A new report has flagged a wide gap between AI governance policies and their actual enforcement across Indian enterprises.

Delinea’s 2026 Identity Security Report, titled The AI Enforcement Gap, found that 99 per cent of Indian organisations have a formal policy defining what data AI tools and agents can access. Yet 84 per cent said an AI tool or agent had accessed sensitive data beyond its intended scope in the past year.

Indian firms also give AI tools wider access than global peers. About 76 per cent of Indian organisations allow AI tools to access employee data, compared with 51 per cent globally. Similar gaps exist for customer information, financial records and source code.

The report found that 87 per cent of Indian firms say their AI data access policy is actively enforced, against 71 per cent globally. But 98 per cent remain confident they could demonstrate compliant AI access to a regulator.

“At that point, a policy alone stops being enough,” said Cynthia Lee, vice president for APJ at Delinea. She said firms will need to prove who authorised each access and what the agent did.