Australia is switching on AI faster than it can govern it

Every week we sit with Australian business leaders who have AI running in more places than they can easily name. A chatbot here, a copilot there, an agent quietly booking things and moving data around in the background. The tools went live fast. The rules to run them safely are still being written. New research from Commvault puts hard numbers to that pattern, and the gap is worth your attention.

The adoption gap the numbers reveal

The headline is blunt. Australia and New Zealand organisations are accelerating AI adoption at pace, but many lack the governance and resilience controls needed to manage the growing risks tied to agentic AI and AI-driven environments. More than 30 per cent of organisations across the region are already trialling or deploying agentic AI across hybrid and multi-cloud environments, while 36 per cent are increasing AI investment by more than 25 per cent this year (Source: Commvault, 'State of Data Resilience ANZ 2026'). At the same time, data estates across ANZ have expanded by 30 per cent year-on-year, driven largely by AI deployment and adoption (Source: Commvault, 'State of Data Resilience ANZ 2026').

Now the part that should make you pause. Only one-third of organisations said they had rigorously assessed security and governance risks before deploying AI systems, while just 36 per cent have extended resilience planning to AI agents (Source: Commvault, 'State of Data Resilience ANZ 2026'). This is credible work, not a vendor guess. The independent survey was conducted by TRA, now part of Omdia, and included responses from 411 organisations across Australia and New Zealand, including CIOs, CISOs, IT leaders and senior technology decision-makers (Source: Commvault, 'State of Data Resilience ANZ 2026').

There is genuine movement on the governance side. Sixty-six percent of respondents now have policies for AI-generated data and content, up from 29% last year, signalling a rapid shift toward stronger risk and compliance frameworks (Source: Commvault, 'State of Data Resilience ANZ 2026'). Good. It also tells you how recently most organisations started, which means the controls are young and the deployments are already deep.

The local backdrop makes the point louder. On 10 August 2026, South Australia announced Australia's first royal commission into AI, with the Commission expected to commence on 1 October 2026 and a final report due no later than 1 July 2027 (Source: Gadens, 'South Australia announces Royal Commission into AI', August 2026). Policy is coming. It is arriving well behind the technology, and you cannot wait for it before you tidy your own house.

What practical governance looks like at each stage

Governance is not a binder. It is a short set of decisions you make deliberately as AI moves through your business.

When you are piloting. Name an owner for each use case, write down what data the tool can touch, and decide what it is allowed to do without a human in the loop. Keep a simple register of where AI is running. Most organisations discover they already have more live tools than the register would suggest.

When you are scaling. This is where agents start acting on your systems, and where the Commvault data shows the biggest gap. Extend your existing controls to the AI itself: access limits, logging, and a clear line of sight into what each agent can reach. If you operate under APRA obligations, note that Australian organisations face increasing regulatory pressure around operational resilience, governance and cyber preparedness, particularly under frameworks such as APRA CPS 230 and CPS 234 (Source: Tech Business News, 'Data Resilience Lagging Behind AI Adoption', May 2026). Your AI is now inside that perimeter.

When it is embedded. Test for failure before it happens. Decide how you roll back an agent's changes, who gets alerted, and how you recover the data and models AI depends on. Recovery planning that stops at your databases and ignores your agents leaves a hole exactly where the activity is growing fastest.

Why data readiness underpins the return

The value case and the risk case are the same conversation. Feed AI messy, ungoverned data and you get confident-sounding output you cannot trust, plus exposure you did not sign up for. As Commvault's Martin Creighan put it, AI is now central to how organisations operate but its value depends on the integrity of the data behind it, and that data must be understood, validated, and free of sensitive information (Source: Tech Business News, 'Data Resilience Lagging Behind AI Adoption', May 2026).

This matters for the return, too. Australia's own tracking shows plenty of activity and thin measurement. MYOB data shows 82 per cent of AI-using businesses report positive impact, but 46 per cent do not measure impact at all (Source: ScaleSuite, citing MYOB, 2026). Adoption is running well ahead of proof. The National AI Centre's monthly SME AI Pulse tracker, surveying 400 businesses each month through December 2025 to February 2026, found 43 to 44 per cent reported some level of AI adoption, up from 37 per cent a year earlier (Source: roi.com.au, citing National AI Centre, 2026). Getting your data in order is what turns that adoption into a number you can put in front of a board.

The honest read is that fast adoption is the right instinct. Fast adoption without knowing where your AI runs, what it can touch, and how you recover it is where the trouble sits. Closing that gap now is far cheaper than closing it after an incident.

The right next steps for you depend on where you are right now. Our AI Maturity Assessment is an easy place to start. After that, let's have a chat about your next steps.