles confidential documents and finds them ready to use. Europe learned earlier than most, often expensively, how to build discipline around data. In the AI era that discipline is worth a concrete technical advantage. Who uses it first is still open.

Valerio Pastore, Co-founder & CTO, CyberGrant

Frequently asked questions

What does data governance mean in the AI era?

It means defining who can access a document, with which permissions and with what traceability, and keeping those rules in force once the file leaves company systems: cloud storage, personal devices, suppliers, AI tools. Perimeter governance stops at the network boundary, while file-centric governance stays attached to the document for its entire life cycle.

Why is traditional DLP no longer enough with AI?

Traditional DLP was built to intercept data on its way out of the perimeter. AI tools open a channel that model does not watch: a document pasted into a public assistant crosses no gateway and raises no alert. According to IBM (Cost of a Data Breach Report 2026) shadow AI incidents rose from 20% to 43% of organizations, at an average cost of 5.39 million dollars.

How does FileGrant protect a document after it leaves the company?

FileGrant, the file-centric platform from CyberGrant, encrypts the document at creation with quantum-safe cryptography and keeps permissions, post-sharing revocation, screen capture blocking and audit trail active even when the file sits on an external device or in a cloud service the company does not administer. Anyone reaching the content without authorization gets unreadable data.

Do you need FileGrant to use AIGrant?

Yes. AIGrant is an extension of FileGrant, not a standalone product. It works inside the platform’s encrypted space and applies FileGrant’s RBAC permissions while retrieving documents, before composing the answer, so a user cannot obtain from an answer the contents of a file they are not authorized to open.

What do NIS2 and DORA require regarding encryption?

NIS2 lists cryptography and access control among its risk management measures and sets notification windows of 24 hours for the early warning, 72 hours for the update and one month for the final report. DORA, Regulation (EU) 2022/2554, requires financial entities to encrypt data at rest and in transit, to apply least privilege access, and to maintain documented oversight of ICT providers.

By when must NIS2 baseline security measures be in place in Italy?

For entities added to the ACN register during 2025 the deadline is 18 months from the inclusion notice, as set in Article 3 of ACN Determination 379907/2025, which means by October 2026; the exact date depends on when each entity received its notice. For entities added during 2026, Determination 127434/2026 sets the deadline at 31 July 2027, with incident notification starting 1 January 2027.

What is quantum-safe cryptography and which data does it concern?

Quantum-safe cryptography uses algorithms designed to resist a future quantum computer, such as CRYSTALS-Kyber, selected by NIST and published as FIPS 203 (ML-KEM) in August 2024. It applies first to information that must stay confidential for many years, because that data can be collected today and decrypted later under the harvest now, decrypt later logic. According to IBM (2026) only 26% of organizations have started a post-quantum migration project.